Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Analysis

  • max time kernel
    135s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    07-07-2022 04:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7dd062bb77a2a6a3c5d38c2a078faa8b06c1b31b90874472b53b9b27f931a81e.xls

  • Size

    95KB

  • MD5

    1888a5cfb2293aec9c29872dc1e62239

  • SHA1

    06dbffbcd6136fe406a84c14646d4a9200b0b9ea

  • SHA256

    7dd062bb77a2a6a3c5d38c2a078faa8b06c1b31b90874472b53b9b27f931a81e

  • SHA512

    5dd6ea157219040c5459ffe5a370057d6c915fa5ff098a7e4e8217128cdb32da6b4e85b8c904117835dd328f6e10bd1bb2845dde8dbb775dd30518d9a8b3a5db

Score
10/10
emotetepoch4bankersuricatatrojan

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.sunflowerlaboratory.in/fonts/79Tq62ly/
xlm40.dropper

http://dirigent.co.uk/vardagsekonomi/iC36jJ4J1cf/
xlm40.dropper

http://agtrade.hu/images/kiQYmOs2tSKq/

Extracted

Family

emotet

Botnet

Epoch4

C2

94.23.45.86:4143

209.97.163.214:443

212.24.98.99:8080

103.43.75.120:443

183.111.227.137:8080

197.242.150.244:8080

129.232.188.93:443

159.65.88.10:8080

163.44.196.120:8080

51.161.73.194:443

164.90.222.65:443

159.89.202.34:443

1.234.2.232:8080

150.95.66.124:8080

51.91.76.89:8080

196.218.30.83:443

5.9.116.246:8080

146.59.226.45:443

173.212.193.249:8080

213.241.20.155:443
eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7dd062bb77a2a6a3c5d38c2a078faa8b06c1b31b90874472b53b9b27f931a81e.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:920
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci1.ocx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4936
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YkvaA\cUHHRgWRR.dll"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5112
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci2.ocx
      2⤵
      • Process spawned unexpected child process
      PID:5020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\soci1.ocx
    Filesize

    312KB

    MD5

    fc77abd23a6e881a617a4cd434f9e6cf

    SHA1

    7b315f0c59cc7279e8b0f6009fa608f67fe635cd

    SHA256

    994c9244257c356ce77bdd85aa8bdbc8e493add86e9fdd417722d3063d6d827f

    SHA512

    837df79d366be72d4d1aa769cf2cd9f777e434131d040e6f37d25ca2d3b92e0fb46a83d3a8b1b704340c92674916b0d5ccf78ecd68e0add60659b44995911a59

    Download Submit
  • \Users\Admin\soci1.ocx
    Filesize

    312KB

    MD5

    fc77abd23a6e881a617a4cd434f9e6cf

    SHA1

    7b315f0c59cc7279e8b0f6009fa608f67fe635cd

    SHA256

    994c9244257c356ce77bdd85aa8bdbc8e493add86e9fdd417722d3063d6d827f

    SHA512

    837df79d366be72d4d1aa769cf2cd9f777e434131d040e6f37d25ca2d3b92e0fb46a83d3a8b1b704340c92674916b0d5ccf78ecd68e0add60659b44995911a59

    Download Submit
  • memory/920-118-0x00007FFE7A3C0000-0x00007FFE7A3D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/920-119-0x00007FFE7A3C0000-0x00007FFE7A3D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/920-120-0x00007FFE7A3C0000-0x00007FFE7A3D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/920-121-0x00007FFE7A3C0000-0x00007FFE7A3D0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/920-130-0x00007FFE768A0000-0x00007FFE768B0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/920-131-0x00007FFE768A0000-0x00007FFE768B0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4936-268-0x0000000000000000-mapping.dmp
    Download
  • memory/4936-271-0x0000000180000000-0x000000018002D000-memory.dmp
    Filesize

    180KB

    Download
  • memory/5020-281-0x0000000000000000-mapping.dmp
    Download
  • memory/5112-282-0x0000000000000000-mapping.dmp
    Download