emotet | e195f517c48aa10fb9332be7d763b9e4cea5118509c210c32375713e52f761df

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
07/06/2022, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rech 2022.06.06_0916.xls
Size 70KB
Sample220607-hal8vabfe9
SHA256 e195f517c48aa10fb9332be7d763b9e4cea5118509c210c32375713e52f761df
MD5 219f4b2b10d6bc62e615c5b4df79c545
SHA1 9cfd43ab2fba9a9ae72653e727b887d16dfd6609
SHA512 a027e06c2bdd55c8ddb696acdea78b858423f262439928171862f7332f73890e4248523513ac0f880dbabd44fbf82fd0a637c2888b690c9c330370171e3d20cb
MD5 SHA1 SHA512

Score

10^/10

emotet epoch4 banker suricata trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://nationco-op.org/css/8wv7lB5/
xlm40.dropper
http://lightmyfire.in/demo/RIkAFgTFVuaI05r2/
xlm40.dropper
http://www.nexxdecor.vn/apk/zy8GkZ/

Extracted

Family

emotet

Botnet

Epoch4

94.23.45.86:4143
129.232.188.93:443
213.241.20.155:443
197.242.150.244:8080
172.104.251.154:8080
46.55.222.11:443
82.223.21.224:8080
5.9.116.246:8080
1.234.2.232:8080
146.59.226.45:443
160.16.142.56:8080
115.68.227.76:8080
72.15.201.15:8080
188.44.20.25:443
185.4.135.165:8080
103.132.242.26:8080
173.212.193.249:8080
163.44.196.120:8080
183.111.227.137:8080
149.56.131.28:8080
212.24.98.99:8080
159.65.140.115:443
150.95.66.124:8080
107.170.39.149:8080
203.114.109.124:443
41.73.252.195:443
37.187.115.122:8080
82.165.152.127:8080
119.193.124.41:7080
103.75.201.2:443
79.137.35.198:8080
159.65.88.10:8080
209.126.98.206:8080
167.172.253.162:8080
186.194.240.217:443
51.254.140.238:7080
51.91.76.89:8080
153.126.146.25:7080
207.180.241.186:8080
206.189.28.199:8080
45.176.232.124:443
103.70.28.102:8080
158.69.222.101:443
151.106.112.196:8080
103.43.75.120:443
91.207.28.33:8080
159.89.202.34:443
45.186.16.18:443
45.235.8.30:8080
201.94.166.162:443
164.68.99.3:8080
110.232.117.186:8080
45.118.115.99:8080
207.148.79.14:8080
131.100.24.231:80
31.22.4.160:8080
134.122.66.193:8080
196.218.30.83:443
209.97.163.214:443
1.234.21.73:7080
101.50.0.91:8080

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4132	3116	regsvr32.exe	66
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1348	3116	regsvr32.exe	66
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	488	3116	regsvr32.exe	66

suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
1348	regsvr32.exe
2964	regsvr32.exe
488	regsvr32.exe
632	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3116	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1348	regsvr32.exe
1348	regsvr32.exe
2964	regsvr32.exe
2964	regsvr32.exe
2964	regsvr32.exe
2964	regsvr32.exe
488	regsvr32.exe
488	regsvr32.exe
632	regsvr32.exe
632	regsvr32.exe
632	regsvr32.exe
632	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3116	EXCEL.EXE
3116	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3116	EXCEL.EXE
3116	EXCEL.EXE
3116	EXCEL.EXE
3116	EXCEL.EXE
3116	EXCEL.EXE
3116	EXCEL.EXE
3116	EXCEL.EXE
3116	EXCEL.EXE
3116	EXCEL.EXE
3116	EXCEL.EXE
3116	EXCEL.EXE
3116	EXCEL.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4132	3116	EXCEL.EXE	82
PID 3116 wrote to memory of 4132	3116	EXCEL.EXE	82
PID 3116 wrote to memory of 1348	3116	EXCEL.EXE	83
PID 3116 wrote to memory of 1348	3116	EXCEL.EXE	83
PID 1348 wrote to memory of 2964	1348	regsvr32.exe	84
PID 1348 wrote to memory of 2964	1348	regsvr32.exe	84
PID 3116 wrote to memory of 488	3116	EXCEL.EXE	85
PID 3116 wrote to memory of 488	3116	EXCEL.EXE	85
PID 488 wrote to memory of 632	488	regsvr32.exe	86
PID 488 wrote to memory of 632	488	regsvr32.exe	86

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Rech 2022.06.06_0916.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\dxgxe1.ocx
  2⤵
  - Process spawned unexpected child process
  PID:4132
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\dxgxe2.ocx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DJUVy\xAuKaR.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2964
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\dxgxe3.ocx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:488
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FnemjPwWAikrc\ieWh.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dxgxe2.ocx

Path C:\Users\Admin\dxgxe2.ocx
Size 665KB
SHA256 40c46278d656be674b0fd733c3fbabb4edded7a2446f8ced62f7c7da1aeafb11
MD5 efcd33bf4b68c4a102b69c9a4b1e9a35
SHA1 06f46a7576af7c60aa87accf00904043aff990d6
SHA512 6a8fcf240fe048d953e9c83d471e6b97b7e83a0bd5d86c9a3f9a0fd9da798bba4afa3a508e39b6bef795472cc6d12bd312a4626693fe671530af3d1d3c74bfaa
SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6K0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYh41HfD46kU8WG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxgxe2.ocx

Path C:\Users\Admin\dxgxe2.ocx
Size 665KB
SHA256 40c46278d656be674b0fd733c3fbabb4edded7a2446f8ced62f7c7da1aeafb11
MD5 efcd33bf4b68c4a102b69c9a4b1e9a35
SHA1 06f46a7576af7c60aa87accf00904043aff990d6
SHA512 6a8fcf240fe048d953e9c83d471e6b97b7e83a0bd5d86c9a3f9a0fd9da798bba4afa3a508e39b6bef795472cc6d12bd312a4626693fe671530af3d1d3c74bfaa
SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6K0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYh41HfD46kU8WG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxgxe3.ocx

Path C:\Users\Admin\dxgxe3.ocx
Size 665KB
SHA256 8a9de694a4d8a6d777933a79a14a15489d802e8c75597e78cff5f0e87ae31412
MD5 c9f8cc14d89d58d8bc52b6c3f69177d7
SHA1 8b39915690865f7c6e63dbcf3e49193c639c0628
SHA512 ff0a6a72be5bca2ed6f8c60ec74cdc92f499c0e8b4059c82263c24bc7989bc7d9b8990b6c65efb9a8ac1a31cff99065b6c3a6ac7bef2633878daf1c41c1b9a50
SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6M0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYhO1HfD46kU8WG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxgxe3.ocx

Path C:\Users\Admin\dxgxe3.ocx
Size 665KB
SHA256 8a9de694a4d8a6d777933a79a14a15489d802e8c75597e78cff5f0e87ae31412
MD5 c9f8cc14d89d58d8bc52b6c3f69177d7
SHA1 8b39915690865f7c6e63dbcf3e49193c639c0628
SHA512 ff0a6a72be5bca2ed6f8c60ec74cdc92f499c0e8b4059c82263c24bc7989bc7d9b8990b6c65efb9a8ac1a31cff99065b6c3a6ac7bef2633878daf1c41c1b9a50
SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6M0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYhO1HfD46kU8WG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

xAuKaR.dll

Path C:\Windows\System32\DJUVy\xAuKaR.dll
Size 665KB
SHA256 40c46278d656be674b0fd733c3fbabb4edded7a2446f8ced62f7c7da1aeafb11
MD5 efcd33bf4b68c4a102b69c9a4b1e9a35
SHA1 06f46a7576af7c60aa87accf00904043aff990d6
SHA512 6a8fcf240fe048d953e9c83d471e6b97b7e83a0bd5d86c9a3f9a0fd9da798bba4afa3a508e39b6bef795472cc6d12bd312a4626693fe671530af3d1d3c74bfaa
SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6K0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYh41HfD46kU8WG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ieWh.dll

Path C:\Windows\System32\FnemjPwWAikrc\ieWh.dll
Size 665KB
SHA256 8a9de694a4d8a6d777933a79a14a15489d802e8c75597e78cff5f0e87ae31412
MD5 c9f8cc14d89d58d8bc52b6c3f69177d7
SHA1 8b39915690865f7c6e63dbcf3e49193c639c0628
SHA512 ff0a6a72be5bca2ed6f8c60ec74cdc92f499c0e8b4059c82263c24bc7989bc7d9b8990b6c65efb9a8ac1a31cff99065b6c3a6ac7bef2633878daf1c41c1b9a50
SSDEEP 12288:IkcciVL7KJ39aFUl29UrVNVWgdblGaIsyWYx9V6M0fpG4gnmHeID4+C8swJkU8Qs:IkcciG39aFIW0Y4yWYhO1HfD46kU8WG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1348-141-0x0000000180000000-0x000000018002A000-memory.dmp

Download

memory/3116-130-0x00007FFDAE3F0000-0x00007FFDAE400000-memory.dmp

Download

memory/3116-136-0x00007FFDAC1E0000-0x00007FFDAC1F0000-memory.dmp

Download

memory/3116-135-0x00007FFDAC1E0000-0x00007FFDAC1F0000-memory.dmp

Download

memory/3116-134-0x00007FFDAE3F0000-0x00007FFDAE400000-memory.dmp

Download

memory/3116-133-0x00007FFDAE3F0000-0x00007FFDAE400000-memory.dmp

Download

memory/3116-131-0x00007FFDAE3F0000-0x00007FFDAE400000-memory.dmp

Download

memory/3116-132-0x00007FFDAE3F0000-0x00007FFDAE400000-memory.dmp

Download