File name:

2018-02-16-Emotet-Maldoc.zip

Full analysis: https://app.any.run/tasks/f92ebdfe-b23c-4b1f-bd81-38fd44d7a489
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: December 05, 2022, 22:16:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
emotet
trojan
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C7242C9A64E0093A00BCAE1378C8BA62

SHA1:

8E03F467648321B8E2ECC4D0B99C9089F9CF3555

SHA256:

6C9F44451E76EA2A9685C2E70AA4F6533B201BE5B9C6E45EA445F47BFC9159DC

SSDEEP:

3072:ZMYfWjFi6J4LbKW9CfunNzU11X0if/1NUrcgIvhyJHgCtm4bk7zfx:ZJ7+4LbV9vNQtjLnP8JHhtm4o7Tx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • wlanwin.exe (PID: 2284)
      • wlanwin.exe (PID: 1816)
      • secmsi.exe (PID: 3188)
      • secmsi.exe (PID: 2784)
    • EMOTET was detected

      • secmsi.exe (PID: 3188)
    • EMOTET detected by memory dumps

      • secmsi.exe (PID: 3188)
  • SUSPICIOUS

    • Application launched itself

      • wlanwin.exe (PID: 1816)
      • secmsi.exe (PID: 2784)
    • Starts itself from another location

      • wlanwin.exe (PID: 2284)
    • Connects to unusual port

      • secmsi.exe (PID: 3188)
  • INFO

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1872)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1872)
    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start winrar.exe wlanwin.exe no specs wlanwin.exe no specs secmsi.exe no specs #EMOTET secmsi.exe taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1872"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\2018-02-16-Emotet-Maldoc.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1816"C:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\wlanwin.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\wlanwin.exeWinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1872.11598\wlanwin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2284"C:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\wlanwin.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\wlanwin.exewlanwin.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb1872.11598\wlanwin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2784"C:\Users\admin\AppData\Local\Microsoft\Windows\secmsi.exe"C:\Users\admin\AppData\Local\Microsoft\Windows\secmsi.exewlanwin.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\secmsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3188"C:\Users\admin\AppData\Local\Microsoft\Windows\secmsi.exe"C:\Users\admin\AppData\Local\Microsoft\Windows\secmsi.exe
secmsi.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\microsoft\windows\secmsi.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
2568"C:\Windows\system32\taskmgr.exe" C:\Windows\system32\taskmgr.exeExplorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
2 810
Read events
2 764
Write events
45
Delete events
1

Modification events

(PID) Process:(1872) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1872) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1872) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1872) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1872) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1872) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\2018-02-16-Emotet-Maldoc.zip
(PID) Process:(1872) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1872) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1872) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1872) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\Maldoc extracted script files\VZaYbmGtext
MD5:98697AD593E3D8AC3BD40627A76CE431
SHA256:69292833366A8D3EF1D1E2E8D7B75574292212F573B282F6A17F2B01E79C2819
1872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\322-64-058762-618 & 322-64-058762-233.docdocument
MD5:F435BF778F96DE1131A714C3EFA78058
SHA256:BEA874DCAEEB584EBC8CBF157FB9DBC3FF0DB8E39F9A645D10BDCCF3AF7E3FB5
1872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\Maldoc extracted script files\BzisiPADmtext
MD5:03E3F0C8A48EB20926E464E5638633E4
SHA256:E1FB4A07AB82860DF5B13EC4ACB5C6A83584C0F12C3F302E4BCA26D69609B4CE
1872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\Maldoc extracted script files\ThisDocumenttext
MD5:C598C45B0D9D3090599FF1DF77C5D612
SHA256:76F615001478CC8D4CCE6FE76F75B2CA62880736645E205DFCE15FC20F92E650
1872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\Maldoc extracted script files\LLcZCRPldJXTntext
MD5:E5369BC45CBFE61CC2E502B7E92EB374
SHA256:788E73086DB623A6F87F16B22312DBE75A7C356CBA91028647564D524F84C12C
1872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\Maldoc extracted script files\SWznfnhPtext
MD5:1782148F84BB2B5E0A2225CD6D6D3FD0
SHA256:0A4C45EC704D04727B07742157328AEC92CC237E6CE0811A2DDEC127EB42099D
2284wlanwin.exeC:\Users\admin\AppData\Local\Microsoft\Windows\secmsi.exeexecutable
MD5:B4B768B594A7A999743B203B80CF2D14
SHA256:E0D69A6E9B4ABFB79954DD73EAC0AEC0D4F3B3FC5A9DD5AF9202B621949748CA
1872WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1872.11598\wlanwin.exeexecutable
MD5:B4B768B594A7A999743B203B80CF2D14
SHA256:E0D69A6E9B4ABFB79954DD73EAC0AEC0D4F3B3FC5A9DD5AF9202B621949748CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
9
DNS requests
1
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3188
secmsi.exe
POST
37.187.57.57:443
http://37.187.57.57:443/
FR
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3188
secmsi.exe
37.187.57.57:443
OVH SAS
FR
malicious
3188
secmsi.exe
69.45.19.251:4143
LEVEL3
US
suspicious
3188
secmsi.exe
37.97.135.82:4143
Signet B.V.
NL
suspicious
69.45.19.251:4143
LEVEL3
US
suspicious

DNS requests

Domain
IP
Reputation
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3188
secmsi.exe
A Network Trojan was detected
ET TROJAN Win32/Emotet CnC Checkin (POST)
3188
secmsi.exe
A Network Trojan was detected
ET TROJAN W32/Emotet.v4 Checkin
3188
secmsi.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
3188
secmsi.exe
Potentially Bad Traffic
ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1
3188
secmsi.exe
Potentially Bad Traffic
AV POLICY HTTP traffic on port 443 to IP host (POST)
No debug info