emotet | e64c48cd8fc971d54d502f37f199df9a01dac4cc5acf16fcf0e9259f562a1fb7

General

Target

e64c48cd8fc971d54d502f37f199df9a01dac4cc5acf16fcf0e9259f562a1fb7.xls
Size

217KB
MD5

da9aaaacea797554e33c5a5d5d45febb
SHA1

13416d8e0f67df354884280b83e425cb2d9e72bd
SHA256

e64c48cd8fc971d54d502f37f199df9a01dac4cc5acf16fcf0e9259f562a1fb7
SHA512

84fb8f13cb085b6d9699e908473cf9c266b841ab700d0a635605c55cc180b2644dd62e25cfa5ef3f10a0c55901be1690e8d5f253c44dd3dad1420284f06c1237
SSDEEP

6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dglyY+TAQXTHGUMEyP5p6f5jQms:JbGUMVWlbs

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://aquariorecords.com.br/wp-content/A8G3ownNApEj1L4hF/

xlm40.dropper

http://ftp.pricoat.com.mx/Fichas/3ybJLLXu5zqqn8Sx/

xlm40.dropper

http://armannahalpersian.ir/3H5qqUOB/

xlm40.dropper

http://alagi.ge/application/irnz5Rs8qWvQrf/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2224	2432	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4924	2432	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4324	2432	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	360	2432	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 3 IoCs

pid	Process
4924	regsvr32.exe
4324	regsvr32.exe
360	regsvr32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dqfoqljNtzGC.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\MIEAhYu\\dqfoqljNtzGC.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsGNvD.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\BJhQs\\MsGNvD.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hcTHZtezkVsJVCka.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\Txxwtxf\\hcTHZtezkVsJVCka.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2432	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4924	regsvr32.exe
4924	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
4324	regsvr32.exe
4324	regsvr32.exe
3288	regsvr32.exe
3288	regsvr32.exe
3288	regsvr32.exe
3288	regsvr32.exe
360	regsvr32.exe
360	regsvr32.exe
648	regsvr32.exe
648	regsvr32.exe
648	regsvr32.exe
648	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2432	EXCEL.EXE
2432	EXCEL.EXE
2432	EXCEL.EXE
2432	EXCEL.EXE
2432	EXCEL.EXE
2432	EXCEL.EXE
2432	EXCEL.EXE
2432	EXCEL.EXE
2432	EXCEL.EXE
2432	EXCEL.EXE
2432	EXCEL.EXE
2432	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2224	2432	EXCEL.EXE	68
PID 2432 wrote to memory of 2224	2432	EXCEL.EXE	68
PID 2432 wrote to memory of 4924	2432	EXCEL.EXE	73
PID 2432 wrote to memory of 4924	2432	EXCEL.EXE	73
PID 4924 wrote to memory of 2232	4924	regsvr32.exe	74
PID 4924 wrote to memory of 2232	4924	regsvr32.exe	74
PID 2432 wrote to memory of 4324	2432	EXCEL.EXE	75
PID 2432 wrote to memory of 4324	2432	EXCEL.EXE	75
PID 4324 wrote to memory of 3288	4324	regsvr32.exe	77
PID 4324 wrote to memory of 3288	4324	regsvr32.exe	77
PID 2432 wrote to memory of 360	2432	EXCEL.EXE	78
PID 2432 wrote to memory of 360	2432	EXCEL.EXE	78
PID 360 wrote to memory of 648	360	regsvr32.exe	79
PID 360 wrote to memory of 648	360	regsvr32.exe	79

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e64c48cd8fc971d54d502f37f199df9a01dac4cc5acf16fcf0e9259f562a1fb7.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:2224
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Txxwtxf\hcTHZtezkVsJVCka.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2232
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MIEAhYu\dqfoqljNtzGC.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3288
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:360
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BJhQs\MsGNvD.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
b92add0352f056b8c959722ffccb197a

SHA1
3a0346978cdf4443faea5c9a0ff1d65b971e893f

SHA256
f9d5b391259f05d6918288a4d4325c6f3ed9e93378ee9d101a0ff4744705cc26

SHA512
f88b76c9ee1243e2d8ee31275f7a22ba03f25f75cc0f02580aaa9232817950a4f97c2b658bc0025a80bef70014c8a17b7cba41ee81b95b518fbc372b0f6597c6

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
751KB

MD5
9a81048aade37b8adeeba168dbabf159

SHA1
ff7212b6ccc751a2a16194834d88ce13577b5b59

SHA256
56cf0a404550bd79b30a6b3d66c1e7c7f1ea05605cf73e005330be9dbd1085f4

SHA512
549b18a84b0f808ed1cd1704c4845a372154a0f4dc67eb47f2e99fb967eb68b6856af744fa22ca9974d60c0437d2053a2eb931f03cb04949c846dfe6db46b4e5

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
8483a1bdf7bc8a2ec8c35d4e7d5871b9

SHA1
524dc8fc8b72f91a3ddf528127b170bff9503f47

SHA256
46f74ea87f81217233cb565b8aaf1a971faf2762dd2eaf0da26dc0f1e3ac4ca8

SHA512
882ad2a4149415522d662eca246203ed4234e1914f92cc1e19c8e963ae1abf50253e52b75ddcd0fb224a687ac5c5cd7a820855191f0f8de321a67025c5d092bb

Download Submit
\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
b92add0352f056b8c959722ffccb197a

SHA1
3a0346978cdf4443faea5c9a0ff1d65b971e893f

SHA256
f9d5b391259f05d6918288a4d4325c6f3ed9e93378ee9d101a0ff4744705cc26

SHA512
f88b76c9ee1243e2d8ee31275f7a22ba03f25f75cc0f02580aaa9232817950a4f97c2b658bc0025a80bef70014c8a17b7cba41ee81b95b518fbc372b0f6597c6

Download Submit
\Users\Admin\oxnv3.ooccxx

Filesize
751KB

MD5
9a81048aade37b8adeeba168dbabf159

SHA1
ff7212b6ccc751a2a16194834d88ce13577b5b59

SHA256
56cf0a404550bd79b30a6b3d66c1e7c7f1ea05605cf73e005330be9dbd1085f4

SHA512
549b18a84b0f808ed1cd1704c4845a372154a0f4dc67eb47f2e99fb967eb68b6856af744fa22ca9974d60c0437d2053a2eb931f03cb04949c846dfe6db46b4e5

Download Submit
\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
8483a1bdf7bc8a2ec8c35d4e7d5871b9

SHA1
524dc8fc8b72f91a3ddf528127b170bff9503f47

SHA256
46f74ea87f81217233cb565b8aaf1a971faf2762dd2eaf0da26dc0f1e3ac4ca8

SHA512
882ad2a4149415522d662eca246203ed4234e1914f92cc1e19c8e963ae1abf50253e52b75ddcd0fb224a687ac5c5cd7a820855191f0f8de321a67025c5d092bb

Download Submit
memory/2432-345-0x00007FF83D030000-0x00007FF83D040000-memory.dmp

Filesize
64KB

Download
memory/2432-348-0x00007FF83D030000-0x00007FF83D040000-memory.dmp

Filesize
64KB

Download
memory/2432-347-0x00007FF83D030000-0x00007FF83D040000-memory.dmp

Filesize
64KB

Download
memory/2432-115-0x00007FF83D030000-0x00007FF83D040000-memory.dmp

Filesize
64KB

Download
memory/2432-128-0x00007FF83A290000-0x00007FF83A2A0000-memory.dmp

Filesize
64KB

Download
memory/2432-346-0x00007FF83D030000-0x00007FF83D040000-memory.dmp

Filesize
64KB

Download
memory/2432-127-0x00007FF83A290000-0x00007FF83A2A0000-memory.dmp

Filesize
64KB

Download
memory/2432-118-0x00007FF83D030000-0x00007FF83D040000-memory.dmp

Filesize
64KB

Download
memory/2432-117-0x00007FF83D030000-0x00007FF83D040000-memory.dmp

Filesize
64KB

Download
memory/2432-116-0x00007FF83D030000-0x00007FF83D040000-memory.dmp

Filesize
64KB

Download
memory/4924-281-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads