emotet | a2c765d555ce8eff36aefe6704e08548d21ca38111cfefc8d3c73b57c68dc7f5

Analysis

max time kernel
147s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2022 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00216_76.xls
Size

217KB
MD5

c50064ce002fd4d8bd318ac3718ce2e0
SHA1

46c8aaaaeed6a16310dbba8bd0cff9e089b6429d
SHA256

a2c765d555ce8eff36aefe6704e08548d21ca38111cfefc8d3c73b57c68dc7f5
SHA512

c5b9627fe8f0d3bd576181c2ff9f2ce3549948b4e53e053e5b5d5f69bc5ea67187be6bad670760fc863f70dfdf673a34b8f222a351c64323bba6bede03423239
SSDEEP

6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgXyY+TAQXTHGUMEyP5p6f5jQmm:DbGUMVWlbm

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://barkstage.es/wp-content/0E7NdYl7TZuHMJq7/

xlm40.dropper

http://contactworks.nl/images_old/NuEAhfF0PCFhvv/

xlm40.dropper

http://www.iam.ch/wp-content/cache/minify/O1OAjWnfen/

xlm40.dropper

https://www.elaboro.pl/wp-admin/J0hwyIMsk9YFIi/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	432	4252	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3468	4252	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4312	4252	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3664	4252	regsvr32.exe	80

Downloads MZ/PE file

Loads dropped DLL 6 IoCs

pid	Process
432	regsvr32.exe
2036	regsvr32.exe
3468	regsvr32.exe
928	regsvr32.exe
3664	regsvr32.exe
4688	regsvr32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BUCMAiBXvofVRI.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\BABGXXyKfFNTKQPU\\BUCMAiBXvofVRI.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vKCOdXAJmkMs.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\XeuNzHegZjfK\\vKCOdXAJmkMs.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fgyQYIYVnXPfZiB.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\UUyKkAUgCkJjUkjt\\fgyQYIYVnXPfZiB.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4252	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
432	regsvr32.exe
432	regsvr32.exe
2036	regsvr32.exe
2036	regsvr32.exe
3468	regsvr32.exe
3468	regsvr32.exe
2036	regsvr32.exe
2036	regsvr32.exe
928	regsvr32.exe
928	regsvr32.exe
928	regsvr32.exe
928	regsvr32.exe
3664	regsvr32.exe
3664	regsvr32.exe
4688	regsvr32.exe
4688	regsvr32.exe
4688	regsvr32.exe
4688	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4252	EXCEL.EXE
4252	EXCEL.EXE
4252	EXCEL.EXE
4252	EXCEL.EXE
4252	EXCEL.EXE
4252	EXCEL.EXE
4252	EXCEL.EXE
4252	EXCEL.EXE
4252	EXCEL.EXE
4252	EXCEL.EXE
4252	EXCEL.EXE
4252	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 432	4252	EXCEL.EXE	85
PID 4252 wrote to memory of 432	4252	EXCEL.EXE	85
PID 432 wrote to memory of 2036	432	regsvr32.exe	87
PID 432 wrote to memory of 2036	432	regsvr32.exe	87
PID 4252 wrote to memory of 3468	4252	EXCEL.EXE	88
PID 4252 wrote to memory of 3468	4252	EXCEL.EXE	88
PID 3468 wrote to memory of 928	3468	regsvr32.exe	89
PID 3468 wrote to memory of 928	3468	regsvr32.exe	89
PID 4252 wrote to memory of 4312	4252	EXCEL.EXE	92
PID 4252 wrote to memory of 4312	4252	EXCEL.EXE	92
PID 4252 wrote to memory of 3664	4252	EXCEL.EXE	93
PID 4252 wrote to memory of 3664	4252	EXCEL.EXE	93
PID 3664 wrote to memory of 4688	3664	regsvr32.exe	94
PID 3664 wrote to memory of 4688	3664	regsvr32.exe	94

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\00216_76.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XeuNzHegZjfK\vKCOdXAJmkMs.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2036
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UUyKkAUgCkJjUkjt\fgyQYIYVnXPfZiB.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:928
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:4312
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BABGXXyKfFNTKQPU\BUCMAiBXvofVRI.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
65aa46819f96d9470a7d251a2914cb4f

SHA1
01c8a0716ee72ce0bfba337fddcb3c3b5cd873f8

SHA256
26f05c787bd428fdcd2187f3335f03fd2f7e2ded912854cd668d93c1ade58403

SHA512
3de8d3797dc6ed246aa03b9699928810f101c41bb9e66aff8d251984db830c26229d8c795d33993e56bbbb2ebf1a81bb897707890ae45673b30e6ab4f81c4186

Download Submit
C:\Users\Admin\oxnv1.ooccxx

Filesize
751KB

MD5
65aa46819f96d9470a7d251a2914cb4f

SHA1
01c8a0716ee72ce0bfba337fddcb3c3b5cd873f8

SHA256
26f05c787bd428fdcd2187f3335f03fd2f7e2ded912854cd668d93c1ade58403

SHA512
3de8d3797dc6ed246aa03b9699928810f101c41bb9e66aff8d251984db830c26229d8c795d33993e56bbbb2ebf1a81bb897707890ae45673b30e6ab4f81c4186

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
b74f54ec21b7eee3eefd68b0a162cf2f

SHA1
65bebd45e990fee64e96586895cfa10d926695c3

SHA256
7d690682eaaa9471e7bd5123ee2501442eac327e5812705d890911a22be22322

SHA512
9a7671f54a0c0e33ea1ca3156411d62f81a39e83c2c55093c967cedd0fe63966eb1cabb71fbf75ca891d5dab93d187d5c45b11e57e366f9dec71a0a839576fee

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
751KB

MD5
b74f54ec21b7eee3eefd68b0a162cf2f

SHA1
65bebd45e990fee64e96586895cfa10d926695c3

SHA256
7d690682eaaa9471e7bd5123ee2501442eac327e5812705d890911a22be22322

SHA512
9a7671f54a0c0e33ea1ca3156411d62f81a39e83c2c55093c967cedd0fe63966eb1cabb71fbf75ca891d5dab93d187d5c45b11e57e366f9dec71a0a839576fee

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
c4f32c7b21d0a1abec9cde0b9b32976a

SHA1
84ff5f720a9b6f578c9e9c4a79826ebdbfffd20e

SHA256
083292403c9960fda3552ab691effc4c73856750e1fd3e13039dfbfa99406cd2

SHA512
657183976e3163d44d0bb8b2349a55c4de11b533a46174f4de966895bccc1ad470cd66789681ed4d4dadf3eb6c360bb32cf636c2a5de9c7fc9973954b22683c9

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
751KB

MD5
c4f32c7b21d0a1abec9cde0b9b32976a

SHA1
84ff5f720a9b6f578c9e9c4a79826ebdbfffd20e

SHA256
083292403c9960fda3552ab691effc4c73856750e1fd3e13039dfbfa99406cd2

SHA512
657183976e3163d44d0bb8b2349a55c4de11b533a46174f4de966895bccc1ad470cd66789681ed4d4dadf3eb6c360bb32cf636c2a5de9c7fc9973954b22683c9

Download Submit
C:\Windows\System32\BABGXXyKfFNTKQPU\BUCMAiBXvofVRI.dll

Filesize
751KB

MD5
c4f32c7b21d0a1abec9cde0b9b32976a

SHA1
84ff5f720a9b6f578c9e9c4a79826ebdbfffd20e

SHA256
083292403c9960fda3552ab691effc4c73856750e1fd3e13039dfbfa99406cd2

SHA512
657183976e3163d44d0bb8b2349a55c4de11b533a46174f4de966895bccc1ad470cd66789681ed4d4dadf3eb6c360bb32cf636c2a5de9c7fc9973954b22683c9

Download Submit
C:\Windows\System32\UUyKkAUgCkJjUkjt\fgyQYIYVnXPfZiB.dll

Filesize
751KB

MD5
b74f54ec21b7eee3eefd68b0a162cf2f

SHA1
65bebd45e990fee64e96586895cfa10d926695c3

SHA256
7d690682eaaa9471e7bd5123ee2501442eac327e5812705d890911a22be22322

SHA512
9a7671f54a0c0e33ea1ca3156411d62f81a39e83c2c55093c967cedd0fe63966eb1cabb71fbf75ca891d5dab93d187d5c45b11e57e366f9dec71a0a839576fee

Download Submit
C:\Windows\System32\XeuNzHegZjfK\vKCOdXAJmkMs.dll

Filesize
751KB

MD5
65aa46819f96d9470a7d251a2914cb4f

SHA1
01c8a0716ee72ce0bfba337fddcb3c3b5cd873f8

SHA256
26f05c787bd428fdcd2187f3335f03fd2f7e2ded912854cd668d93c1ade58403

SHA512
3de8d3797dc6ed246aa03b9699928810f101c41bb9e66aff8d251984db830c26229d8c795d33993e56bbbb2ebf1a81bb897707890ae45673b30e6ab4f81c4186

Download Submit
memory/432-142-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download
memory/4252-138-0x00007FF8D50A0000-0x00007FF8D50B0000-memory.dmp

Filesize
64KB

Download
memory/4252-132-0x00007FF8D78D0000-0x00007FF8D78E0000-memory.dmp

Filesize
64KB

Download
memory/4252-137-0x00007FF8D50A0000-0x00007FF8D50B0000-memory.dmp

Filesize
64KB

Download
memory/4252-136-0x00007FF8D78D0000-0x00007FF8D78E0000-memory.dmp

Filesize
64KB

Download
memory/4252-135-0x00007FF8D78D0000-0x00007FF8D78E0000-memory.dmp

Filesize
64KB

Download
memory/4252-134-0x00007FF8D78D0000-0x00007FF8D78E0000-memory.dmp

Filesize
64KB

Download
memory/4252-133-0x00007FF8D78D0000-0x00007FF8D78E0000-memory.dmp

Filesize
64KB

Download