emotet | d9a9a3bdc110ab4fc3be03587c768c5924025cf07e94f368f073986f090df746

General

Target

d9a9a3bdc110ab4fc3be03587c768c5924025cf07e94f368f073986f090df746.xls
Size

217KB
MD5

c7b531a4d1c27f0a007cd733ed9cdee2
SHA1

96d7b830986e5d7688218c269e0ee0d899921026
SHA256

d9a9a3bdc110ab4fc3be03587c768c5924025cf07e94f368f073986f090df746
SHA512

d8b1cd6e838c0022368b3d80290b6332e3b08183c19ec05ad657057d4da38b8baba45a3e3a22f35385e3779f090453f75f03c865cb435528ff466ca21d5ab657
SSDEEP

6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dglyY+TAQXTHGUMEyP5p6f5jQmI:JbGUMVWlbI

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://aquariorecords.com.br/wp-content/A8G3ownNApEj1L4hF/

xlm40.dropper

http://ftp.pricoat.com.mx/Fichas/3ybJLLXu5zqqn8Sx/

xlm40.dropper

http://armannahalpersian.ir/3H5qqUOB/

xlm40.dropper

http://alagi.ge/application/irnz5Rs8qWvQrf/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4800	4372	regsvr32.exe	66
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	420	4372	regsvr32.exe	66
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	768	4372	regsvr32.exe	66
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2324	4372	regsvr32.exe	66

Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
4800	regsvr32.exe
420	regsvr32.exe
768	regsvr32.exe
2324	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XDBTHRf.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\TFLWfuxsYJHNbfc\\XDBTHRf.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PvHfPBgtKXDmKLqJ.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\TMZiGFULtBW\\PvHfPBgtKXDmKLqJ.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kmYAOAnFOXj.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\NtlbUtkup\\kmYAOAnFOXj.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ncryAeprsYpHu.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\JzLPEmQMUvA\\ncryAeprsYpHu.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4372	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4800	regsvr32.exe
4800	regsvr32.exe
4676	regsvr32.exe
4676	regsvr32.exe
4676	regsvr32.exe
4676	regsvr32.exe
420	regsvr32.exe
420	regsvr32.exe
1844	regsvr32.exe
1844	regsvr32.exe
1844	regsvr32.exe
1844	regsvr32.exe
768	regsvr32.exe
768	regsvr32.exe
3372	regsvr32.exe
3372	regsvr32.exe
3372	regsvr32.exe
3372	regsvr32.exe
2324	regsvr32.exe
2324	regsvr32.exe
808	regsvr32.exe
808	regsvr32.exe
808	regsvr32.exe
808	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4372	EXCEL.EXE
4372	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4372	EXCEL.EXE
4372	EXCEL.EXE
4372	EXCEL.EXE
4372	EXCEL.EXE
4372	EXCEL.EXE
4372	EXCEL.EXE
4372	EXCEL.EXE
4372	EXCEL.EXE
4372	EXCEL.EXE
4372	EXCEL.EXE
4372	EXCEL.EXE
4372	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4800	4372	EXCEL.EXE	69
PID 4372 wrote to memory of 4800	4372	EXCEL.EXE	69
PID 4800 wrote to memory of 4676	4800	regsvr32.exe	72
PID 4800 wrote to memory of 4676	4800	regsvr32.exe	72
PID 4372 wrote to memory of 420	4372	EXCEL.EXE	75
PID 4372 wrote to memory of 420	4372	EXCEL.EXE	75
PID 420 wrote to memory of 1844	420	regsvr32.exe	76
PID 420 wrote to memory of 1844	420	regsvr32.exe	76
PID 4372 wrote to memory of 768	4372	EXCEL.EXE	78
PID 4372 wrote to memory of 768	4372	EXCEL.EXE	78
PID 768 wrote to memory of 3372	768	regsvr32.exe	80
PID 768 wrote to memory of 3372	768	regsvr32.exe	80
PID 4372 wrote to memory of 2324	4372	EXCEL.EXE	81
PID 4372 wrote to memory of 2324	4372	EXCEL.EXE	81
PID 2324 wrote to memory of 808	2324	regsvr32.exe	82
PID 2324 wrote to memory of 808	2324	regsvr32.exe	82

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d9a9a3bdc110ab4fc3be03587c768c5924025cf07e94f368f073986f090df746.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JzLPEmQMUvA\ncryAeprsYpHu.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4676
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TFLWfuxsYJHNbfc\XDBTHRf.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1844
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TMZiGFULtBW\PvHfPBgtKXDmKLqJ.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3372
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NtlbUtkup\kmYAOAnFOXj.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
9b18ab5065d36daf483340702957bca1

SHA1
ba476b384601da04a2315a296ab7d938dd346f7e

SHA256
480e390a7746e40cf14a0cd5a1407c0618f03115f9e8ccbe5b67cd5f2e44b826

SHA512
a8cec501b8733aeb4f7a16a3fa8e482d230ba7223363b9ba3c030cb8b4642d7a0ddbc106651cb98132bb6f61df8ac32a49f801f617091cab9b804011631f82c6

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
bade9a1725ae3a1e652b4ca3e10dfa07

SHA1
8d7c320347d1e81d584827dc1639997cc7983a7d

SHA256
a2eda64582fcfd2ec634c57a212c61a2393cec043a7c7a30f67ba054c0228060

SHA512
982d0042fd86d61ae7dd50c7e1b8da38b1e5568e6a95518fb4ac20e70baaf8857fda190593c9e29c0b4f7b7bbb2f936d43fc17baa5cd39a884892f615f4830a8

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
751KB

MD5
d30992e9c413d29484f4e4a43d89dfcb

SHA1
2425f2f8724309592f3fdc1eeb60e412afe74a89

SHA256
ee8e28a9154b5438e0844f218224eef6e5c2499732b4cfd63f737c03884101cf

SHA512
3e2c0ff18fcf97eb7fa8a9ba9e4b71f6585b4416fd06eba6a913f61b183fc7eeeb7dc55d1f6f354da497e118c7ef09b51fd4cec77394485e517d7e8f7819de67

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
1c9a034b7165ecd2ffd889ee1210cb7f

SHA1
c3f21ae368e35aca5be5895994a8f2111882b34e

SHA256
7179803fb529382218135ce89bb2d35452c6fa91db3e374910f687f39a6c687d

SHA512
3ef027c195e066346072dd00272141e7240f119b61ab95fc72f99403415ac71b665d2330f981b0c83e44808a47777a226c8ad211427edab96b043a731043d770

Download Submit
\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
9b18ab5065d36daf483340702957bca1

SHA1
ba476b384601da04a2315a296ab7d938dd346f7e

SHA256
480e390a7746e40cf14a0cd5a1407c0618f03115f9e8ccbe5b67cd5f2e44b826

SHA512
a8cec501b8733aeb4f7a16a3fa8e482d230ba7223363b9ba3c030cb8b4642d7a0ddbc106651cb98132bb6f61df8ac32a49f801f617091cab9b804011631f82c6

Download Submit
\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
bade9a1725ae3a1e652b4ca3e10dfa07

SHA1
8d7c320347d1e81d584827dc1639997cc7983a7d

SHA256
a2eda64582fcfd2ec634c57a212c61a2393cec043a7c7a30f67ba054c0228060

SHA512
982d0042fd86d61ae7dd50c7e1b8da38b1e5568e6a95518fb4ac20e70baaf8857fda190593c9e29c0b4f7b7bbb2f936d43fc17baa5cd39a884892f615f4830a8

Download Submit
\Users\Admin\oxnv3.ooccxx

Filesize
751KB

MD5
d30992e9c413d29484f4e4a43d89dfcb

SHA1
2425f2f8724309592f3fdc1eeb60e412afe74a89

SHA256
ee8e28a9154b5438e0844f218224eef6e5c2499732b4cfd63f737c03884101cf

SHA512
3e2c0ff18fcf97eb7fa8a9ba9e4b71f6585b4416fd06eba6a913f61b183fc7eeeb7dc55d1f6f354da497e118c7ef09b51fd4cec77394485e517d7e8f7819de67

Download Submit
\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
1c9a034b7165ecd2ffd889ee1210cb7f

SHA1
c3f21ae368e35aca5be5895994a8f2111882b34e

SHA256
7179803fb529382218135ce89bb2d35452c6fa91db3e374910f687f39a6c687d

SHA512
3ef027c195e066346072dd00272141e7240f119b61ab95fc72f99403415ac71b665d2330f981b0c83e44808a47777a226c8ad211427edab96b043a731043d770

Download Submit
memory/4372-119-0x00007FF991080000-0x00007FF991090000-memory.dmp

Filesize
64KB

Download
memory/4372-129-0x00007FF98D610000-0x00007FF98D620000-memory.dmp

Filesize
64KB

Download
memory/4372-116-0x00007FF991080000-0x00007FF991090000-memory.dmp

Filesize
64KB

Download
memory/4372-128-0x00007FF98D610000-0x00007FF98D620000-memory.dmp

Filesize
64KB

Download
memory/4372-118-0x00007FF991080000-0x00007FF991090000-memory.dmp

Filesize
64KB

Download
memory/4372-117-0x00007FF991080000-0x00007FF991090000-memory.dmp

Filesize
64KB

Download
memory/4372-342-0x00007FF991080000-0x00007FF991090000-memory.dmp

Filesize
64KB

Download
memory/4372-343-0x00007FF991080000-0x00007FF991090000-memory.dmp

Filesize
64KB

Download
memory/4372-344-0x00007FF991080000-0x00007FF991090000-memory.dmp

Filesize
64KB

Download
memory/4372-345-0x00007FF991080000-0x00007FF991090000-memory.dmp

Filesize
64KB

Download
memory/4800-253-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads