emotet | c62b4badfe22b89fe0e69e235d0e4008a2a1fdabcdc537b7c861b8d1599cedea

General

Target

c62b4badfe22b89fe0e69e235d0e4008a2a1fdabcdc537b7c861b8d1599cedea.xls
Size

217KB
MD5

97f3621e19cc49f16fd6b7e892cc9d72
SHA1

26b81fca1be8faa32fcf668e1f7479a256334318
SHA256

c62b4badfe22b89fe0e69e235d0e4008a2a1fdabcdc537b7c861b8d1599cedea
SHA512

06e4fe48166f9ad738419efe3d4a683cf3fe044f517337c7480cc849a03c46721b7b7b65a1a153dec27237c6c1211d3e3283d1c9589e3b4f9712678e23edd971
SSDEEP

6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dglyY+TAQXTHGUMEyP5p6f5jQmI:JbGUMVWlbI

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://aquariorecords.com.br/wp-content/A8G3ownNApEj1L4hF/

xlm40.dropper

http://ftp.pricoat.com.mx/Fichas/3ybJLLXu5zqqn8Sx/

xlm40.dropper

http://armannahalpersian.ir/3H5qqUOB/

xlm40.dropper

http://alagi.ge/application/irnz5Rs8qWvQrf/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4624	2508	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4292	2508	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4652	2508	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1232	2508	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 3 IoCs

pid	Process
4292	regsvr32.exe
4652	regsvr32.exe
1232	regsvr32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IEetqyu.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\GtPxiZLMZw\\IEetqyu.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mIflPTVxVI.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\DDYTlvejvCxw\\mIflPTVxVI.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Dwxrni.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\YVjbT\\Dwxrni.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2508	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4292	regsvr32.exe
4292	regsvr32.exe
4756	regsvr32.exe
4756	regsvr32.exe
4756	regsvr32.exe
4756	regsvr32.exe
4652	regsvr32.exe
4652	regsvr32.exe
404	regsvr32.exe
404	regsvr32.exe
404	regsvr32.exe
404	regsvr32.exe
1232	regsvr32.exe
1232	regsvr32.exe
1716	regsvr32.exe
1716	regsvr32.exe
1716	regsvr32.exe
1716	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2508	EXCEL.EXE
2508	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2508	EXCEL.EXE
2508	EXCEL.EXE
2508	EXCEL.EXE
2508	EXCEL.EXE
2508	EXCEL.EXE
2508	EXCEL.EXE
2508	EXCEL.EXE
2508	EXCEL.EXE
2508	EXCEL.EXE
2508	EXCEL.EXE
2508	EXCEL.EXE
2508	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 4624	2508	EXCEL.EXE	68
PID 2508 wrote to memory of 4624	2508	EXCEL.EXE	68
PID 2508 wrote to memory of 4292	2508	EXCEL.EXE	71
PID 2508 wrote to memory of 4292	2508	EXCEL.EXE	71
PID 4292 wrote to memory of 4756	4292	regsvr32.exe	74
PID 4292 wrote to memory of 4756	4292	regsvr32.exe	74
PID 2508 wrote to memory of 4652	2508	EXCEL.EXE	75
PID 2508 wrote to memory of 4652	2508	EXCEL.EXE	75
PID 4652 wrote to memory of 404	4652	regsvr32.exe	77
PID 4652 wrote to memory of 404	4652	regsvr32.exe	77
PID 2508 wrote to memory of 1232	2508	EXCEL.EXE	78
PID 2508 wrote to memory of 1232	2508	EXCEL.EXE	78
PID 1232 wrote to memory of 1716	1232	regsvr32.exe	79
PID 1232 wrote to memory of 1716	1232	regsvr32.exe	79

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c62b4badfe22b89fe0e69e235d0e4008a2a1fdabcdc537b7c861b8d1599cedea.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:4624
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YVjbT\Dwxrni.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4756
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GtPxiZLMZw\IEetqyu.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:404
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DDYTlvejvCxw\mIflPTVxVI.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
b92add0352f056b8c959722ffccb197a

SHA1
3a0346978cdf4443faea5c9a0ff1d65b971e893f

SHA256
f9d5b391259f05d6918288a4d4325c6f3ed9e93378ee9d101a0ff4744705cc26

SHA512
f88b76c9ee1243e2d8ee31275f7a22ba03f25f75cc0f02580aaa9232817950a4f97c2b658bc0025a80bef70014c8a17b7cba41ee81b95b518fbc372b0f6597c6

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
751KB

MD5
9a81048aade37b8adeeba168dbabf159

SHA1
ff7212b6ccc751a2a16194834d88ce13577b5b59

SHA256
56cf0a404550bd79b30a6b3d66c1e7c7f1ea05605cf73e005330be9dbd1085f4

SHA512
549b18a84b0f808ed1cd1704c4845a372154a0f4dc67eb47f2e99fb967eb68b6856af744fa22ca9974d60c0437d2053a2eb931f03cb04949c846dfe6db46b4e5

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
8483a1bdf7bc8a2ec8c35d4e7d5871b9

SHA1
524dc8fc8b72f91a3ddf528127b170bff9503f47

SHA256
46f74ea87f81217233cb565b8aaf1a971faf2762dd2eaf0da26dc0f1e3ac4ca8

SHA512
882ad2a4149415522d662eca246203ed4234e1914f92cc1e19c8e963ae1abf50253e52b75ddcd0fb224a687ac5c5cd7a820855191f0f8de321a67025c5d092bb

Download Submit
\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
b92add0352f056b8c959722ffccb197a

SHA1
3a0346978cdf4443faea5c9a0ff1d65b971e893f

SHA256
f9d5b391259f05d6918288a4d4325c6f3ed9e93378ee9d101a0ff4744705cc26

SHA512
f88b76c9ee1243e2d8ee31275f7a22ba03f25f75cc0f02580aaa9232817950a4f97c2b658bc0025a80bef70014c8a17b7cba41ee81b95b518fbc372b0f6597c6

Download Submit
\Users\Admin\oxnv3.ooccxx

Filesize
751KB

MD5
9a81048aade37b8adeeba168dbabf159

SHA1
ff7212b6ccc751a2a16194834d88ce13577b5b59

SHA256
56cf0a404550bd79b30a6b3d66c1e7c7f1ea05605cf73e005330be9dbd1085f4

SHA512
549b18a84b0f808ed1cd1704c4845a372154a0f4dc67eb47f2e99fb967eb68b6856af744fa22ca9974d60c0437d2053a2eb931f03cb04949c846dfe6db46b4e5

Download Submit
\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
8483a1bdf7bc8a2ec8c35d4e7d5871b9

SHA1
524dc8fc8b72f91a3ddf528127b170bff9503f47

SHA256
46f74ea87f81217233cb565b8aaf1a971faf2762dd2eaf0da26dc0f1e3ac4ca8

SHA512
882ad2a4149415522d662eca246203ed4234e1914f92cc1e19c8e963ae1abf50253e52b75ddcd0fb224a687ac5c5cd7a820855191f0f8de321a67025c5d092bb

Download Submit
memory/2508-128-0x00007FFC2E8D0000-0x00007FFC2E8E0000-memory.dmp

Filesize
64KB

Download
memory/2508-347-0x00007FFC31C40000-0x00007FFC31C50000-memory.dmp

Filesize
64KB

Download
memory/2508-346-0x00007FFC31C40000-0x00007FFC31C50000-memory.dmp

Filesize
64KB

Download
memory/2508-115-0x00007FFC31C40000-0x00007FFC31C50000-memory.dmp

Filesize
64KB

Download
memory/2508-345-0x00007FFC31C40000-0x00007FFC31C50000-memory.dmp

Filesize
64KB

Download
memory/2508-127-0x00007FFC2E8D0000-0x00007FFC2E8E0000-memory.dmp

Filesize
64KB

Download
memory/2508-118-0x00007FFC31C40000-0x00007FFC31C50000-memory.dmp

Filesize
64KB

Download
memory/2508-117-0x00007FFC31C40000-0x00007FFC31C50000-memory.dmp

Filesize
64KB

Download
memory/2508-116-0x00007FFC31C40000-0x00007FFC31C50000-memory.dmp

Filesize
64KB

Download
memory/2508-344-0x00007FFC31C40000-0x00007FFC31C50000-memory.dmp

Filesize
64KB

Download
memory/4292-274-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads