emotet | 2a3a9f34754ac1e674a6cdc1f6a5a0d7ebfba0ec5d2ccddd469aac7adfc4182a

Analysis

max time kernel
115s
max time network
212s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
01/04/2022, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
doc_69156.xls
Size 50KB
Sample220401-tf7bradhb8
SHA256 2a3a9f34754ac1e674a6cdc1f6a5a0d7ebfba0ec5d2ccddd469aac7adfc4182a
MD5 0591ce4eb656d52273c3b88236fd242a
SHA1 4a176873b82944703a344044d95ad46d70b79702
SHA512 1ebf21395987c11670abd3c22f92c2995683537905c5885d5ff7229e09e3fb7a34941124109319a37e8b9bb827c5a113e6467a8d48863006404bd8648e58a67c
MD5 SHA1 SHA512

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

5.189.160.61:443
94.177.178.26:8080
202.29.239.162:443
54.38.143.246:7080
119.59.125.140:8080
185.148.168.15:8080
188.166.229.148:443
2.58.16.87:8080
104.131.62.48:8080
103.82.248.59:7080
37.59.209.141:8080
103.133.214.242:8080
195.77.239.39:8080
128.199.192.135:8080
78.47.204.80:443
59.148.253.194:443
87.106.97.83:7080
45.71.195.104:8080
85.214.67.203:8080
139.196.72.155:8080
210.57.209.142:8080
194.9.172.107:8080
116.124.128.206:8080
118.98.72.86:443
203.153.216.46:443
202.28.34.99:8080
54.37.228.122:443
202.134.4.210:7080
88.217.172.165:8080
196.44.98.190:8080
195.154.146.35:443
217.182.143.207:443
36.67.23.59:443
207.148.81.119:8080
190.90.233.66:443
66.42.57.149:443
85.25.120.45:8080
93.104.209.107:8080
68.183.93.250:443
103.42.58.120:7080
5.56.132.177:8080
159.69.237.188:443
51.68.141.164:8080
54.37.106.167:8080
198.199.98.78:8080
54.38.242.185:443
62.171.178.147:8080
37.44.244.177:8080
103.41.204.169:8080
78.46.73.125:443
185.148.168.220:8080
191.252.103.16:80
175.126.176.79:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2144	1344	regsvr32.exe	75

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1344	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1344	EXCEL.EXE
1344	EXCEL.EXE
1344	EXCEL.EXE
1344	EXCEL.EXE
1344	EXCEL.EXE
1344	EXCEL.EXE
1344	EXCEL.EXE
1344	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\doc_69156.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1344
- C:\Windows\SysWow64\regsvr32.exe
  C:\Windows\SysWow64\regsvr32.exe -s ..\xcah.dll
  2⤵
  - Process spawned unexpected child process
  PID:2144
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Mdrenlmadxsp\uudbpyfvehfqa.qni"
    3⤵
    PID:4760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xcah.dll

Path C:\Users\Admin\xcah.dll
Size 432KB
SHA256 d0ee8b3d2cb16a9266c513fe103441c57260e4ca5a703da94b4eed38902f954c
MD5 27513ea9550636494542b0d2a604190d
SHA1 525ffd97bcf5d57a65b230b711e365733abf5134
SHA512 4e82846541a82f565e05dbe597b034bfc92815f81bea907b1fb3df52d75ab9ca574321f9d9b42818842893c89146ba4356644e037b4710878e9711264c6d80ed
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKDJS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKlrsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

xcah.dll

Path C:\Users\Admin\xcah.dll
Size 432KB
SHA256 d0ee8b3d2cb16a9266c513fe103441c57260e4ca5a703da94b4eed38902f954c
MD5 27513ea9550636494542b0d2a604190d
SHA1 525ffd97bcf5d57a65b230b711e365733abf5134
SHA512 4e82846541a82f565e05dbe597b034bfc92815f81bea907b1fb3df52d75ab9ca574321f9d9b42818842893c89146ba4356644e037b4710878e9711264c6d80ed
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKDJS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKlrsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

uudbpyfvehfqa.qni

Path C:\Windows\SysWOW64\Mdrenlmadxsp\uudbpyfvehfqa.qni
Size 432KB
SHA256 d0ee8b3d2cb16a9266c513fe103441c57260e4ca5a703da94b4eed38902f954c
MD5 27513ea9550636494542b0d2a604190d
SHA1 525ffd97bcf5d57a65b230b711e365733abf5134
SHA512 4e82846541a82f565e05dbe597b034bfc92815f81bea907b1fb3df52d75ab9ca574321f9d9b42818842893c89146ba4356644e037b4710878e9711264c6d80ed
SSDEEP 6144:fXsg4N8g8NZrrED8R+7pARpzKDJS4rsjW+5YFYQ8Gv0JW84gCFff:f8g4N8RM8R+7pYpzKlrsjW+5MDvT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1344-124-0x00007FFB49170000-0x00007FFB49180000-memory.dmp

Download

memory/1344-125-0x00007FFB49170000-0x00007FFB49180000-memory.dmp

Download

memory/1344-126-0x00007FFB49170000-0x00007FFB49180000-memory.dmp

Download

memory/1344-127-0x00007FFB49170000-0x00007FFB49180000-memory.dmp

Download

memory/1344-128-0x00007FFB49170000-0x00007FFB49180000-memory.dmp

Download

memory/2144-132-0x00000000030B0000-0x00000000030D3000-memory.dmp

Download

memory/4760-137-0x0000000001010000-0x0000000001033000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads