emotet | 2674b080efea45abb2e50c88e23e439b2580587e3128ad681df2934ebb1ba16e

Analysis

max time kernel
148s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2022, 04:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9603JLYA 04112022.xls
Size

217KB
MD5

d07487faaa8170ce9a9b16cd5b12e86a
SHA1

2efb55698a3d4818fb9a7db02a0fde1f5ae8b8db
SHA256

2674b080efea45abb2e50c88e23e439b2580587e3128ad681df2934ebb1ba16e
SHA512

64220d4e609ca919f4ffa5fe8b3072e3ce0a06bee5b46795e4ca05bd9c0cb2687146f4ef4aecc84f3d82373ec19c029448feaf61bcc0c08894d9c21f9d3c5713
SSDEEP

6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgXyY+TAQXTHGUMEyP5p6f5jQm6:DbGUMVWlb6

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://barkstage.es/wp-content/0E7NdYl7TZuHMJq7/

xlm40.dropper

http://contactworks.nl/images_old/NuEAhfF0PCFhvv/

xlm40.dropper

http://www.iam.ch/wp-content/cache/minify/O1OAjWnfen/

xlm40.dropper

https://www.elaboro.pl/wp-admin/J0hwyIMsk9YFIi/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4276	4836	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1248	4836	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3372	4836	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4680	4836	regsvr32.exe	80

Downloads MZ/PE file

Loads dropped DLL 6 IoCs

pid	Process
4276	regsvr32.exe
2732	regsvr32.exe
1248	regsvr32.exe
4448	regsvr32.exe
4680	regsvr32.exe
1452	regsvr32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mXfIQJKNFi.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\CidmaycczPZfGh\\mXfIQJKNFi.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dgUJotoGVU.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\EVFey\\dgUJotoGVU.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JiMb.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\MKYbtEhlK\\JiMb.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4836	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4276	regsvr32.exe
4276	regsvr32.exe
2732	regsvr32.exe
2732	regsvr32.exe
1248	regsvr32.exe
1248	regsvr32.exe
2732	regsvr32.exe
2732	regsvr32.exe
4448	regsvr32.exe
4448	regsvr32.exe
4448	regsvr32.exe
4448	regsvr32.exe
4680	regsvr32.exe
4680	regsvr32.exe
1452	regsvr32.exe
1452	regsvr32.exe
1452	regsvr32.exe
1452	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 4276	4836	EXCEL.EXE	85
PID 4836 wrote to memory of 4276	4836	EXCEL.EXE	85
PID 4276 wrote to memory of 2732	4276	regsvr32.exe	86
PID 4276 wrote to memory of 2732	4276	regsvr32.exe	86
PID 4836 wrote to memory of 1248	4836	EXCEL.EXE	88
PID 4836 wrote to memory of 1248	4836	EXCEL.EXE	88
PID 1248 wrote to memory of 4448	1248	regsvr32.exe	89
PID 1248 wrote to memory of 4448	1248	regsvr32.exe	89
PID 4836 wrote to memory of 3372	4836	EXCEL.EXE	92
PID 4836 wrote to memory of 3372	4836	EXCEL.EXE	92
PID 4836 wrote to memory of 4680	4836	EXCEL.EXE	93
PID 4836 wrote to memory of 4680	4836	EXCEL.EXE	93
PID 4680 wrote to memory of 1452	4680	regsvr32.exe	94
PID 4680 wrote to memory of 1452	4680	regsvr32.exe	94

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9603JLYA 04112022.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MKYbtEhlK\JiMb.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2732
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EVFey\dgUJotoGVU.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4448
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:3372
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CidmaycczPZfGh\mXfIQJKNFi.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
b14cbd294e12ffa0472b3d0b71ace24c

SHA1
5873c757c1dfa1f7cf2829d11a18d452f21cbe5c

SHA256
31bc00d7708a07553c9c079888d7ebb3442463f758cce7870dc130a3c8a37dc2

SHA512
520933f9c23822defb0ad13d09dddd63a7ae036b772e1a93dfe60384fc46a4925a4155f7d5279441edbc77de222e0c91bbe0217512ab626fb0b13806f586870c

Download Submit
C:\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
b14cbd294e12ffa0472b3d0b71ace24c

SHA1
5873c757c1dfa1f7cf2829d11a18d452f21cbe5c

SHA256
31bc00d7708a07553c9c079888d7ebb3442463f758cce7870dc130a3c8a37dc2

SHA512
520933f9c23822defb0ad13d09dddd63a7ae036b772e1a93dfe60384fc46a4925a4155f7d5279441edbc77de222e0c91bbe0217512ab626fb0b13806f586870c

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
b09a376ce4c884071536745e404fe7f4

SHA1
6bd335d147b196d44e8d7f228ec55c647e792a1c

SHA256
f173e87152e13e5c458d57b21beb6b7589367c8322b8b421888606383fb988aa

SHA512
234a55777a961df9329ba63a046c7f56baa2158ca8287c6c852722ca6e5cc20c8be7d1fe898f2e94e85a7318b8066d2cbd44088d05b839f7dd9ee9a37074abc2

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
b09a376ce4c884071536745e404fe7f4

SHA1
6bd335d147b196d44e8d7f228ec55c647e792a1c

SHA256
f173e87152e13e5c458d57b21beb6b7589367c8322b8b421888606383fb988aa

SHA512
234a55777a961df9329ba63a046c7f56baa2158ca8287c6c852722ca6e5cc20c8be7d1fe898f2e94e85a7318b8066d2cbd44088d05b839f7dd9ee9a37074abc2

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
d38bfb2673ced27ea9b98e78f6497f88

SHA1
d81c0c1f54094a766baae03d673e3ce41c202df8

SHA256
5093d3b8d32fb01e0fc1a2a155a254754e3973fbc89067424bb4096385228275

SHA512
4dd02f0cdfd8b43271ba40b0e5bd76c7aaefc25cf0379a8ab4f635e62818654413e3ba737b0bfdaa8fe59dec74e12f19179677bb585f04fb56297f86c99f7bef

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
d38bfb2673ced27ea9b98e78f6497f88

SHA1
d81c0c1f54094a766baae03d673e3ce41c202df8

SHA256
5093d3b8d32fb01e0fc1a2a155a254754e3973fbc89067424bb4096385228275

SHA512
4dd02f0cdfd8b43271ba40b0e5bd76c7aaefc25cf0379a8ab4f635e62818654413e3ba737b0bfdaa8fe59dec74e12f19179677bb585f04fb56297f86c99f7bef

Download Submit
C:\Windows\System32\CidmaycczPZfGh\mXfIQJKNFi.dll

Filesize
751KB

MD5
d38bfb2673ced27ea9b98e78f6497f88

SHA1
d81c0c1f54094a766baae03d673e3ce41c202df8

SHA256
5093d3b8d32fb01e0fc1a2a155a254754e3973fbc89067424bb4096385228275

SHA512
4dd02f0cdfd8b43271ba40b0e5bd76c7aaefc25cf0379a8ab4f635e62818654413e3ba737b0bfdaa8fe59dec74e12f19179677bb585f04fb56297f86c99f7bef

Download Submit
C:\Windows\System32\EVFey\dgUJotoGVU.dll

Filesize
751KB

MD5
b09a376ce4c884071536745e404fe7f4

SHA1
6bd335d147b196d44e8d7f228ec55c647e792a1c

SHA256
f173e87152e13e5c458d57b21beb6b7589367c8322b8b421888606383fb988aa

SHA512
234a55777a961df9329ba63a046c7f56baa2158ca8287c6c852722ca6e5cc20c8be7d1fe898f2e94e85a7318b8066d2cbd44088d05b839f7dd9ee9a37074abc2

Download Submit
C:\Windows\System32\MKYbtEhlK\JiMb.dll

Filesize
751KB

MD5
b14cbd294e12ffa0472b3d0b71ace24c

SHA1
5873c757c1dfa1f7cf2829d11a18d452f21cbe5c

SHA256
31bc00d7708a07553c9c079888d7ebb3442463f758cce7870dc130a3c8a37dc2

SHA512
520933f9c23822defb0ad13d09dddd63a7ae036b772e1a93dfe60384fc46a4925a4155f7d5279441edbc77de222e0c91bbe0217512ab626fb0b13806f586870c

Download Submit
memory/4276-145-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/4836-141-0x00007FFCCB810000-0x00007FFCCB820000-memory.dmp

Filesize
64KB

Download
memory/4836-140-0x00007FFCCB810000-0x00007FFCCB820000-memory.dmp

Filesize
64KB

Download
memory/4836-135-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

Filesize
64KB

Download
memory/4836-139-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

Filesize
64KB

Download
memory/4836-138-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

Filesize
64KB

Download
memory/4836-137-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

Filesize
64KB

Download
memory/4836-136-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

Filesize
64KB

Download