emotet | dedf7111e1c7773c304be3660fdb6aa1ff664c44b04387f9393e3176c36737b4

General

Target

dedf7111e1c7773c304be3660fdb6aa1ff664c44b04387f9393e3176c36737b4.xls
Size

73KB
MD5

d8688ad6b940f457ca18ddeeb15478d2
SHA1

894d930b6bbce17992c484f04aa2b650806ba9c2
SHA256

dedf7111e1c7773c304be3660fdb6aa1ff664c44b04387f9393e3176c36737b4
SHA512

112fa7cfcab188b23ca785242a573b78ced48a933a58c893bff0e73d1c962c0e971b19ac3486214e8951edfbae3cbd294f6e513951c13eb755def0d7e4d1ab16

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://hullsite.com/0a61/nm6lxocqt/

xlm40.dropper

https://bencevendeghaz.hu/wp-includes/cLrqBIwf8C/

Extracted

Family

emotet

Botnet

Epoch4

C2

51.254.140.238:7080

103.70.28.102:8080

5.9.116.246:8080

1.234.2.232:8080

209.250.246.206:443

58.227.42.236:80

72.15.201.15:8080

159.65.88.10:8080

189.126.111.200:7080

173.212.193.249:8080

188.44.20.25:443

134.122.66.193:8080

172.104.251.154:8080

103.75.201.2:443

150.95.66.124:8080

153.126.146.25:7080

103.43.75.120:443

203.114.109.124:443

27.54.89.58:8080

1.234.21.73:7080

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3764	3380	regsvr32.exe	EXCEL.EXE

suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

3764 regsvr32.exe

pid	process
3764	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3380 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

3676 regsvr32.exe
3676 regsvr32.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

3380 EXCEL.EXE
3380 EXCEL.EXE

pid	process
3676	regsvr32.exe
3676	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE
3380	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

EXCEL.EXEregsvr32.exe

description	pid	process	target process
PID 3380 wrote to memory of 3764	3380	EXCEL.EXE	regsvr32.exe
PID 3380 wrote to memory of 3764	3380	EXCEL.EXE	regsvr32.exe
PID 3764 wrote to memory of 3676	3764	regsvr32.exe	regsvr32.exe
PID 3764 wrote to memory of 3676	3764	regsvr32.exe	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\dedf7111e1c7773c304be3660fdb6aa1ff664c44b04387f9393e3176c36737b4.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380

C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe ..\vhdxw.ocx
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3764

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KtWPdBNDhh\OjdXChbyAygJWlC.dll"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\vhdxw.ocx
Filesize
405KB

MD5
030d640b07c97f3d7fb5573e7f63a4db

SHA1
2fa1f8b5a9aab9169922c95af23e87b57f79d1da

SHA256
2c579ddf1b850c0b72e9468731dbaa202b17dd6e8fd0cf56e754acd460957a57

SHA512
6ffce06a7b78f613a93fff09d3afb5202bcd74f0b382a3e7915d7814dbbe3aa43b62928856a9f3ad517389c7812fcdee20de85013eb545d1199cfc7a766c45b0

Download Submit
\Users\Admin\vhdxw.ocx
Filesize
405KB

MD5
030d640b07c97f3d7fb5573e7f63a4db

SHA1
2fa1f8b5a9aab9169922c95af23e87b57f79d1da

SHA256
2c579ddf1b850c0b72e9468731dbaa202b17dd6e8fd0cf56e754acd460957a57

SHA512
6ffce06a7b78f613a93fff09d3afb5202bcd74f0b382a3e7915d7814dbbe3aa43b62928856a9f3ad517389c7812fcdee20de85013eb545d1199cfc7a766c45b0

Download Submit
memory/3380-116-0x00007FFCD8AE0000-0x00007FFCD8AF0000-memory.dmp

Filesize
64KB

Download
memory/3380-119-0x00007FFCD8AE0000-0x00007FFCD8AF0000-memory.dmp

Filesize
64KB

Download
memory/3380-128-0x00007FFCD5670000-0x00007FFCD5680000-memory.dmp

Filesize
64KB

Download
memory/3380-129-0x00007FFCD5670000-0x00007FFCD5680000-memory.dmp

Filesize
64KB

Download
memory/3380-307-0x00007FFCD8AE0000-0x00007FFCD8AF0000-memory.dmp

Filesize
64KB

Download
memory/3380-118-0x00007FFCD8AE0000-0x00007FFCD8AF0000-memory.dmp

Filesize
64KB

Download
memory/3380-117-0x00007FFCD8AE0000-0x00007FFCD8AF0000-memory.dmp

Filesize
64KB

Download
memory/3380-308-0x00007FFCD8AE0000-0x00007FFCD8AF0000-memory.dmp

Filesize
64KB

Download
memory/3380-305-0x00007FFCD8AE0000-0x00007FFCD8AF0000-memory.dmp

Filesize
64KB

Download
memory/3380-306-0x00007FFCD8AE0000-0x00007FFCD8AF0000-memory.dmp

Filesize
64KB

Download
memory/3676-274-0x0000000000000000-mapping.dmp

Download
memory/3764-256-0x0000000000000000-mapping.dmp

Download
memory/3764-259-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads