emotet | cde22596b9fea502adfa8890f763f2a01b08cb1d4cb205d392f1ebcc486da04a

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27950.xls
Size

221KB
MD5

bab93d6ad3bb2f48f9a94a351ed286e5
SHA1

dc0990bf9de4f4fe61ae705a16fa5240d825b0ae
SHA256

cde22596b9fea502adfa8890f763f2a01b08cb1d4cb205d392f1ebcc486da04a
SHA512

067a58f327c10e2186920ab301d8c675a32ea040771122064abd4ea7605b1ce321126a2c81ac10ef7a6036fb7923c3a4921f4f159f72064505b62d49bae08fec
SSDEEP

6144:bKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgzmnaVGraWWqXqzzyd17O6t0RmUoBb:aXWWqazOd165Rmvb

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://datie-tw.com/img/SvH/

xlm40.dropper

http://central-nutrition.com/wp-content/Nh1L6YR4qlDFWS58cVB/

xlm40.dropper

http://championsfactorysampaios.com.br/xt5HKu/tDs8WsKOxQFq/

xlm40.dropper

https://dacsandongthapmuoi.vn/system/cron/HwOtNCFo/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5108	848	regsvr32.exe	81
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3328	848	regsvr32.exe	81
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4248	848	regsvr32.exe	81
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3596	848	regsvr32.exe	81

Downloads MZ/PE file

Loads dropped DLL 8 IoCs

pid	Process
5108	regsvr32.exe
4728	regsvr32.exe
3328	regsvr32.exe
2712	regsvr32.exe
4248	regsvr32.exe
1756	regsvr32.exe
3596	regsvr32.exe
3544	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KDDxUVoqMPqPr.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\MCBCtrLXbyVv\\KDDxUVoqMPqPr.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\THdJfUYPiLhdrp.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\TCtFp\\THdJfUYPiLhdrp.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HUuqivnsWcvElGf.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\KFRxpcrlPBwtCv\\HUuqivnsWcvElGf.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QAmpfpChYiJIjNRH.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\UcxMM\\QAmpfpChYiJIjNRH.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
848	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5108	regsvr32.exe
5108	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
3328	regsvr32.exe
3328	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
2712	regsvr32.exe
4248	regsvr32.exe
4248	regsvr32.exe
1756	regsvr32.exe
1756	regsvr32.exe
1756	regsvr32.exe
1756	regsvr32.exe
3596	regsvr32.exe
3596	regsvr32.exe
3544	regsvr32.exe
3544	regsvr32.exe
3544	regsvr32.exe
3544	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
848	EXCEL.EXE
848	EXCEL.EXE
848	EXCEL.EXE
848	EXCEL.EXE
848	EXCEL.EXE
848	EXCEL.EXE
848	EXCEL.EXE
848	EXCEL.EXE
848	EXCEL.EXE
848	EXCEL.EXE
848	EXCEL.EXE
848	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 5108	848	EXCEL.EXE	86
PID 848 wrote to memory of 5108	848	EXCEL.EXE	86
PID 5108 wrote to memory of 4728	5108	regsvr32.exe	88
PID 5108 wrote to memory of 4728	5108	regsvr32.exe	88
PID 848 wrote to memory of 3328	848	EXCEL.EXE	89
PID 848 wrote to memory of 3328	848	EXCEL.EXE	89
PID 3328 wrote to memory of 2712	3328	regsvr32.exe	90
PID 3328 wrote to memory of 2712	3328	regsvr32.exe	90
PID 848 wrote to memory of 4248	848	EXCEL.EXE	91
PID 848 wrote to memory of 4248	848	EXCEL.EXE	91
PID 4248 wrote to memory of 1756	4248	regsvr32.exe	92
PID 4248 wrote to memory of 1756	4248	regsvr32.exe	92
PID 848 wrote to memory of 3596	848	EXCEL.EXE	93
PID 848 wrote to memory of 3596	848	EXCEL.EXE	93
PID 3596 wrote to memory of 3544	3596	regsvr32.exe	94
PID 3596 wrote to memory of 3544	3596	regsvr32.exe	94

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\27950.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UcxMM\QAmpfpChYiJIjNRH.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4728
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MCBCtrLXbyVv\KDDxUVoqMPqPr.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2712
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TCtFp\THdJfUYPiLhdrp.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1756
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KFRxpcrlPBwtCv\HUuqivnsWcvElGf.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv1.ooccxx

Filesize
790KB

MD5
139f72046bf14956a1e56425736fbdf5

SHA1
8260c2fe934e89adbb2b19bbd67e04557f0d93bd

SHA256
8213464904793c15b350a0145540d2d0aa9d62bc6f53f37cc6c8c61840534071

SHA512
f2c66978d86aa1fbc85bf0dda028821bcc7574ade65be0b00471c407839953f2d5e965eca609090251dc10ef7cb2b2c65a044310b748e8c5f985d25405d16066

Download Submit
C:\Users\Admin\oxnv1.ooccxx

Filesize
790KB

MD5
139f72046bf14956a1e56425736fbdf5

SHA1
8260c2fe934e89adbb2b19bbd67e04557f0d93bd

SHA256
8213464904793c15b350a0145540d2d0aa9d62bc6f53f37cc6c8c61840534071

SHA512
f2c66978d86aa1fbc85bf0dda028821bcc7574ade65be0b00471c407839953f2d5e965eca609090251dc10ef7cb2b2c65a044310b748e8c5f985d25405d16066

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
790KB

MD5
6d26ff3b6f386c76b8440f89c4851a89

SHA1
dfe7bdcde1bfaee675ca367f7c54f5946812d714

SHA256
83cf170fee4bc03d01ec92dde7f5c089190d87ec7e4c346b8b07e19d760d6c15

SHA512
e79fc30b62528362537a8b8349f6f544fc23d6fcce3753f13732ad3048bbdcf471bddbedc017beda2bb6efd176499124dd5e9fc2d497a326d7699a238f8497b8

Download Submit
C:\Users\Admin\oxnv2.ooccxx

Filesize
790KB

MD5
6d26ff3b6f386c76b8440f89c4851a89

SHA1
dfe7bdcde1bfaee675ca367f7c54f5946812d714

SHA256
83cf170fee4bc03d01ec92dde7f5c089190d87ec7e4c346b8b07e19d760d6c15

SHA512
e79fc30b62528362537a8b8349f6f544fc23d6fcce3753f13732ad3048bbdcf471bddbedc017beda2bb6efd176499124dd5e9fc2d497a326d7699a238f8497b8

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
790KB

MD5
7f8e9533c15ee641b7d44ce7ebe4c107

SHA1
de3f1d4ae24c2594a6e697d3e22ad3ba7a983239

SHA256
7a579ae7138bf6f6d10ed55193917232ae4962e932ab7a3be349290b5e8d22fb

SHA512
e06fedbb2cfdc80773afdc5148740c831583876bfc3ee2b62830235385f2b0e8d4adc9553029565d96a82263edc48cb1397156777fd34e793f7d2c2bf4eb43fd

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
790KB

MD5
7f8e9533c15ee641b7d44ce7ebe4c107

SHA1
de3f1d4ae24c2594a6e697d3e22ad3ba7a983239

SHA256
7a579ae7138bf6f6d10ed55193917232ae4962e932ab7a3be349290b5e8d22fb

SHA512
e06fedbb2cfdc80773afdc5148740c831583876bfc3ee2b62830235385f2b0e8d4adc9553029565d96a82263edc48cb1397156777fd34e793f7d2c2bf4eb43fd

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
790KB

MD5
c62024ee2667312f5e2c95d39bd35628

SHA1
80e976d6b43f6e4b82f50c4fb0ab7587462526e9

SHA256
b8e9f026f48b205fd6ccd38e249a0dcbdd3ee0dc46288c204fe3fef0d1175296

SHA512
143b28a826091dc455984ed280db227781ac1e05ca200a3c965a6152241115c8fcbade868ae7c0ddb58769507873f45069d9a42b5927b782e4520c926018c3cc

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
790KB

MD5
c62024ee2667312f5e2c95d39bd35628

SHA1
80e976d6b43f6e4b82f50c4fb0ab7587462526e9

SHA256
b8e9f026f48b205fd6ccd38e249a0dcbdd3ee0dc46288c204fe3fef0d1175296

SHA512
143b28a826091dc455984ed280db227781ac1e05ca200a3c965a6152241115c8fcbade868ae7c0ddb58769507873f45069d9a42b5927b782e4520c926018c3cc

Download Submit
C:\Windows\System32\KFRxpcrlPBwtCv\HUuqivnsWcvElGf.dll

Filesize
790KB

MD5
c62024ee2667312f5e2c95d39bd35628

SHA1
80e976d6b43f6e4b82f50c4fb0ab7587462526e9

SHA256
b8e9f026f48b205fd6ccd38e249a0dcbdd3ee0dc46288c204fe3fef0d1175296

SHA512
143b28a826091dc455984ed280db227781ac1e05ca200a3c965a6152241115c8fcbade868ae7c0ddb58769507873f45069d9a42b5927b782e4520c926018c3cc

Download Submit
C:\Windows\System32\MCBCtrLXbyVv\KDDxUVoqMPqPr.dll

Filesize
790KB

MD5
6d26ff3b6f386c76b8440f89c4851a89

SHA1
dfe7bdcde1bfaee675ca367f7c54f5946812d714

SHA256
83cf170fee4bc03d01ec92dde7f5c089190d87ec7e4c346b8b07e19d760d6c15

SHA512
e79fc30b62528362537a8b8349f6f544fc23d6fcce3753f13732ad3048bbdcf471bddbedc017beda2bb6efd176499124dd5e9fc2d497a326d7699a238f8497b8

Download Submit
C:\Windows\System32\TCtFp\THdJfUYPiLhdrp.dll

Filesize
790KB

MD5
7f8e9533c15ee641b7d44ce7ebe4c107

SHA1
de3f1d4ae24c2594a6e697d3e22ad3ba7a983239

SHA256
7a579ae7138bf6f6d10ed55193917232ae4962e932ab7a3be349290b5e8d22fb

SHA512
e06fedbb2cfdc80773afdc5148740c831583876bfc3ee2b62830235385f2b0e8d4adc9553029565d96a82263edc48cb1397156777fd34e793f7d2c2bf4eb43fd

Download Submit
C:\Windows\System32\UcxMM\QAmpfpChYiJIjNRH.dll

Filesize
790KB

MD5
139f72046bf14956a1e56425736fbdf5

SHA1
8260c2fe934e89adbb2b19bbd67e04557f0d93bd

SHA256
8213464904793c15b350a0145540d2d0aa9d62bc6f53f37cc6c8c61840534071

SHA512
f2c66978d86aa1fbc85bf0dda028821bcc7574ade65be0b00471c407839953f2d5e965eca609090251dc10ef7cb2b2c65a044310b748e8c5f985d25405d16066

Download Submit
memory/848-134-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/848-132-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/848-136-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/848-135-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/848-187-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/848-186-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/848-185-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/848-184-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/848-133-0x00007FFC45150000-0x00007FFC45160000-memory.dmp

Filesize
64KB

Download
memory/848-138-0x00007FFC42D80000-0x00007FFC42D90000-memory.dmp

Filesize
64KB

Download
memory/848-137-0x00007FFC42D80000-0x00007FFC42D90000-memory.dmp

Filesize
64KB

Download
memory/5108-142-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download