emotet | e7ea45c7ca3ae5dcba232a87bbffec61987e3442216ab7b7b6fe215efb9307a8

General

Target

e7ea45c7ca3ae5dcba232a87bbffec61987e3442216ab7b7b6fe215efb9307a8.xls
Size

217KB
MD5

41eb5ba0c78580fa3ad7ed762923b486
SHA1

9f6f2da12c23f1b62cdf7f92daf39b7f2328eb69
SHA256

e7ea45c7ca3ae5dcba232a87bbffec61987e3442216ab7b7b6fe215efb9307a8
SHA512

75a8384752232c741c3f668fb19804f3d0e765e5dd7c6a71e5138f09df293f928babed9a843a35edabd0be95585ecbf544f12345118621b0318be7918e950cd7
SSDEEP

6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgXyY+TAQXTHGUMEyP5p6f5jQm6:DbGUMVWlb6

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://barkstage.es/wp-content/0E7NdYl7TZuHMJq7/

xlm40.dropper

http://contactworks.nl/images_old/NuEAhfF0PCFhvv/

xlm40.dropper

http://www.iam.ch/wp-content/cache/minify/O1OAjWnfen/

xlm40.dropper

https://www.elaboro.pl/wp-admin/J0hwyIMsk9YFIi/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4736	3844	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4864	3844	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1672	3844	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2012	3844	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 3 IoCs

pid	Process
4736	regsvr32.exe
4864	regsvr32.exe
2012	regsvr32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AwwMDncJMPjENKot.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\MpdgHqPv\\AwwMDncJMPjENKot.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vXiLlpkpAhzOy.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\CqcnY\\vXiLlpkpAhzOy.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UCdHANzwYSJp.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\Wudkf\\UCdHANzwYSJp.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3844	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4736	regsvr32.exe
4736	regsvr32.exe
3572	regsvr32.exe
3572	regsvr32.exe
4864	regsvr32.exe
4864	regsvr32.exe
3572	regsvr32.exe
3572	regsvr32.exe
788	regsvr32.exe
788	regsvr32.exe
788	regsvr32.exe
788	regsvr32.exe
2012	regsvr32.exe
2012	regsvr32.exe
288	regsvr32.exe
288	regsvr32.exe
288	regsvr32.exe
288	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3844	EXCEL.EXE
3844	EXCEL.EXE
3844	EXCEL.EXE
3844	EXCEL.EXE
3844	EXCEL.EXE
3844	EXCEL.EXE
3844	EXCEL.EXE
3844	EXCEL.EXE
3844	EXCEL.EXE
3844	EXCEL.EXE
3844	EXCEL.EXE
3844	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 4736	3844	EXCEL.EXE	68
PID 3844 wrote to memory of 4736	3844	EXCEL.EXE	68
PID 4736 wrote to memory of 3572	4736	regsvr32.exe	71
PID 4736 wrote to memory of 3572	4736	regsvr32.exe	71
PID 3844 wrote to memory of 4864	3844	EXCEL.EXE	74
PID 3844 wrote to memory of 4864	3844	EXCEL.EXE	74
PID 4864 wrote to memory of 788	4864	regsvr32.exe	75
PID 4864 wrote to memory of 788	4864	regsvr32.exe	75
PID 3844 wrote to memory of 1672	3844	EXCEL.EXE	76
PID 3844 wrote to memory of 1672	3844	EXCEL.EXE	76
PID 3844 wrote to memory of 2012	3844	EXCEL.EXE	78
PID 3844 wrote to memory of 2012	3844	EXCEL.EXE	78
PID 2012 wrote to memory of 288	2012	regsvr32.exe	79
PID 2012 wrote to memory of 288	2012	regsvr32.exe	79

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e7ea45c7ca3ae5dcba232a87bbffec61987e3442216ab7b7b6fe215efb9307a8.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MpdgHqPv\AwwMDncJMPjENKot.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3572
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CqcnY\vXiLlpkpAhzOy.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:788
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:1672
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Wudkf\UCdHANzwYSJp.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
0948809d06ea59dcb40550b49c376cdf

SHA1
707023497386bc42ad3d87bef68571b0960260dc

SHA256
1e359a92a1209574ef88716adc0f2877540d967a61649ce0d0b9c613381478c8

SHA512
98014aea521429917b94a37d0d8fba25dcb16535e89fd4bec869372072573e09c3659f83ddb8cce07ee6cae3adc7a49627dbdbcfeb8cd56b7cc0d8d12844ed77

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
e506330c6571a209ec74dd227a5561d9

SHA1
1e4f649d2b458b7fd42ccd94e17f89d350905c46

SHA256
ea9efb061e7d1a1c983f370baf322f6f5f58cfcc2c9b1f1ff0a55509f4910479

SHA512
8c94f5576b63121325634e30ed5d8765601a4c892bdc7e1966e01809b650572c04a3be1f342d32b398d5185189ce501a443a3e3a93ea5353a60e738d0150266f

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
3c0393ff84df3a47d30c1ac8b975d034

SHA1
7d12e5d7a8a87545c615daa8e7c4596171d91e28

SHA256
4302736d4c079d144aaa48a3a5313ddbf0cfe2d5d7603e9f44cb05d840221859

SHA512
eabf8756a185bfb7f4f4e828a20dae0ab5d875ae5255e42271bffd4e2acaa97b8ba5ebb34ec067064ef666dc6672eb95dae6a109d519a5fcac1ea41aacbe64b3

Download Submit
\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
0948809d06ea59dcb40550b49c376cdf

SHA1
707023497386bc42ad3d87bef68571b0960260dc

SHA256
1e359a92a1209574ef88716adc0f2877540d967a61649ce0d0b9c613381478c8

SHA512
98014aea521429917b94a37d0d8fba25dcb16535e89fd4bec869372072573e09c3659f83ddb8cce07ee6cae3adc7a49627dbdbcfeb8cd56b7cc0d8d12844ed77

Download Submit
\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
e506330c6571a209ec74dd227a5561d9

SHA1
1e4f649d2b458b7fd42ccd94e17f89d350905c46

SHA256
ea9efb061e7d1a1c983f370baf322f6f5f58cfcc2c9b1f1ff0a55509f4910479

SHA512
8c94f5576b63121325634e30ed5d8765601a4c892bdc7e1966e01809b650572c04a3be1f342d32b398d5185189ce501a443a3e3a93ea5353a60e738d0150266f

Download Submit
\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
3c0393ff84df3a47d30c1ac8b975d034

SHA1
7d12e5d7a8a87545c615daa8e7c4596171d91e28

SHA256
4302736d4c079d144aaa48a3a5313ddbf0cfe2d5d7603e9f44cb05d840221859

SHA512
eabf8756a185bfb7f4f4e828a20dae0ab5d875ae5255e42271bffd4e2acaa97b8ba5ebb34ec067064ef666dc6672eb95dae6a109d519a5fcac1ea41aacbe64b3

Download Submit
memory/288-322-0x0000000000000000-mapping.dmp

Download
memory/788-303-0x0000000000000000-mapping.dmp

Download
memory/1672-309-0x0000000000000000-mapping.dmp

Download
memory/2012-312-0x0000000000000000-mapping.dmp

Download
memory/3572-284-0x0000000000000000-mapping.dmp

Download
memory/3844-352-0x00007FFE49A90000-0x00007FFE49AA0000-memory.dmp

Filesize
64KB

Download
memory/3844-118-0x00007FFE49A90000-0x00007FFE49AA0000-memory.dmp

Filesize
64KB

Download
memory/3844-117-0x00007FFE49A90000-0x00007FFE49AA0000-memory.dmp

Filesize
64KB

Download
memory/3844-127-0x00007FFE46270000-0x00007FFE46280000-memory.dmp

Filesize
64KB

Download
memory/3844-116-0x00007FFE49A90000-0x00007FFE49AA0000-memory.dmp

Filesize
64KB

Download
memory/3844-115-0x00007FFE49A90000-0x00007FFE49AA0000-memory.dmp

Filesize
64KB

Download
memory/3844-128-0x00007FFE46270000-0x00007FFE46280000-memory.dmp

Filesize
64KB

Download
memory/3844-353-0x00007FFE49A90000-0x00007FFE49AA0000-memory.dmp

Filesize
64KB

Download
memory/3844-354-0x00007FFE49A90000-0x00007FFE49AA0000-memory.dmp

Filesize
64KB

Download
memory/3844-355-0x00007FFE49A90000-0x00007FFE49AA0000-memory.dmp

Filesize
64KB

Download
memory/4736-276-0x0000000000000000-mapping.dmp

Download
memory/4736-279-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/4864-295-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads