emotet | a4c9ab25e494f7f6f2411e1ff709665d708cbf03566716384bd077046ff40d5e

Resubmissions

08/01/2024, 19:57

240108-ypk74agdcl10

03/06/2022, 20:27

220603-y8dmcsddf810

Analysis

max time kernel
149s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03/06/2022, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Contract-2022-06-03_1618.xls
Size 70KB
Sample220603-y8dmcsddf8
SHA256 a4c9ab25e494f7f6f2411e1ff709665d708cbf03566716384bd077046ff40d5e
MD5 b3f12429a92a00a629b11f1a6e6c7046
SHA1 d6e96e076704b2b9d2401d6faef3381936185da3
SHA512 230c5b4f5f62599188eb27e38ef25b88dc52b52d5ee2a2d47074c99235dae6e40cb9f94b1f3559231c6c08d262cd4b372fc747480022b983d01dcbbc75944be1
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://panamel.com/wp-content/FBPHSHN1AdVpn/
xlm40.dropper
https://papillonweb.fr/wp-content/QTdf/
xlm40.dropper
https://www.pioneerimmigration.co.in/icon/Z5z5Vx/

Extracted

Family

emotet

Botnet

Epoch4

164.68.99.3:8080
146.59.226.45:443
51.91.76.89:8080
209.97.163.214:443
158.69.222.101:443
82.165.152.127:8080
103.70.28.102:8080
72.15.201.15:8080
150.95.66.124:8080
45.176.232.124:443
82.223.21.224:8080
107.170.39.149:8080
160.16.142.56:8080
103.132.242.26:8080
153.126.146.25:7080
213.241.20.155:443
1.234.21.73:7080
197.242.150.244:8080
188.44.20.25:443
196.218.30.83:443
5.9.116.246:8080
183.111.227.137:8080
173.212.193.249:8080
207.180.241.186:8080
201.94.166.162:443
212.24.98.99:8080
115.68.227.76:8080
206.189.28.199:8080
203.114.109.124:443
103.43.75.120:443
149.56.131.28:8080
110.232.117.186:8080
103.75.201.2:443
46.55.222.11:443
209.126.98.206:8080
1.234.2.232:8080
45.118.115.99:8080
163.44.196.120:8080
119.193.124.41:7080
151.106.112.196:8080
101.50.0.91:8080
51.254.140.238:7080
186.194.240.217:443
172.104.251.154:8080
91.207.28.33:8080
159.65.88.10:8080
185.4.135.165:8080
79.137.35.198:8080
159.89.202.34:443
129.232.188.93:443
131.100.24.231:80
41.73.252.195:443
134.122.66.193:8080
37.187.115.122:8080
94.23.45.86:4143
167.172.253.162:8080
159.65.140.115:443
45.235.8.30:8080

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1096	2820	regsvr32.exe	81
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	176	2820	regsvr32.exe	81
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	628	2820	regsvr32.exe	81

Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
176	regsvr32.exe
628	regsvr32.exe
628	regsvr32.exe
4784	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2820	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
176	regsvr32.exe
176	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2820	EXCEL.EXE
2820	EXCEL.EXE
2820	EXCEL.EXE
2820	EXCEL.EXE
2820	EXCEL.EXE
2820	EXCEL.EXE
2820	EXCEL.EXE
2820	EXCEL.EXE
2820	EXCEL.EXE
2820	EXCEL.EXE
2820	EXCEL.EXE
2820	EXCEL.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1096	2820	EXCEL.EXE	86
PID 2820 wrote to memory of 1096	2820	EXCEL.EXE	86
PID 2820 wrote to memory of 176	2820	EXCEL.EXE	88
PID 2820 wrote to memory of 176	2820	EXCEL.EXE	88
PID 2820 wrote to memory of 628	2820	EXCEL.EXE	93
PID 2820 wrote to memory of 628	2820	EXCEL.EXE	93
PID 176 wrote to memory of 4784	176	regsvr32.exe	94
PID 176 wrote to memory of 4784	176	regsvr32.exe	94

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Contract-2022-06-03_1618.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\uhwa1.ocx
  2⤵
  - Process spawned unexpected child process
  PID:1096
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\uhwa2.ocx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:176
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LxBPfJCgvrtcChx\jyaPPNC.dll"
    3⤵
    - Loads dropped DLL
    PID:4784
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\uhwa3.ocx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  PID:628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uhwa2.ocx

Path C:\Users\Admin\uhwa2.ocx
Size 580KB
SHA256 c1e07148f523120e899ee7e7ffeb2dbff9498c660225520f6489f9e6fa15f5ab
MD5 e0cce99a328246f19c09121dd48edf8b
SHA1 2a614c3c9eb4b665592a8ddc84c9d0ad6bfa31e7
SHA512 6952a79f96f32aa62f1f4033dc2dd7d0f8af6a2250ea946a58de4cd61d7b1e6826c23361cb07521943bb61413c6d3d79c5e5be04cc5edd4f242f93f31750d599
SSDEEP 12288:dIcc2PAC1JB9aaWlI+5rGN6IMP1ZFb2ROyyrsZ/9M/gIAZVoS/fd:dIcc2LB9aaMIWJ2Uyyrm/9MoIA3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

uhwa2.ocx

Path C:\Users\Admin\uhwa2.ocx
Size 580KB
SHA256 c1e07148f523120e899ee7e7ffeb2dbff9498c660225520f6489f9e6fa15f5ab
MD5 e0cce99a328246f19c09121dd48edf8b
SHA1 2a614c3c9eb4b665592a8ddc84c9d0ad6bfa31e7
SHA512 6952a79f96f32aa62f1f4033dc2dd7d0f8af6a2250ea946a58de4cd61d7b1e6826c23361cb07521943bb61413c6d3d79c5e5be04cc5edd4f242f93f31750d599
SSDEEP 12288:dIcc2PAC1JB9aaWlI+5rGN6IMP1ZFb2ROyyrsZ/9M/gIAZVoS/fd:dIcc2LB9aaMIWJ2Uyyrm/9MoIA3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

uhwa3.ocx

Path C:\Users\Admin\uhwa3.ocx
Size 580KB
SHA256 4547416a13e24940aa557caf39173c48f91f172578cf2ea1a86bbcad691db5c2
MD5 65349bece8eae8383990217d2008a0c1
SHA1 1d5723ded96eecc30eafc606876873833932d2cd
SHA512 dc70bc9150ca80b20605bd57202763c15f9145c27204e4ec2c18dc780470555a69d8eb83583d6cbe62e93d17d2328a2aac18db46b6f4ae101a78582078e4a110
SSDEEP 12288:dIcc2PAC1JB9aaWlI+5rGN6IMP1ZFb2ROyyrsZ69M/gIAZVoS/fd:dIcc2LB9aaMIWJ2Uyyrm69MoIA3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

uhwa3.ocx

Path C:\Users\Admin\uhwa3.ocx
Size 580KB
SHA256 4547416a13e24940aa557caf39173c48f91f172578cf2ea1a86bbcad691db5c2
MD5 65349bece8eae8383990217d2008a0c1
SHA1 1d5723ded96eecc30eafc606876873833932d2cd
SHA512 dc70bc9150ca80b20605bd57202763c15f9145c27204e4ec2c18dc780470555a69d8eb83583d6cbe62e93d17d2328a2aac18db46b6f4ae101a78582078e4a110
SSDEEP 12288:dIcc2PAC1JB9aaWlI+5rGN6IMP1ZFb2ROyyrsZ69M/gIAZVoS/fd:dIcc2LB9aaMIWJ2Uyyrm69MoIA3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

uhwa3.ocx

Path C:\Users\Admin\uhwa3.ocx
Size 580KB
SHA256 4547416a13e24940aa557caf39173c48f91f172578cf2ea1a86bbcad691db5c2
MD5 65349bece8eae8383990217d2008a0c1
SHA1 1d5723ded96eecc30eafc606876873833932d2cd
SHA512 dc70bc9150ca80b20605bd57202763c15f9145c27204e4ec2c18dc780470555a69d8eb83583d6cbe62e93d17d2328a2aac18db46b6f4ae101a78582078e4a110
SSDEEP 12288:dIcc2PAC1JB9aaWlI+5rGN6IMP1ZFb2ROyyrsZ69M/gIAZVoS/fd:dIcc2LB9aaMIWJ2Uyyrm69MoIA3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

jyaPPNC.dll

Path C:\Windows\System32\LxBPfJCgvrtcChx\jyaPPNC.dll
Size 580KB
SHA256 c1e07148f523120e899ee7e7ffeb2dbff9498c660225520f6489f9e6fa15f5ab
MD5 e0cce99a328246f19c09121dd48edf8b
SHA1 2a614c3c9eb4b665592a8ddc84c9d0ad6bfa31e7
SHA512 6952a79f96f32aa62f1f4033dc2dd7d0f8af6a2250ea946a58de4cd61d7b1e6826c23361cb07521943bb61413c6d3d79c5e5be04cc5edd4f242f93f31750d599
SSDEEP 12288:dIcc2PAC1JB9aaWlI+5rGN6IMP1ZFb2ROyyrsZ/9M/gIAZVoS/fd:dIcc2LB9aaMIWJ2Uyyrm/9MoIA3n
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/176-147-0x0000000180000000-0x000000018002B000-memory.dmp

Download

memory/628-145-0x0000000002220000-0x00000000022CA000-memory.dmp

Download

memory/2820-130-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Download

memory/2820-136-0x00007FF854BB0000-0x00007FF854BC0000-memory.dmp

Download

memory/2820-135-0x00007FF854BB0000-0x00007FF854BC0000-memory.dmp

Download

memory/2820-134-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Download

memory/2820-133-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Download

memory/2820-132-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Download

memory/2820-131-0x00007FF8574B0000-0x00007FF8574C0000-memory.dmp

Download