emotet | faeed85fc2079e8915aea25c7112ea3f0149256e2f179ee46c766fe88bcf65bf

General

Target

faeed85fc2079e8915aea25c7112ea3f0149256e2f179ee46c766fe88bcf65bf.xls
Size

217KB
MD5

0e75650e0b5f22892e6f002cf5421844
SHA1

84605005545cee709b612bbd04f3e74feb4c6287
SHA256

faeed85fc2079e8915aea25c7112ea3f0149256e2f179ee46c766fe88bcf65bf
SHA512

e3ab82d15919e9d5a20532da55b3575f70fe3b6a62b810d10bb57ab05aff340efdda459bd6a221a4fe76fa3ff6598cedb039ff149e523d1b6179e7f15d185926
SSDEEP

6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dglyY+TAQXTHGUMEyP5p6f5jQm4:JbGUMVWlb4

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://aquariorecords.com.br/wp-content/A8G3ownNApEj1L4hF/

xlm40.dropper

http://ftp.pricoat.com.mx/Fichas/3ybJLLXu5zqqn8Sx/

xlm40.dropper

http://armannahalpersian.ir/3H5qqUOB/

xlm40.dropper

http://alagi.ge/application/irnz5Rs8qWvQrf/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4628	2672	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3544	2672	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3660	2672	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1772	2672	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
4628	regsvr32.exe
3544	regsvr32.exe
3660	regsvr32.exe
1772	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EJsSYntxOFDIbD.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\NCPMy\\EJsSYntxOFDIbD.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PQsSMB.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\YeQduBHthRgE\\PQsSMB.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VzUeyaGeT.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\FnSLFQU\\VzUeyaGeT.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SBjfeAp.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\AEszTGQMFN\\SBjfeAp.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2672	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4628	regsvr32.exe
4628	regsvr32.exe
4372	regsvr32.exe
4372	regsvr32.exe
4372	regsvr32.exe
4372	regsvr32.exe
3544	regsvr32.exe
3544	regsvr32.exe
2164	regsvr32.exe
2164	regsvr32.exe
3660	regsvr32.exe
3660	regsvr32.exe
2164	regsvr32.exe
2164	regsvr32.exe
4548	regsvr32.exe
4548	regsvr32.exe
4548	regsvr32.exe
4548	regsvr32.exe
1772	regsvr32.exe
1772	regsvr32.exe
4700	regsvr32.exe
4700	regsvr32.exe
4700	regsvr32.exe
4700	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2672	EXCEL.EXE
2672	EXCEL.EXE
2672	EXCEL.EXE
2672	EXCEL.EXE
2672	EXCEL.EXE
2672	EXCEL.EXE
2672	EXCEL.EXE
2672	EXCEL.EXE
2672	EXCEL.EXE
2672	EXCEL.EXE
2672	EXCEL.EXE
2672	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 4628	2672	EXCEL.EXE	70
PID 2672 wrote to memory of 4628	2672	EXCEL.EXE	70
PID 4628 wrote to memory of 4372	4628	regsvr32.exe	71
PID 4628 wrote to memory of 4372	4628	regsvr32.exe	71
PID 2672 wrote to memory of 3544	2672	EXCEL.EXE	72
PID 2672 wrote to memory of 3544	2672	EXCEL.EXE	72
PID 3544 wrote to memory of 2164	3544	regsvr32.exe	74
PID 3544 wrote to memory of 2164	3544	regsvr32.exe	74
PID 2672 wrote to memory of 3660	2672	EXCEL.EXE	75
PID 2672 wrote to memory of 3660	2672	EXCEL.EXE	75
PID 3660 wrote to memory of 4548	3660	regsvr32.exe	76
PID 3660 wrote to memory of 4548	3660	regsvr32.exe	76
PID 2672 wrote to memory of 1772	2672	EXCEL.EXE	77
PID 2672 wrote to memory of 1772	2672	EXCEL.EXE	77
PID 1772 wrote to memory of 4700	1772	regsvr32.exe	78
PID 1772 wrote to memory of 4700	1772	regsvr32.exe	78

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\faeed85fc2079e8915aea25c7112ea3f0149256e2f179ee46c766fe88bcf65bf.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FnSLFQU\VzUeyaGeT.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4372
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AEszTGQMFN\SBjfeAp.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2164
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NCPMy\EJsSYntxOFDIbD.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4548
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YeQduBHthRgE\PQsSMB.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
6e0033e4b15b0b1aa904f6f1ca7646a5

SHA1
b81403e37f66b0eb1d840e24cf458204b868d5f2

SHA256
35aa2872fd4188f9047d0fd38cce16e090a286c075413fc9831f32f606536b77

SHA512
31b670c4caf8c538bead34af34b80785128e393b59128e8127916848d47c13eddf79409f0ba13673a6b571679e6be53ba2a6fcd1a0d74ccf37b6bed2b726972d

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
bade9a1725ae3a1e652b4ca3e10dfa07

SHA1
8d7c320347d1e81d584827dc1639997cc7983a7d

SHA256
a2eda64582fcfd2ec634c57a212c61a2393cec043a7c7a30f67ba054c0228060

SHA512
982d0042fd86d61ae7dd50c7e1b8da38b1e5568e6a95518fb4ac20e70baaf8857fda190593c9e29c0b4f7b7bbb2f936d43fc17baa5cd39a884892f615f4830a8

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
751KB

MD5
d30992e9c413d29484f4e4a43d89dfcb

SHA1
2425f2f8724309592f3fdc1eeb60e412afe74a89

SHA256
ee8e28a9154b5438e0844f218224eef6e5c2499732b4cfd63f737c03884101cf

SHA512
3e2c0ff18fcf97eb7fa8a9ba9e4b71f6585b4416fd06eba6a913f61b183fc7eeeb7dc55d1f6f354da497e118c7ef09b51fd4cec77394485e517d7e8f7819de67

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
8d2a802e847f059a477d96c7d300dc21

SHA1
6c1f8d1a2ffcbe21b84b3f5b431407d0357dcfa9

SHA256
827b6a3c62d15c9e822e6fa4bc61bd5e8a28984bc232d6331786607949a449f9

SHA512
876c7f3aba0ad77e3184874be7a97f440de2e48f4ec63141c7c00795c61beef52373310fa8e54c164299ba4238fd4515ef2f4ec223df2e1d9dc57cd069e1ae3e

Download Submit
\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
6e0033e4b15b0b1aa904f6f1ca7646a5

SHA1
b81403e37f66b0eb1d840e24cf458204b868d5f2

SHA256
35aa2872fd4188f9047d0fd38cce16e090a286c075413fc9831f32f606536b77

SHA512
31b670c4caf8c538bead34af34b80785128e393b59128e8127916848d47c13eddf79409f0ba13673a6b571679e6be53ba2a6fcd1a0d74ccf37b6bed2b726972d

Download Submit
\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
bade9a1725ae3a1e652b4ca3e10dfa07

SHA1
8d7c320347d1e81d584827dc1639997cc7983a7d

SHA256
a2eda64582fcfd2ec634c57a212c61a2393cec043a7c7a30f67ba054c0228060

SHA512
982d0042fd86d61ae7dd50c7e1b8da38b1e5568e6a95518fb4ac20e70baaf8857fda190593c9e29c0b4f7b7bbb2f936d43fc17baa5cd39a884892f615f4830a8

Download Submit
\Users\Admin\oxnv3.ooccxx

Filesize
751KB

MD5
d30992e9c413d29484f4e4a43d89dfcb

SHA1
2425f2f8724309592f3fdc1eeb60e412afe74a89

SHA256
ee8e28a9154b5438e0844f218224eef6e5c2499732b4cfd63f737c03884101cf

SHA512
3e2c0ff18fcf97eb7fa8a9ba9e4b71f6585b4416fd06eba6a913f61b183fc7eeeb7dc55d1f6f354da497e118c7ef09b51fd4cec77394485e517d7e8f7819de67

Download Submit
\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
8d2a802e847f059a477d96c7d300dc21

SHA1
6c1f8d1a2ffcbe21b84b3f5b431407d0357dcfa9

SHA256
827b6a3c62d15c9e822e6fa4bc61bd5e8a28984bc232d6331786607949a449f9

SHA512
876c7f3aba0ad77e3184874be7a97f440de2e48f4ec63141c7c00795c61beef52373310fa8e54c164299ba4238fd4515ef2f4ec223df2e1d9dc57cd069e1ae3e

Download Submit
memory/2672-341-0x00007FFA31170000-0x00007FFA31180000-memory.dmp

Filesize
64KB

Download
memory/2672-342-0x00007FFA31170000-0x00007FFA31180000-memory.dmp

Filesize
64KB

Download
memory/2672-343-0x00007FFA31170000-0x00007FFA31180000-memory.dmp

Filesize
64KB

Download
memory/2672-129-0x00007FFA2D600000-0x00007FFA2D610000-memory.dmp

Filesize
64KB

Download
memory/2672-340-0x00007FFA31170000-0x00007FFA31180000-memory.dmp

Filesize
64KB

Download
memory/2672-128-0x00007FFA2D600000-0x00007FFA2D610000-memory.dmp

Filesize
64KB

Download
memory/2672-119-0x00007FFA31170000-0x00007FFA31180000-memory.dmp

Filesize
64KB

Download
memory/2672-116-0x00007FFA31170000-0x00007FFA31180000-memory.dmp

Filesize
64KB

Download
memory/2672-118-0x00007FFA31170000-0x00007FFA31180000-memory.dmp

Filesize
64KB

Download
memory/2672-117-0x00007FFA31170000-0x00007FFA31180000-memory.dmp

Filesize
64KB

Download
memory/4628-261-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads