emotet | bcb53af88c2eb7a3e04c8874854a6c4fc0a2b9890ed39cc4bc9c1f7ef6380563

Analysis

max time kernel
155s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/05/2022, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Documento.xls
Size 40KB
Sample220512-lfbk3sbhb3
SHA256 bcb53af88c2eb7a3e04c8874854a6c4fc0a2b9890ed39cc4bc9c1f7ef6380563
MD5 bf1a84bcee85983c92040cc52a43dd17
SHA1 eedb1bbdc50095d087ac9fd3eb0e4695217c6d0d
SHA512 fab1981d877b6bbb041723e1d19b4c019413e447ba193b5bd1a2f0b59ad8cbfbf9e54e06b6fed407ac82f03bec84ca6ba5fa0aba5aa0d4cd792c1da4632eb860
MD5 SHA1 SHA512

Score

10^/10

emotet banker trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4436	2544	regsvr32.exe	79

Loads dropped DLL 2 IoCs

pid	Process
4436	regsvr32.exe
4232	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2544	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4232	regsvr32.exe
4232	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE
2544	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 4436	2544	EXCEL.EXE	82
PID 2544 wrote to memory of 4436	2544	EXCEL.EXE	82
PID 4436 wrote to memory of 4232	4436	regsvr32.exe	84
PID 4436 wrote to memory of 4232	4436	regsvr32.exe	84

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Documento.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe ..\wurod.ocx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UeOLIiqRmv\RCBu.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wurod.ocx

Path C:\Users\Admin\wurod.ocx
Size 764KB
SHA256 d7bbba0e0a4b8818716055080b36fd4e51eb883f5f49896bd50995377e0088f4
MD5 56922642df76d515651215578a10d873
SHA1 aac8eb5cb0fa3ef3fdc7e0ec034a1325bd75990e
SHA512 e9795738e8484677143dbb359db02f0002d31876954a0263788fd5fe2c1a231bff4a007905e034fd6f3f842490d746a41393d80849fd47fa66b38482fb738714
SSDEEP 12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSujNwgraKRT61cKGNx:S4DzZKnH43RGY61WN+
MD5 SHA1 SHA512 SSDEEP

Submit Download

wurod.ocx

Path C:\Users\Admin\wurod.ocx
Size 764KB
SHA256 d7bbba0e0a4b8818716055080b36fd4e51eb883f5f49896bd50995377e0088f4
MD5 56922642df76d515651215578a10d873
SHA1 aac8eb5cb0fa3ef3fdc7e0ec034a1325bd75990e
SHA512 e9795738e8484677143dbb359db02f0002d31876954a0263788fd5fe2c1a231bff4a007905e034fd6f3f842490d746a41393d80849fd47fa66b38482fb738714
SSDEEP 12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSujNwgraKRT61cKGNx:S4DzZKnH43RGY61WN+
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCBu.dll

Path C:\Windows\System32\UeOLIiqRmv\RCBu.dll
Size 764KB
SHA256 d7bbba0e0a4b8818716055080b36fd4e51eb883f5f49896bd50995377e0088f4
MD5 56922642df76d515651215578a10d873
SHA1 aac8eb5cb0fa3ef3fdc7e0ec034a1325bd75990e
SHA512 e9795738e8484677143dbb359db02f0002d31876954a0263788fd5fe2c1a231bff4a007905e034fd6f3f842490d746a41393d80849fd47fa66b38482fb738714
SSDEEP 12288:e1NKDzZKRpnBlD7MGVrdjF3hRcTsApSvHQdOzyK7zjwOjmSujNwgraKRT61cKGNx:S4DzZKnH43RGY61WN+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2544-133-0x00007FFF77E70000-0x00007FFF77E80000-memory.dmp

Download

memory/2544-134-0x00007FFF77E70000-0x00007FFF77E80000-memory.dmp

Download

memory/2544-135-0x00007FFF75DE0000-0x00007FFF75DF0000-memory.dmp

Download

memory/2544-136-0x00007FFF75DE0000-0x00007FFF75DF0000-memory.dmp

Download

memory/2544-130-0x00007FFF77E70000-0x00007FFF77E80000-memory.dmp

Download

memory/2544-132-0x00007FFF77E70000-0x00007FFF77E80000-memory.dmp

Download

memory/2544-131-0x00007FFF77E70000-0x00007FFF77E80000-memory.dmp

Download

memory/4436-140-0x0000000001F70000-0x0000000001FA0000-memory.dmp

Download