emotet | 7a9b9c85dce039c6a7e5cbcc4f9c91a1bd582027fc25a41a5f6e18bfc4365f38

General

Target

7a9b9c85dce039c6a7e5cbcc4f9c91a1bd582027fc25a41a5f6e18bfc4365f38.xls
Size

217KB
MD5

ddee987abc8b88a478ef2e50311bd146
SHA1

ed023c9df6576a617a9358f96798d8f386ac1869
SHA256

7a9b9c85dce039c6a7e5cbcc4f9c91a1bd582027fc25a41a5f6e18bfc4365f38
SHA512

6595cd5c41b786155df64a58359e092a1654b8a570fe0c9c9cd2055ce2928525cefb6449e709357a935fa2aa16c355f799c37b92a1f65f6aaa3e4334e2f18b31
SSDEEP

6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dglyY+TAQXTHGUMEyP5p6f5jQm4:JbGUMVWlb4

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://aquariorecords.com.br/wp-content/A8G3ownNApEj1L4hF/

xlm40.dropper

http://ftp.pricoat.com.mx/Fichas/3ybJLLXu5zqqn8Sx/

xlm40.dropper

http://armannahalpersian.ir/3H5qqUOB/

xlm40.dropper

http://alagi.ge/application/irnz5Rs8qWvQrf/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3036	3540	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	920	3540	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1352	3540	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2248	3540	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
3036	regsvr32.exe
920	regsvr32.exe
1352	regsvr32.exe
2248	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fHNcJPRC.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\RYELDDdlTIur\\fHNcJPRC.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MWWwfHolItQEZx.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\LnmetnDVh\\MWWwfHolItQEZx.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AbbWJSIHN.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\ChDFCXIi\\AbbWJSIHN.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZAMWbzGp.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\AMqDrHYYSA\\ZAMWbzGp.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3540	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3036	regsvr32.exe
3036	regsvr32.exe
4516	regsvr32.exe
4516	regsvr32.exe
4516	regsvr32.exe
4516	regsvr32.exe
920	regsvr32.exe
920	regsvr32.exe
1192	regsvr32.exe
1192	regsvr32.exe
1192	regsvr32.exe
1192	regsvr32.exe
1352	regsvr32.exe
1352	regsvr32.exe
164	regsvr32.exe
164	regsvr32.exe
2248	regsvr32.exe
2248	regsvr32.exe
164	regsvr32.exe
164	regsvr32.exe
916	regsvr32.exe
916	regsvr32.exe
916	regsvr32.exe
916	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3540	EXCEL.EXE
3540	EXCEL.EXE
3540	EXCEL.EXE
3540	EXCEL.EXE
3540	EXCEL.EXE
3540	EXCEL.EXE
3540	EXCEL.EXE
3540	EXCEL.EXE
3540	EXCEL.EXE
3540	EXCEL.EXE
3540	EXCEL.EXE
3540	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3036	3540	EXCEL.EXE	69
PID 3540 wrote to memory of 3036	3540	EXCEL.EXE	69
PID 3036 wrote to memory of 4516	3036	regsvr32.exe	73
PID 3036 wrote to memory of 4516	3036	regsvr32.exe	73
PID 3540 wrote to memory of 920	3540	EXCEL.EXE	75
PID 3540 wrote to memory of 920	3540	EXCEL.EXE	75
PID 920 wrote to memory of 1192	920	regsvr32.exe	76
PID 920 wrote to memory of 1192	920	regsvr32.exe	76
PID 3540 wrote to memory of 1352	3540	EXCEL.EXE	77
PID 3540 wrote to memory of 1352	3540	EXCEL.EXE	77
PID 1352 wrote to memory of 164	1352	regsvr32.exe	79
PID 1352 wrote to memory of 164	1352	regsvr32.exe	79
PID 3540 wrote to memory of 2248	3540	EXCEL.EXE	80
PID 3540 wrote to memory of 2248	3540	EXCEL.EXE	80
PID 2248 wrote to memory of 916	2248	regsvr32.exe	81
PID 2248 wrote to memory of 916	2248	regsvr32.exe	81

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7a9b9c85dce039c6a7e5cbcc4f9c91a1bd582027fc25a41a5f6e18bfc4365f38.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RYELDDdlTIur\fHNcJPRC.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4516
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LnmetnDVh\MWWwfHolItQEZx.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1192
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ChDFCXIi\AbbWJSIHN.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:164
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AMqDrHYYSA\ZAMWbzGp.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
8b06ce89cb25e10b68680a6a9a0a9a28

SHA1
ec8d35cddc806fa3abefa822d82d1cf9e08aa8f2

SHA256
20eae4899b0156c7b922ba981a4dcddcf8233483058c38845b4b7bd29d91f36d

SHA512
519613513741f09795db681de4f312f9e4efb720ce05b64daeeec37c8b72545c5413becdc929873242379ae24913cc446135387e0ae6af5e93320734d50b2154

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
8e6279b83610b51cbe73d4a470e2c9bd

SHA1
798fcfa9a2064aa9a432d005aa1dace2786eac59

SHA256
5e5725169d95569a2d3600e353c5a7a4162107fd92abce97e429e1028f90b25d

SHA512
e82215b7fbb34804c37342ad7190e943b6a6707f3dbb1b43806359ea009c57179ca6eeb48b9ff10d950b71fd5d41301a222a2dc33937858416f084742d51051c

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
751KB

MD5
322b4c5e2b0268a1195514c87b9e84a2

SHA1
01e1dc0f84ef37f252d78ccfa8ccdfd3be9f18e8

SHA256
85cde23ec245cd40dcf05d1f06084a3f1bff4c57c05ebd627f4dfb7981634b8c

SHA512
1a7718f256478dac375db9024921d5e6db4870791712a4371c12617ea98081f836ae781ba3b33ec2a9f35b69f5ed74fc7b11a540908e82dacfc371c8cdd936d7

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
3f6b995b0bbaaec91a3015fc14a35602

SHA1
0668028b54a6cb0f0099406320acf710fe302ab4

SHA256
d2444a6b1552c52968080905eeda0b2069d43387ba7c6ddb415bc2a348ea9352

SHA512
cff909b26761ed7ca1ad0c057b9587a38554ea2514fb3578534c4c3b5b0f893061e3fb43bc47ecd03f3fb72054a9778d3c474d7df2c476a788c241438dff1ebe

Download Submit
\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
8b06ce89cb25e10b68680a6a9a0a9a28

SHA1
ec8d35cddc806fa3abefa822d82d1cf9e08aa8f2

SHA256
20eae4899b0156c7b922ba981a4dcddcf8233483058c38845b4b7bd29d91f36d

SHA512
519613513741f09795db681de4f312f9e4efb720ce05b64daeeec37c8b72545c5413becdc929873242379ae24913cc446135387e0ae6af5e93320734d50b2154

Download Submit
\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
8e6279b83610b51cbe73d4a470e2c9bd

SHA1
798fcfa9a2064aa9a432d005aa1dace2786eac59

SHA256
5e5725169d95569a2d3600e353c5a7a4162107fd92abce97e429e1028f90b25d

SHA512
e82215b7fbb34804c37342ad7190e943b6a6707f3dbb1b43806359ea009c57179ca6eeb48b9ff10d950b71fd5d41301a222a2dc33937858416f084742d51051c

Download Submit
\Users\Admin\oxnv3.ooccxx

Filesize
751KB

MD5
322b4c5e2b0268a1195514c87b9e84a2

SHA1
01e1dc0f84ef37f252d78ccfa8ccdfd3be9f18e8

SHA256
85cde23ec245cd40dcf05d1f06084a3f1bff4c57c05ebd627f4dfb7981634b8c

SHA512
1a7718f256478dac375db9024921d5e6db4870791712a4371c12617ea98081f836ae781ba3b33ec2a9f35b69f5ed74fc7b11a540908e82dacfc371c8cdd936d7

Download Submit
\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
3f6b995b0bbaaec91a3015fc14a35602

SHA1
0668028b54a6cb0f0099406320acf710fe302ab4

SHA256
d2444a6b1552c52968080905eeda0b2069d43387ba7c6ddb415bc2a348ea9352

SHA512
cff909b26761ed7ca1ad0c057b9587a38554ea2514fb3578534c4c3b5b0f893061e3fb43bc47ecd03f3fb72054a9778d3c474d7df2c476a788c241438dff1ebe

Download Submit
memory/3036-279-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/3540-121-0x00007FF851770000-0x00007FF851780000-memory.dmp

Filesize
64KB

Download
memory/3540-130-0x00007FF84DFE0000-0x00007FF84DFF0000-memory.dmp

Filesize
64KB

Download
memory/3540-118-0x00007FF851770000-0x00007FF851780000-memory.dmp

Filesize
64KB

Download
memory/3540-131-0x00007FF84DFE0000-0x00007FF84DFF0000-memory.dmp

Filesize
64KB

Download
memory/3540-120-0x00007FF851770000-0x00007FF851780000-memory.dmp

Filesize
64KB

Download
memory/3540-119-0x00007FF851770000-0x00007FF851780000-memory.dmp

Filesize
64KB

Download
memory/3540-362-0x00007FF851770000-0x00007FF851780000-memory.dmp

Filesize
64KB

Download
memory/3540-363-0x00007FF851770000-0x00007FF851780000-memory.dmp

Filesize
64KB

Download
memory/3540-364-0x00007FF851770000-0x00007FF851780000-memory.dmp

Filesize
64KB

Download
memory/3540-365-0x00007FF851770000-0x00007FF851780000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads