emotet | 1c5f2ca9839078742383b207721ce92fdfa70ac50e5d7b73c2488d47f7e5ebac

Analysis

max time kernel
151s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Report.xls
Size

255KB
MD5

893f9b10a48073fc3fa0d5c8867f7200
SHA1

875d63ddc7467890f8f72aa787298ca4b2051e3e
SHA256

1c5f2ca9839078742383b207721ce92fdfa70ac50e5d7b73c2488d47f7e5ebac
SHA512

8c65c4f8c89d5b6e973f2108cb4267cf3f6703609d84be6d4fda7b92770d462344c957e6fbc7a00e24076bbe2dc51bfe68ed80e5685ff985a01772edca5de632
SSDEEP

6144:6Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dgVNiwrfx9rNFMMrttRzV5Dz3UxqC8LUcST:5NbDjP9XH5XIqZLnST

Score

10^/10

emotet epoch4 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://cs.com.sg/Backup/Bk778kXNKMiH5vH/

xlm40.dropper

https://j2ccamionmagasin.fr/css/1Mp8y/

xlm40.dropper

http://atici.net/old/PkZI74DD/

xlm40.dropper

http://clanbaker.org/css/khhl7kT2n69n/

Extracted

Family

emotet

Botnet

Epoch4

45.235.8.30:8080

94.23.45.86:4143

119.59.103.152:8080

169.60.181.70:8080

164.68.99.3:8080

172.105.226.75:8080

107.170.39.149:8080

206.189.28.199:8080

1.234.2.232:8080

188.44.20.25:443

186.194.240.217:443

103.43.75.120:443

149.28.143.92:443

159.89.202.34:443

209.97.163.214:443

183.111.227.137:8080

129.232.188.93:443

139.59.126.41:443

110.232.117.186:8080

139.59.56.73:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3824	5040	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	220	5040	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5116	5040	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	984	5040	regsvr32.exe	80

Downloads MZ/PE file

Loads dropped DLL 6 IoCs

pid	Process
220	regsvr32.exe
3940	regsvr32.exe
5116	regsvr32.exe
2584	regsvr32.exe
984	regsvr32.exe
4852	regsvr32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\btpmUqimelpkklzs.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\PMDbDtjgeZf\\btpmUqimelpkklzs.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dVxOYofftJPDnSuO.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\QnbyZAqiF\\dVxOYofftJPDnSuO.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zLxEG.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\DUzZgHuYW\\zLxEG.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5040	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
220	regsvr32.exe
220	regsvr32.exe
3940	regsvr32.exe
3940	regsvr32.exe
5116	regsvr32.exe
5116	regsvr32.exe
3940	regsvr32.exe
3940	regsvr32.exe
2584	regsvr32.exe
2584	regsvr32.exe
2584	regsvr32.exe
2584	regsvr32.exe
984	regsvr32.exe
984	regsvr32.exe
4852	regsvr32.exe
4852	regsvr32.exe
4852	regsvr32.exe
4852	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5040	EXCEL.EXE
5040	EXCEL.EXE
5040	EXCEL.EXE
5040	EXCEL.EXE
5040	EXCEL.EXE
5040	EXCEL.EXE
5040	EXCEL.EXE
5040	EXCEL.EXE
5040	EXCEL.EXE
5040	EXCEL.EXE
5040	EXCEL.EXE
5040	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3824	5040	EXCEL.EXE	82
PID 5040 wrote to memory of 3824	5040	EXCEL.EXE	82
PID 5040 wrote to memory of 220	5040	EXCEL.EXE	83
PID 5040 wrote to memory of 220	5040	EXCEL.EXE	83
PID 220 wrote to memory of 3940	220	regsvr32.exe	84
PID 220 wrote to memory of 3940	220	regsvr32.exe	84
PID 5040 wrote to memory of 5116	5040	EXCEL.EXE	85
PID 5040 wrote to memory of 5116	5040	EXCEL.EXE	85
PID 5116 wrote to memory of 2584	5116	regsvr32.exe	88
PID 5116 wrote to memory of 2584	5116	regsvr32.exe	88
PID 5040 wrote to memory of 984	5040	EXCEL.EXE	90
PID 5040 wrote to memory of 984	5040	EXCEL.EXE	90
PID 984 wrote to memory of 4852	984	regsvr32.exe	91
PID 984 wrote to memory of 4852	984	regsvr32.exe	91

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Report.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:3824
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PMDbDtjgeZf\btpmUqimelpkklzs.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3940
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QnbyZAqiF\dVxOYofftJPDnSuO.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2584
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DUzZgHuYW\zLxEG.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv2.ooccxx

Filesize
610KB

MD5
114402567631f6704ec6d2091e265cf7

SHA1
0e3d646bbb6bed408afa09387c324d4be5e138f6

SHA256
3ed43626f3553f220d17f48a3a29bbcd97d2a6f06c3c97ebc86ff0b008b975a3

SHA512
f50790732d0fdd74d0d6e330f45e2fcd4a9ecf5b3d48d279bc7d91ed62bad8912632ffa9914dc06ca46171d84e1c2b76d0a3d989fa500711ae0215dfd3f9fc4c

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
610KB

MD5
114402567631f6704ec6d2091e265cf7

SHA1
0e3d646bbb6bed408afa09387c324d4be5e138f6

SHA256
3ed43626f3553f220d17f48a3a29bbcd97d2a6f06c3c97ebc86ff0b008b975a3

SHA512
f50790732d0fdd74d0d6e330f45e2fcd4a9ecf5b3d48d279bc7d91ed62bad8912632ffa9914dc06ca46171d84e1c2b76d0a3d989fa500711ae0215dfd3f9fc4c

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
610KB

MD5
058f5784a3439c0d62baeee801cacb99

SHA1
eb9f2e0e694904101869e30cda66c3b068aa240c

SHA256
a0e87ee1bc77db29f58b8291312c8c295c6b9816569664f4bb0b0b30084147b9

SHA512
ea6758a3f943e784de39ca56cf055d74987fd6fa4660a8f5649943756a6378ffdc21ae77c00b80a421eedf575a46b9e9e342b2b677af86264883ae7957e1e9df

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
610KB

MD5
058f5784a3439c0d62baeee801cacb99

SHA1
eb9f2e0e694904101869e30cda66c3b068aa240c

SHA256
a0e87ee1bc77db29f58b8291312c8c295c6b9816569664f4bb0b0b30084147b9

SHA512
ea6758a3f943e784de39ca56cf055d74987fd6fa4660a8f5649943756a6378ffdc21ae77c00b80a421eedf575a46b9e9e342b2b677af86264883ae7957e1e9df

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
610KB

MD5
22f9bc4178ddaca484da3ad0a7e3de01

SHA1
56b5c30485fb1c1068a4ea7407007a28ab256807

SHA256
a997988a00535c1b1f7cad121885a051d565287741e04aefabcd6fe1db5020ba

SHA512
e4fd235495ab5b2b49d183092dadc0847e7e5c78e799c7e87e36437b718d90bd830ad55a583f8dc50a599dc33f8be33299a47627db98f6525487e9c9bd8aaf27

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
610KB

MD5
22f9bc4178ddaca484da3ad0a7e3de01

SHA1
56b5c30485fb1c1068a4ea7407007a28ab256807

SHA256
a997988a00535c1b1f7cad121885a051d565287741e04aefabcd6fe1db5020ba

SHA512
e4fd235495ab5b2b49d183092dadc0847e7e5c78e799c7e87e36437b718d90bd830ad55a583f8dc50a599dc33f8be33299a47627db98f6525487e9c9bd8aaf27

Download Submit
C:\Windows\System32\DUzZgHuYW\zLxEG.dll

Filesize
610KB

MD5
22f9bc4178ddaca484da3ad0a7e3de01

SHA1
56b5c30485fb1c1068a4ea7407007a28ab256807

SHA256
a997988a00535c1b1f7cad121885a051d565287741e04aefabcd6fe1db5020ba

SHA512
e4fd235495ab5b2b49d183092dadc0847e7e5c78e799c7e87e36437b718d90bd830ad55a583f8dc50a599dc33f8be33299a47627db98f6525487e9c9bd8aaf27

Download Submit
C:\Windows\System32\PMDbDtjgeZf\btpmUqimelpkklzs.dll

Filesize
610KB

MD5
114402567631f6704ec6d2091e265cf7

SHA1
0e3d646bbb6bed408afa09387c324d4be5e138f6

SHA256
3ed43626f3553f220d17f48a3a29bbcd97d2a6f06c3c97ebc86ff0b008b975a3

SHA512
f50790732d0fdd74d0d6e330f45e2fcd4a9ecf5b3d48d279bc7d91ed62bad8912632ffa9914dc06ca46171d84e1c2b76d0a3d989fa500711ae0215dfd3f9fc4c

Download Submit
C:\Windows\System32\QnbyZAqiF\dVxOYofftJPDnSuO.dll

Filesize
610KB

MD5
058f5784a3439c0d62baeee801cacb99

SHA1
eb9f2e0e694904101869e30cda66c3b068aa240c

SHA256
a0e87ee1bc77db29f58b8291312c8c295c6b9816569664f4bb0b0b30084147b9

SHA512
ea6758a3f943e784de39ca56cf055d74987fd6fa4660a8f5649943756a6378ffdc21ae77c00b80a421eedf575a46b9e9e342b2b677af86264883ae7957e1e9df

Download Submit
memory/220-143-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download
memory/5040-132-0x00007FFF1A650000-0x00007FFF1A660000-memory.dmp

Filesize
64KB

Download
memory/5040-138-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download
memory/5040-137-0x00007FFF17CF0000-0x00007FFF17D00000-memory.dmp

Filesize
64KB

Download
memory/5040-136-0x00007FFF1A650000-0x00007FFF1A660000-memory.dmp

Filesize
64KB

Download
memory/5040-135-0x00007FFF1A650000-0x00007FFF1A660000-memory.dmp

Filesize
64KB

Download
memory/5040-133-0x00007FFF1A650000-0x00007FFF1A660000-memory.dmp

Filesize
64KB

Download
memory/5040-134-0x00007FFF1A650000-0x00007FFF1A660000-memory.dmp

Filesize
64KB

Download