emotet | 6565c2959a8e637f2b0f8463eae7e6e453e830ce1761654aafc757c19e5f0fcb

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15/06/2022, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Fattura numero 93518 del 15.06.2022.xls
Size 80KB
Sample220615-p2zftaaba4
SHA256 6565c2959a8e637f2b0f8463eae7e6e453e830ce1761654aafc757c19e5f0fcb
MD5 b9dd7ece6cbb17424ec8c947cacb5b16
SHA1 6efeebf472ec5e94764eb70fcab8a098cdab87ed
SHA512 ec62b3c4c622a2ce87993c8cfba89d89cf335cfa4c28b2c733971a1314e9efba8178d4e7f054da5210e3460e7eb90ed5a4d69e6d6f872fe9b51375edec65a1b8
MD5 SHA1 SHA512

Score

10^/10

emotet banker suricata trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://byrdnest3.com/cgi-bin/TEq/
xlm40.dropper
http://carbonbros.co.za/logs/KSTJNdxZ73hIZPKddEDT/
xlm40.dropper
http://www.bubblefootballeurope.de/wp-admin/3aMMnYP/
xlm40.dropper
http://casov.com/proxy/kk0OWcstqPOOyeG/

Extracted

Family

emotet

101.50.0.91:8080
159.89.202.34:443
209.97.163.214:443
173.212.193.249:8080
159.65.88.10:8080
45.118.115.99:8080
82.165.152.127:8080
207.148.79.14:8080
41.73.252.195:443
196.218.30.83:443
103.75.201.2:443
64.227.100.222:8080
149.56.131.28:8080
103.43.75.120:443
188.44.20.25:443
185.4.135.165:8080
91.207.28.33:8080
110.232.117.186:8080
72.15.201.15:8080
45.176.232.124:443
46.55.222.11:443
163.44.196.120:8080
172.105.226.75:8080
5.9.116.246:8080
150.95.66.124:8080
94.23.45.86:4143
107.170.39.149:8080
209.126.98.206:8080
212.24.98.99:8080
167.172.253.162:8080
146.59.226.45:443
115.68.227.76:8080
164.68.99.3:8080
206.189.28.199:8080
186.194.240.217:443
158.69.222.101:443
172.104.251.154:8080
103.70.28.102:8080
45.186.16.18:443
51.254.140.238:7080
197.242.150.244:8080
51.161.73.194:443
201.94.166.162:443
160.16.142.56:8080
213.241.20.155:443
129.232.188.93:443
134.122.66.193:8080
45.235.8.30:8080
159.65.140.115:443
119.193.124.41:7080
151.106.112.196:8080
144.91.78.55:443
82.223.21.224:8080
183.111.227.137:8080
1.234.2.232:8080
153.126.146.25:7080
79.137.35.198:8080
103.132.242.26:8080
51.91.76.89:8080
37.187.115.122:8080
131.100.24.231:80
203.114.109.124:443
1.234.21.73:7080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1464	4548	regsvr32.exe	76
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3044	4548	regsvr32.exe	76
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4776	4548	regsvr32.exe	76
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2600	4548	regsvr32.exe	76

suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata
Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
4776	regsvr32.exe
2928	regsvr32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{50B48A0A-F40D-4F0C-898C-BA6DBE7BFBC6}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{A4B19A17-325B-4B2C-A213-D3FF78FBA0B4}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4548	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4776	regsvr32.exe
4776	regsvr32.exe
2928	regsvr32.exe
2928	regsvr32.exe
2928	regsvr32.exe
2928	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4548	EXCEL.EXE
4548	EXCEL.EXE
4548	EXCEL.EXE
4548	EXCEL.EXE
4548	EXCEL.EXE
4548	EXCEL.EXE
4548	EXCEL.EXE
4548	EXCEL.EXE
4548	EXCEL.EXE
4548	EXCEL.EXE
4548	EXCEL.EXE
4548	EXCEL.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 1464	4548	EXCEL.EXE	85
PID 4548 wrote to memory of 1464	4548	EXCEL.EXE	85
PID 4548 wrote to memory of 3044	4548	EXCEL.EXE	88
PID 4548 wrote to memory of 3044	4548	EXCEL.EXE	88
PID 4548 wrote to memory of 4776	4548	EXCEL.EXE	89
PID 4548 wrote to memory of 4776	4548	EXCEL.EXE	89
PID 4548 wrote to memory of 2600	4548	EXCEL.EXE	90
PID 4548 wrote to memory of 2600	4548	EXCEL.EXE	90
PID 4776 wrote to memory of 2928	4776	regsvr32.exe	94
PID 4776 wrote to memory of 2928	4776	regsvr32.exe	94

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Fattura numero 93518 del 15.06.2022.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\cui1.ocx
  2⤵
  - Process spawned unexpected child process
  PID:1464
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\cui2.ocx
  2⤵
  - Process spawned unexpected child process
  PID:3044
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\cui3.ocx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZgApeAyvJybPrn\cWCCJghwBQ.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2928
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\cui4.ocx
  2⤵
  - Process spawned unexpected child process
  PID:2600

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cui3.ocx

Path C:\Users\Admin\cui3.ocx
Size 666KB
SHA256 791eec058c0bb722ed2eb0ad7b9e7e34da4df042b09cc19b978a90561ae3e13f
MD5 4df2c0180af87636e5122493ee11dc1f
SHA1 ac657f876812869ac9555c45bb20151d7c5d77a8
SHA512 9e76b6d238339761f273a3b78f52e2676c38546f04968779096e080196e4ace36b64f45dd4b072598b712e75e75c57863bdf543a39d7c33ba29b52f100d2416c
SSDEEP 12288:AbE/HRtNDc4Tl94NTt4B7wU47yYr+H+myDqsQul21kYygdYst3N2ZgY2tieHNJn4:AbE/HR6qsQ11Lt9EsNJUDXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

cui3.ocx

Path C:\Users\Admin\cui3.ocx
Size 666KB
SHA256 791eec058c0bb722ed2eb0ad7b9e7e34da4df042b09cc19b978a90561ae3e13f
MD5 4df2c0180af87636e5122493ee11dc1f
SHA1 ac657f876812869ac9555c45bb20151d7c5d77a8
SHA512 9e76b6d238339761f273a3b78f52e2676c38546f04968779096e080196e4ace36b64f45dd4b072598b712e75e75c57863bdf543a39d7c33ba29b52f100d2416c
SSDEEP 12288:AbE/HRtNDc4Tl94NTt4B7wU47yYr+H+myDqsQul21kYygdYst3N2ZgY2tieHNJn4:AbE/HR6qsQ11Lt9EsNJUDXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

cWCCJghwBQ.dll

Path C:\Windows\System32\ZgApeAyvJybPrn\cWCCJghwBQ.dll
Size 666KB
SHA256 791eec058c0bb722ed2eb0ad7b9e7e34da4df042b09cc19b978a90561ae3e13f
MD5 4df2c0180af87636e5122493ee11dc1f
SHA1 ac657f876812869ac9555c45bb20151d7c5d77a8
SHA512 9e76b6d238339761f273a3b78f52e2676c38546f04968779096e080196e4ace36b64f45dd4b072598b712e75e75c57863bdf543a39d7c33ba29b52f100d2416c
SSDEEP 12288:AbE/HRtNDc4Tl94NTt4B7wU47yYr+H+myDqsQul21kYygdYst3N2ZgY2tieHNJn4:AbE/HR6qsQ11Lt9EsNJUDXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4548-134-0x00007FFE82DF0000-0x00007FFE82E00000-memory.dmp

Download

memory/4548-136-0x00007FFE806C0000-0x00007FFE806D0000-memory.dmp

Download

memory/4548-135-0x00007FFE806C0000-0x00007FFE806D0000-memory.dmp

Download

memory/4548-130-0x00007FFE82DF0000-0x00007FFE82E00000-memory.dmp

Download

memory/4548-133-0x00007FFE82DF0000-0x00007FFE82E00000-memory.dmp

Download

memory/4548-132-0x00007FFE82DF0000-0x00007FFE82E00000-memory.dmp

Download

memory/4548-131-0x00007FFE82DF0000-0x00007FFE82E00000-memory.dmp

Download

memory/4776-142-0x0000000180000000-0x000000018002B000-memory.dmp

Download