emotet | ef2ce641a4e9f270eea626e8e4800b0b97b4a436c40e7af30aeb6f02566b809c

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
emotet.xls
Size 216KB
Sample221102-k3wdbsbddp
SHA256 ef2ce641a4e9f270eea626e8e4800b0b97b4a436c40e7af30aeb6f02566b809c
MD5 2486374800299563ab8934122234242a
SHA1 47bfe94aa96ef43231890f04ccd286b0888e10c8
SHA512 74e52e1e1317908447340cbba32949321ed435f17a524224af80236ecdf67187c83908cca514e82a49b9abe9495125ba741e01ed8f30663124c13fce339c63e5
SSDEEP 6144:bKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgAyY+TAQXTHGUMEyP5p6f5jQmK:GbGUMVWlbK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
https://audioselec.com/about/dDw5ggtyMojggTqhc/
xlm40.dropper
https://geringer-muehle.de/wp-admin/G/
xlm40.dropper
http://intolove.co.uk/wp-admin/FbGhiWtrEzrQ/
xlm40.dropper
http://isc.net.ua/themes/3rU/

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2412	2532	regsvr32.exe	81
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	460	2532	regsvr32.exe	81
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2644	2532	regsvr32.exe	81
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3016	2532	regsvr32.exe	81

Downloads MZ/PE file

Loads dropped DLL 8 IoCs

pid	Process
2412	regsvr32.exe
5028	regsvr32.exe
460	regsvr32.exe
4288	regsvr32.exe
2644	regsvr32.exe
3476	regsvr32.exe
3016	regsvr32.exe
1652	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MgUvTwVyMN.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\CzOpKGzVwNlQ\\MgUvTwVyMN.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TaGB.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\AzqJmQV\\TaGB.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KHoYotjYc.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\PidEq\\KHoYotjYc.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\echDM.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\GxlxanwEdqzuhsR\\echDM.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2532	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2412	regsvr32.exe
2412	regsvr32.exe
5028	regsvr32.exe
5028	regsvr32.exe
460	regsvr32.exe
460	regsvr32.exe
5028	regsvr32.exe
5028	regsvr32.exe
2644	regsvr32.exe
4288	regsvr32.exe
2644	regsvr32.exe
4288	regsvr32.exe
4288	regsvr32.exe
4288	regsvr32.exe
3476	regsvr32.exe
3476	regsvr32.exe
3016	regsvr32.exe
3016	regsvr32.exe
3476	regsvr32.exe
3476	regsvr32.exe
1652	regsvr32.exe
1652	regsvr32.exe
1652	regsvr32.exe
1652	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2532	EXCEL.EXE
2532	EXCEL.EXE
2532	EXCEL.EXE
2532	EXCEL.EXE
2532	EXCEL.EXE
2532	EXCEL.EXE
2532	EXCEL.EXE
2532	EXCEL.EXE
2532	EXCEL.EXE
2532	EXCEL.EXE
2532	EXCEL.EXE
2532	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2412	2532	EXCEL.EXE	87
PID 2532 wrote to memory of 2412	2532	EXCEL.EXE	87
PID 2412 wrote to memory of 5028	2412	regsvr32.exe	88
PID 2412 wrote to memory of 5028	2412	regsvr32.exe	88
PID 2532 wrote to memory of 460	2532	EXCEL.EXE	89
PID 2532 wrote to memory of 460	2532	EXCEL.EXE	89
PID 460 wrote to memory of 4288	460	regsvr32.exe	92
PID 460 wrote to memory of 4288	460	regsvr32.exe	92
PID 2532 wrote to memory of 2644	2532	EXCEL.EXE	93
PID 2532 wrote to memory of 2644	2532	EXCEL.EXE	93
PID 2644 wrote to memory of 3476	2644	regsvr32.exe	94
PID 2644 wrote to memory of 3476	2644	regsvr32.exe	94
PID 2532 wrote to memory of 3016	2532	EXCEL.EXE	95
PID 2532 wrote to memory of 3016	2532	EXCEL.EXE	95
PID 3016 wrote to memory of 1652	3016	regsvr32.exe	96
PID 3016 wrote to memory of 1652	3016	regsvr32.exe	96

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\emotet.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GxlxanwEdqzuhsR\echDM.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:5028
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CzOpKGzVwNlQ\MgUvTwVyMN.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4288
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AzqJmQV\TaGB.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3476
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PidEq\KHoYotjYc.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oxnv1.ooccxx

Path C:\Users\Admin\oxnv1.ooccxx
Size 660KB
SHA256 f35e5363dc1380cb48dd6ede2eb3a32968456d4dc1f2aaa2f0a3df6f82f52abb
MD5 64f0855bc28e84b8281173cf6d83b52f
SHA1 9f4b72ae83ca3fd006e6de454e496eb4b65fa8b5
SHA512 1d02929f8c3b88713bafd0c861f764133603c78550abd2cb0df7369ebcd7e4a731bdcb0bf4100b7d9584b5e8aec78e0e67ecf07b8dd88f2b02fdc8d6bfa4bd87
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl4d/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZyYukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxnv1.ooccxx

Path C:\Users\Admin\oxnv1.ooccxx
Size 660KB
SHA256 f35e5363dc1380cb48dd6ede2eb3a32968456d4dc1f2aaa2f0a3df6f82f52abb
MD5 64f0855bc28e84b8281173cf6d83b52f
SHA1 9f4b72ae83ca3fd006e6de454e496eb4b65fa8b5
SHA512 1d02929f8c3b88713bafd0c861f764133603c78550abd2cb0df7369ebcd7e4a731bdcb0bf4100b7d9584b5e8aec78e0e67ecf07b8dd88f2b02fdc8d6bfa4bd87
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl4d/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZyYukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxnv2.ooccxx

Path C:\Users\Admin\oxnv2.ooccxx
Size 660KB
SHA256 9c3c0c2f2f68d6e3f0a795bb81770dae40f2e2e7d9309429a62819e7179136df
MD5 fa1ceceebf873a948d959675aa083f05
SHA1 0379f6d6d01a785b63acb062a1afe2e98925e00d
SHA512 9aef020f1519b2cbf898ff5899fc53af668f132c665484c0965ea539de33dbd3d3895635fc6f9686324b4b189945b528a0e8bcfe9d844080bfe64745fd877df1
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl47/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZy+ukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxnv2.ooccxx

Path C:\Users\Admin\oxnv2.ooccxx
Size 660KB
SHA256 9c3c0c2f2f68d6e3f0a795bb81770dae40f2e2e7d9309429a62819e7179136df
MD5 fa1ceceebf873a948d959675aa083f05
SHA1 0379f6d6d01a785b63acb062a1afe2e98925e00d
SHA512 9aef020f1519b2cbf898ff5899fc53af668f132c665484c0965ea539de33dbd3d3895635fc6f9686324b4b189945b528a0e8bcfe9d844080bfe64745fd877df1
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl47/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZy+ukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxnv3.ooccxx

Path C:\Users\Admin\oxnv3.ooccxx
Size 660KB
SHA256 60ad78bba3a73ff507b6be676a9aaa423430a0eedead104b23724b2d7283cac6
MD5 6cb2a7b48fe278711a17b47232ffe5ed
SHA1 8a5b132a4e31bdf171092fd185ae39a7b48c3a67
SHA512 e89d3e6d872469b3b0416930090ac4dcfdf828fdfa7db5ece22d8fbcf7490f7d163a3351acd4dc2d44c3668fefb037c775d1361289e9c11f513c2cdcdaeb6863
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl4C/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZytukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxnv3.ooccxx

Path C:\Users\Admin\oxnv3.ooccxx
Size 660KB
SHA256 60ad78bba3a73ff507b6be676a9aaa423430a0eedead104b23724b2d7283cac6
MD5 6cb2a7b48fe278711a17b47232ffe5ed
SHA1 8a5b132a4e31bdf171092fd185ae39a7b48c3a67
SHA512 e89d3e6d872469b3b0416930090ac4dcfdf828fdfa7db5ece22d8fbcf7490f7d163a3351acd4dc2d44c3668fefb037c775d1361289e9c11f513c2cdcdaeb6863
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl4C/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZytukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxnv4.ooccxx

Path C:\Users\Admin\oxnv4.ooccxx
Size 660KB
SHA256 6325e94ca59f6d33e29dabfa2cbcaf54565549bdee81b56348aab4e088e84166
MD5 85178f44f970555523bc751770853851
SHA1 a6d5a6e3128ac82ff6208b2939f8a691ddaa237f
SHA512 093ab82623c4747b703f584894b80ba4130e03a32fb05453e1d6dfce2125267e760bdcdc44f0158b4dbbab571bf372981316de6240f76cc4bc20b43a6338b1b6
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl4G/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZypukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

oxnv4.ooccxx

Path C:\Users\Admin\oxnv4.ooccxx
Size 660KB
SHA256 6325e94ca59f6d33e29dabfa2cbcaf54565549bdee81b56348aab4e088e84166
MD5 85178f44f970555523bc751770853851
SHA1 a6d5a6e3128ac82ff6208b2939f8a691ddaa237f
SHA512 093ab82623c4747b703f584894b80ba4130e03a32fb05453e1d6dfce2125267e760bdcdc44f0158b4dbbab571bf372981316de6240f76cc4bc20b43a6338b1b6
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl4G/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZypukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

TaGB.dll

Path C:\Windows\System32\AzqJmQV\TaGB.dll
Size 660KB
SHA256 60ad78bba3a73ff507b6be676a9aaa423430a0eedead104b23724b2d7283cac6
MD5 6cb2a7b48fe278711a17b47232ffe5ed
SHA1 8a5b132a4e31bdf171092fd185ae39a7b48c3a67
SHA512 e89d3e6d872469b3b0416930090ac4dcfdf828fdfa7db5ece22d8fbcf7490f7d163a3351acd4dc2d44c3668fefb037c775d1361289e9c11f513c2cdcdaeb6863
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl4C/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZytukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MgUvTwVyMN.dll

Path C:\Windows\System32\CzOpKGzVwNlQ\MgUvTwVyMN.dll
Size 660KB
SHA256 9c3c0c2f2f68d6e3f0a795bb81770dae40f2e2e7d9309429a62819e7179136df
MD5 fa1ceceebf873a948d959675aa083f05
SHA1 0379f6d6d01a785b63acb062a1afe2e98925e00d
SHA512 9aef020f1519b2cbf898ff5899fc53af668f132c665484c0965ea539de33dbd3d3895635fc6f9686324b4b189945b528a0e8bcfe9d844080bfe64745fd877df1
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl47/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZy+ukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

echDM.dll

Path C:\Windows\System32\GxlxanwEdqzuhsR\echDM.dll
Size 660KB
SHA256 f35e5363dc1380cb48dd6ede2eb3a32968456d4dc1f2aaa2f0a3df6f82f52abb
MD5 64f0855bc28e84b8281173cf6d83b52f
SHA1 9f4b72ae83ca3fd006e6de454e496eb4b65fa8b5
SHA512 1d02929f8c3b88713bafd0c861f764133603c78550abd2cb0df7369ebcd7e4a731bdcb0bf4100b7d9584b5e8aec78e0e67ecf07b8dd88f2b02fdc8d6bfa4bd87
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl4d/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZyYukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

KHoYotjYc.dll

Path C:\Windows\System32\PidEq\KHoYotjYc.dll
Size 660KB
SHA256 6325e94ca59f6d33e29dabfa2cbcaf54565549bdee81b56348aab4e088e84166
MD5 85178f44f970555523bc751770853851
SHA1 a6d5a6e3128ac82ff6208b2939f8a691ddaa237f
SHA512 093ab82623c4747b703f584894b80ba4130e03a32fb05453e1d6dfce2125267e760bdcdc44f0158b4dbbab571bf372981316de6240f76cc4bc20b43a6338b1b6
SSDEEP 12288:H6NFi+qz19gtAgY2tiZl4G/aukg78I8v4lSRi4gu2CTRD:aNY19gigZtiZypukmQAlQEG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2412-142-0x0000000180000000-0x000000018002F000-memory.dmp

Download

memory/2532-136-0x00007FFC32230000-0x00007FFC32240000-memory.dmp

Download

memory/2532-132-0x00007FFC32230000-0x00007FFC32240000-memory.dmp

Download

memory/2532-138-0x00007FFC2FA10000-0x00007FFC2FA20000-memory.dmp

Download

memory/2532-137-0x00007FFC2FA10000-0x00007FFC2FA20000-memory.dmp

Download

memory/2532-135-0x00007FFC32230000-0x00007FFC32240000-memory.dmp

Download

memory/2532-133-0x00007FFC32230000-0x00007FFC32240000-memory.dmp

Download

memory/2532-134-0x00007FFC32230000-0x00007FFC32240000-memory.dmp

Download