emotet | bcb53af88c2eb7a3e04c8874854a6c4fc0a2b9890ed39cc4bc9c1f7ef6380563

General

Target

Documento.xls
Size

40KB
MD5

bf1a84bcee85983c92040cc52a43dd17
SHA1

eedb1bbdc50095d087ac9fd3eb0e4695217c6d0d
SHA256

bcb53af88c2eb7a3e04c8874854a6c4fc0a2b9890ed39cc4bc9c1f7ef6380563
SHA512

fab1981d877b6bbb041723e1d19b4c019413e447ba193b5bd1a2f0b59ad8cbfbf9e54e06b6fed407ac82f03bec84ca6ba5fa0aba5aa0d4cd792c1da4632eb860

Score

10^/10

emotet banker trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4436	2544	regsvr32.exe	EXCEL.EXE

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4436 regsvr32.exe
4232 regsvr32.exe

pid	process
4436	regsvr32.exe
4232	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2544 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4232 regsvr32.exe
4232 regsvr32.exe

pid	process
4232	regsvr32.exe
4232	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

EXCEL.EXEregsvr32.exe

description	pid	process	target process
PID 2544 wrote to memory of 4436	2544	EXCEL.EXE	regsvr32.exe
PID 2544 wrote to memory of 4436	2544	EXCEL.EXE	regsvr32.exe
PID 4436 wrote to memory of 4232	4436	regsvr32.exe	regsvr32.exe
PID 4436 wrote to memory of 4232	4436	regsvr32.exe	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Documento.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe ..\wurod.ocx
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UeOLIiqRmv\RCBu.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\wurod.ocx
Filesize
764KB

MD5
56922642df76d515651215578a10d873

SHA1
aac8eb5cb0fa3ef3fdc7e0ec034a1325bd75990e

SHA256
d7bbba0e0a4b8818716055080b36fd4e51eb883f5f49896bd50995377e0088f4

SHA512
e9795738e8484677143dbb359db02f0002d31876954a0263788fd5fe2c1a231bff4a007905e034fd6f3f842490d746a41393d80849fd47fa66b38482fb738714

Download Submit
C:\Users\Admin\wurod.ocx
Filesize
764KB

MD5
56922642df76d515651215578a10d873

SHA1
aac8eb5cb0fa3ef3fdc7e0ec034a1325bd75990e

SHA256
d7bbba0e0a4b8818716055080b36fd4e51eb883f5f49896bd50995377e0088f4

SHA512
e9795738e8484677143dbb359db02f0002d31876954a0263788fd5fe2c1a231bff4a007905e034fd6f3f842490d746a41393d80849fd47fa66b38482fb738714

Download Submit
C:\Windows\System32\UeOLIiqRmv\RCBu.dll
Filesize
764KB

MD5
56922642df76d515651215578a10d873

SHA1
aac8eb5cb0fa3ef3fdc7e0ec034a1325bd75990e

SHA256
d7bbba0e0a4b8818716055080b36fd4e51eb883f5f49896bd50995377e0088f4

SHA512
e9795738e8484677143dbb359db02f0002d31876954a0263788fd5fe2c1a231bff4a007905e034fd6f3f842490d746a41393d80849fd47fa66b38482fb738714

Download Submit
memory/2544-133-0x00007FFF77E70000-0x00007FFF77E80000-memory.dmp

Filesize
64KB

Download
memory/2544-134-0x00007FFF77E70000-0x00007FFF77E80000-memory.dmp

Filesize
64KB

Download
memory/2544-135-0x00007FFF75DE0000-0x00007FFF75DF0000-memory.dmp

Filesize
64KB

Download
memory/2544-136-0x00007FFF75DE0000-0x00007FFF75DF0000-memory.dmp

Filesize
64KB

Download
memory/2544-130-0x00007FFF77E70000-0x00007FFF77E80000-memory.dmp

Filesize
64KB

Download
memory/2544-132-0x00007FFF77E70000-0x00007FFF77E80000-memory.dmp

Filesize
64KB

Download
memory/2544-131-0x00007FFF77E70000-0x00007FFF77E80000-memory.dmp

Filesize
64KB

Download
memory/4232-143-0x0000000000000000-mapping.dmp

Download
memory/4436-137-0x0000000000000000-mapping.dmp

Download
memory/4436-140-0x0000000001F70000-0x0000000001FA0000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads