emotet | ef2ce641a4e9f270eea626e8e4800b0b97b4a436c40e7af30aeb6f02566b809c

Analysis

max time kernel
146s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fattura 54373.xls
Size

216KB
MD5

2486374800299563ab8934122234242a
SHA1

47bfe94aa96ef43231890f04ccd286b0888e10c8
SHA256

ef2ce641a4e9f270eea626e8e4800b0b97b4a436c40e7af30aeb6f02566b809c
SHA512

74e52e1e1317908447340cbba32949321ed435f17a524224af80236ecdf67187c83908cca514e82a49b9abe9495125ba741e01ed8f30663124c13fce339c63e5
SSDEEP

6144:bKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgAyY+TAQXTHGUMEyP5p6f5jQmK:GbGUMVWlbK

Score

10^/10

emotet banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://audioselec.com/about/dDw5ggtyMojggTqhc/

xlm40.dropper

https://geringer-muehle.de/wp-admin/G/

xlm40.dropper

http://intolove.co.uk/wp-admin/FbGhiWtrEzrQ/

xlm40.dropper

http://isc.net.ua/themes/3rU/

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4840	4364	regsvr32.exe	76
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4468	4364	regsvr32.exe	76
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2252	4364	regsvr32.exe	76
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4948	4364	regsvr32.exe	76

Downloads MZ/PE file

Loads dropped DLL 6 IoCs

pid	Process
4840	regsvr32.exe
752	regsvr32.exe
4468	regsvr32.exe
1252	regsvr32.exe
2252	regsvr32.exe
1888	regsvr32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mNuStiGYgD.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\TzpPMPBvwYQY\\mNuStiGYgD.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nycqAkIUdr.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\TCvuGTJcNG\\nycqAkIUdr.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OWyRGFAMuZQQD.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\YMzztyRaLYb\\OWyRGFAMuZQQD.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4364	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4840	regsvr32.exe
4840	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
752	regsvr32.exe
4468	regsvr32.exe
4468	regsvr32.exe
1252	regsvr32.exe
1252	regsvr32.exe
2252	regsvr32.exe
2252	regsvr32.exe
1252	regsvr32.exe
1252	regsvr32.exe
1888	regsvr32.exe
1888	regsvr32.exe
1888	regsvr32.exe
1888	regsvr32.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE
4364	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4840	4364	EXCEL.EXE	83
PID 4364 wrote to memory of 4840	4364	EXCEL.EXE	83
PID 4840 wrote to memory of 752	4840	regsvr32.exe	85
PID 4840 wrote to memory of 752	4840	regsvr32.exe	85
PID 4364 wrote to memory of 4468	4364	EXCEL.EXE	88
PID 4364 wrote to memory of 4468	4364	EXCEL.EXE	88
PID 4468 wrote to memory of 1252	4468	regsvr32.exe	89
PID 4468 wrote to memory of 1252	4468	regsvr32.exe	89
PID 4364 wrote to memory of 2252	4364	EXCEL.EXE	90
PID 4364 wrote to memory of 2252	4364	EXCEL.EXE	90
PID 2252 wrote to memory of 1888	2252	regsvr32.exe	91
PID 2252 wrote to memory of 1888	2252	regsvr32.exe	91
PID 4364 wrote to memory of 4948	4364	EXCEL.EXE	92
PID 4364 wrote to memory of 4948	4364	EXCEL.EXE	92

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Fattura 54373.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TCvuGTJcNG\nycqAkIUdr.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:752
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YMzztyRaLYb\OWyRGFAMuZQQD.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1252
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TzpPMPBvwYQY\mNuStiGYgD.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1888
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:4948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv1.ooccxx

Filesize
629KB

MD5
9875abea7733cb29ae3e8cb701891ff1

SHA1
f70caf7cda3c52c934c13799e1ea5eccb8f577df

SHA256
84af45fdec95d737015feaeacf26888094c1ad7a227b517baa5c07de8f3630b7

SHA512
52711d962f523884a1fe78f3c811c966a3ebf12618fefbb886688758abf5598b2101c6b9ea18535cb18fa79cfc3d456a91647c7b35e68647ea3c9e3ba24ca2d2

Download Submit
C:\Users\Admin\oxnv1.ooccxx

Filesize
629KB

MD5
9875abea7733cb29ae3e8cb701891ff1

SHA1
f70caf7cda3c52c934c13799e1ea5eccb8f577df

SHA256
84af45fdec95d737015feaeacf26888094c1ad7a227b517baa5c07de8f3630b7

SHA512
52711d962f523884a1fe78f3c811c966a3ebf12618fefbb886688758abf5598b2101c6b9ea18535cb18fa79cfc3d456a91647c7b35e68647ea3c9e3ba24ca2d2

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
629KB

MD5
3380cc416d32671017d9ae39e243c0d7

SHA1
a5cd243c98d2edb3b9097fe9320cb1884ab593a1

SHA256
6a7896afbf51cf31a25f73ed66657d2a9352efd3fcb2af922c16a136c6f4f6ad

SHA512
b745a12b93f3207585a1e8bb4c36b1e592c8c9f1f329b896c110e5e8a2e29b04ed89b126ab600c20710388e39b225c60256dfb52a23ecea068d8d676f39d92d5

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
629KB

MD5
3380cc416d32671017d9ae39e243c0d7

SHA1
a5cd243c98d2edb3b9097fe9320cb1884ab593a1

SHA256
6a7896afbf51cf31a25f73ed66657d2a9352efd3fcb2af922c16a136c6f4f6ad

SHA512
b745a12b93f3207585a1e8bb4c36b1e592c8c9f1f329b896c110e5e8a2e29b04ed89b126ab600c20710388e39b225c60256dfb52a23ecea068d8d676f39d92d5

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
629KB

MD5
afffd878a440c39e71a44b276b2e954c

SHA1
fc219eeeca3e79a67b8403f5185c6de40e50bc75

SHA256
23e04b73cd4c134801efb1db6d5e42337157bc65a71085a8769b3549d8924bbd

SHA512
7286a96d2fc29b61fd217c5685fbd0f102641418dcefde4fb89be55915bce639abaaacc755f9058d784dbe61d8492c71cb0c618edb62113375b8bd516f164119

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
629KB

MD5
afffd878a440c39e71a44b276b2e954c

SHA1
fc219eeeca3e79a67b8403f5185c6de40e50bc75

SHA256
23e04b73cd4c134801efb1db6d5e42337157bc65a71085a8769b3549d8924bbd

SHA512
7286a96d2fc29b61fd217c5685fbd0f102641418dcefde4fb89be55915bce639abaaacc755f9058d784dbe61d8492c71cb0c618edb62113375b8bd516f164119

Download Submit
C:\Windows\System32\TCvuGTJcNG\nycqAkIUdr.dll

Filesize
629KB

MD5
9875abea7733cb29ae3e8cb701891ff1

SHA1
f70caf7cda3c52c934c13799e1ea5eccb8f577df

SHA256
84af45fdec95d737015feaeacf26888094c1ad7a227b517baa5c07de8f3630b7

SHA512
52711d962f523884a1fe78f3c811c966a3ebf12618fefbb886688758abf5598b2101c6b9ea18535cb18fa79cfc3d456a91647c7b35e68647ea3c9e3ba24ca2d2

Download Submit
C:\Windows\System32\TzpPMPBvwYQY\mNuStiGYgD.dll

Filesize
629KB

MD5
afffd878a440c39e71a44b276b2e954c

SHA1
fc219eeeca3e79a67b8403f5185c6de40e50bc75

SHA256
23e04b73cd4c134801efb1db6d5e42337157bc65a71085a8769b3549d8924bbd

SHA512
7286a96d2fc29b61fd217c5685fbd0f102641418dcefde4fb89be55915bce639abaaacc755f9058d784dbe61d8492c71cb0c618edb62113375b8bd516f164119

Download Submit
C:\Windows\System32\YMzztyRaLYb\OWyRGFAMuZQQD.dll

Filesize
629KB

MD5
3380cc416d32671017d9ae39e243c0d7

SHA1
a5cd243c98d2edb3b9097fe9320cb1884ab593a1

SHA256
6a7896afbf51cf31a25f73ed66657d2a9352efd3fcb2af922c16a136c6f4f6ad

SHA512
b745a12b93f3207585a1e8bb4c36b1e592c8c9f1f329b896c110e5e8a2e29b04ed89b126ab600c20710388e39b225c60256dfb52a23ecea068d8d676f39d92d5

Download Submit
memory/4364-138-0x00007FF9E17C0000-0x00007FF9E17D0000-memory.dmp

Filesize
64KB

Download
memory/4364-137-0x00007FF9E17C0000-0x00007FF9E17D0000-memory.dmp

Filesize
64KB

Download
memory/4364-132-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmp

Filesize
64KB

Download
memory/4364-136-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmp

Filesize
64KB

Download
memory/4364-135-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmp

Filesize
64KB

Download
memory/4364-134-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmp

Filesize
64KB

Download
memory/4364-133-0x00007FF9E3F10000-0x00007FF9E3F20000-memory.dmp

Filesize
64KB

Download
memory/4840-142-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download