Overview

overview

10

task1

 

10

task2

 

10

Analysis

  • max time kernel
    135s
  • resource
    win7v191014
  • submitted
    29-01-2020 22:14

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INVOICE JSM9193_1565826.doc

  • Sample

    200129-tw57ntqase

  • SHA256

    5452b9448c3310adaa86f6020c32d6ae4727fce5049f613ad9242e2f35e94eff

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Family

emotet

C2

186.10.98.177:80

154.70.158.97:80

95.66.182.136:80

68.183.18.169:8080

178.62.75.204:8080

178.33.167.120:8080

144.76.56.36:8080

61.204.119.188:443

163.172.107.70:8080

156.155.163.232:80

91.117.31.181:80

153.183.25.24:80

110.2.118.164:80

195.250.143.182:80

162.154.175.215:80

50.116.78.109:8080

72.176.87.136:80

184.162.115.11:443

37.70.131.107:80

181.39.96.86:443
rsa_pubkey.plain

Signatures

  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Modifies registry class 280 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Process spawned unexpected child process 1 IoCs
  • Loads dropped DLL 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\INVOICE JSM9193_1565826.doc"
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Drops file in System32 directory
    • Suspicious behavior: AddClipboardFormatListener
    PID:1964
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\0.9022486.jse"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Process spawned unexpected child process
      PID:1440
      • C:\Users\Admin\AppData\Local\Temp\5av84da72.exe
        "C:\Users\Admin\AppData\Local\Temp\5av84da72.exe"
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1312
        • C:\Users\Admin\AppData\Local\Temp\5av84da72.exe
          --c670fe42
          4⤵
          • Suspicious behavior: EmotetMutantsSpam
          • Suspicious use of SetWindowsHookEx
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:816
  • C:\Windows\SysWOW64\msrasymbol.exe
    "C:\Windows\SysWOW64\msrasymbol.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Executes dropped EXE
    PID:1668
    • C:\Windows\SysWOW64\msrasymbol.exe
      --3cbf467f
      2⤵
      • Suspicious behavior: EmotetMutantsSpam
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Drops file in System32 directory
      PID:1056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/816-12-0x0000000000400000-0x000000000048F000-memory.dmp

    Filesize

    572KB

    Download

  • memory/816-11-0x0000000000300000-0x0000000000317000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1056-16-0x00000000003E0000-0x00000000003F7000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1056-17-0x0000000000400000-0x000000000048F000-memory.dmp

    Filesize

    572KB

    Download

  • memory/1312-7-0x0000000000330000-0x0000000000347000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1440-6-0x0000000002680000-0x0000000002684000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1668-14-0x0000000000270000-0x0000000000287000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1964-2-0x0000000007BD0000-0x0000000007BD4000-memory.dmp

    Filesize

    16KB

    Download