emotet | 1ee7b704748ac97fec5cac6b14feb616aa08a607af15ec2e23dfe4a49e885077

Analysis

max time kernel
171s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
408372.xls
Size 91KB
Sample221109-162yaaedbr
SHA256 1ee7b704748ac97fec5cac6b14feb616aa08a607af15ec2e23dfe4a49e885077
MD5 eba12ff624bac7b80f793d44cebd8d42
SHA1 0550a1128429c2ab52c31c559acb9be33e7b36d6
SHA512 b064f33fd9a5834fe6361e130e4a7fe4a539a461e9d6cd31c5acb36ee3d28ed3fe28e21f9b060e8a0caad5aba9f2c03747e5bc24754972663f3bafed4952cfe1
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgIbCXuZH4gb4CEn9J4ZJVQvj:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://fixoutlet.com/logs/OGlRuU/
xlm40.dropper
http://www.cesasin.com.ar/administrator/viA95RR/
xlm40.dropper
http://blacktequila.com.br/2fb62HWWoKi5nfEq2D/XB5VOAXZkhVhSKveYUV/
xlm40.dropper
http://case.co.il/_js/dooigYa/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1412	4784	regsvr32.exe	79
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3196	4784	regsvr32.exe	79
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4496	4784	regsvr32.exe	79
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2704	4784	regsvr32.exe	79

Downloads MZ/PE file

Loads dropped DLL 6 IoCs

pid	Process
1412	regsvr32.exe
1240	regsvr32.exe
4496	regsvr32.exe
2744	regsvr32.exe
2704	regsvr32.exe
3056	regsvr32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yVllhaMcX.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\EbadT\\yVllhaMcX.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NtHfMgjeE.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\KVJpVbrwvrY\\NtHfMgjeE.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4784	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1412	regsvr32.exe
1412	regsvr32.exe
1240	regsvr32.exe
1240	regsvr32.exe
1240	regsvr32.exe
1240	regsvr32.exe
4496	regsvr32.exe
4496	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2744	regsvr32.exe
2704	regsvr32.exe
2704	regsvr32.exe
3056	regsvr32.exe
3056	regsvr32.exe
3056	regsvr32.exe
3056	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4784	EXCEL.EXE
4784	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4784	EXCEL.EXE
4784	EXCEL.EXE
4784	EXCEL.EXE
4784	EXCEL.EXE
4784	EXCEL.EXE
4784	EXCEL.EXE
4784	EXCEL.EXE
4784	EXCEL.EXE
4784	EXCEL.EXE
4784	EXCEL.EXE
4784	EXCEL.EXE
4784	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 1412	4784	EXCEL.EXE	82
PID 4784 wrote to memory of 1412	4784	EXCEL.EXE	82
PID 1412 wrote to memory of 1240	1412	regsvr32.exe	85
PID 1412 wrote to memory of 1240	1412	regsvr32.exe	85
PID 4784 wrote to memory of 3196	4784	EXCEL.EXE	87
PID 4784 wrote to memory of 3196	4784	EXCEL.EXE	87
PID 4784 wrote to memory of 4496	4784	EXCEL.EXE	88
PID 4784 wrote to memory of 4496	4784	EXCEL.EXE	88
PID 4496 wrote to memory of 2744	4496	regsvr32.exe	89
PID 4496 wrote to memory of 2744	4496	regsvr32.exe	89
PID 4784 wrote to memory of 2704	4784	EXCEL.EXE	90
PID 4784 wrote to memory of 2704	4784	EXCEL.EXE	90
PID 2704 wrote to memory of 3056	2704	regsvr32.exe	91
PID 2704 wrote to memory of 3056	2704	regsvr32.exe	91

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\408372.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KVJpVbrwvrY\NtHfMgjeE.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1240
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:3196
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RXeKoxvKAIs\tGvSlTjZVbxuKOUs.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2744
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EbadT\yVllhaMcX.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 591KB
SHA256 c6cd574ddef31474f34b8a2d921d3c5ebe1b59cd69b16b573e9430cbd613599b
MD5 4a5ab9863715d0778c91040cb2a9c3a8
SHA1 30dfa658ab6895c002c102c2b3009321beb37c5a
SHA512 5e422a91ba8dd43b37f36ac888a54617353c0eef89ba0dbc53e27ba8eefde435b21f2c6a6dcd552e92b3d8c2204f8991fa719d313eaa882575e891c32c5314c1
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmI1L:1ml8U52n1pkxoI0nwfm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 591KB
SHA256 c6cd574ddef31474f34b8a2d921d3c5ebe1b59cd69b16b573e9430cbd613599b
MD5 4a5ab9863715d0778c91040cb2a9c3a8
SHA1 30dfa658ab6895c002c102c2b3009321beb37c5a
SHA512 5e422a91ba8dd43b37f36ac888a54617353c0eef89ba0dbc53e27ba8eefde435b21f2c6a6dcd552e92b3d8c2204f8991fa719d313eaa882575e891c32c5314c1
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmI1L:1ml8U52n1pkxoI0nwfm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 591KB
SHA256 7d5d2efe757a466425b4a8b21af0724b4e27ff66c7e9d91adc0011d790b88fa0
MD5 2f6b66b556069272ad46a89b57863c22
SHA1 45d5d758c10d88b504b25c9cb17b5328735ff652
SHA512 6630149d60428885c2508a4adec47151487b7f605a8cdca9ccb327d4f3654f48edb07d1c3cca5c42855b5a964061ecb4af8d9435f3c3d6b5ac7840ac3b5248e0
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmz1L:1ml8U52n1pkxoI0nwfmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 591KB
SHA256 7d5d2efe757a466425b4a8b21af0724b4e27ff66c7e9d91adc0011d790b88fa0
MD5 2f6b66b556069272ad46a89b57863c22
SHA1 45d5d758c10d88b504b25c9cb17b5328735ff652
SHA512 6630149d60428885c2508a4adec47151487b7f605a8cdca9ccb327d4f3654f48edb07d1c3cca5c42855b5a964061ecb4af8d9435f3c3d6b5ac7840ac3b5248e0
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmz1L:1ml8U52n1pkxoI0nwfmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 591KB
SHA256 48145affe2d4ce3243e6d157c7af448c04b98a4042b1a91fd04e0363d4f706b2
MD5 7b9c0fd9bce02dced8d5d8834d8cf56a
SHA1 22e4690dcfca530e96b8f9286023d711fece52e4
SHA512 635bc6a4df0dc14ad4b3abedcfc0bb8ae17ce8ff270a6fb7a3d1cb9477920fdb4fc3d3ff3ebdcb9f0e9c60d6ae1a79e43728f08d7ea7fd6ab7466967321167bb
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmg1L:1ml8U52n1pkxoI0nwfm2
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 591KB
SHA256 48145affe2d4ce3243e6d157c7af448c04b98a4042b1a91fd04e0363d4f706b2
MD5 7b9c0fd9bce02dced8d5d8834d8cf56a
SHA1 22e4690dcfca530e96b8f9286023d711fece52e4
SHA512 635bc6a4df0dc14ad4b3abedcfc0bb8ae17ce8ff270a6fb7a3d1cb9477920fdb4fc3d3ff3ebdcb9f0e9c60d6ae1a79e43728f08d7ea7fd6ab7466967321167bb
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmg1L:1ml8U52n1pkxoI0nwfm2
MD5 SHA1 SHA512 SSDEEP

Submit Download

yVllhaMcX.dll

Path C:\Windows\System32\EbadT\yVllhaMcX.dll
Size 591KB
SHA256 48145affe2d4ce3243e6d157c7af448c04b98a4042b1a91fd04e0363d4f706b2
MD5 7b9c0fd9bce02dced8d5d8834d8cf56a
SHA1 22e4690dcfca530e96b8f9286023d711fece52e4
SHA512 635bc6a4df0dc14ad4b3abedcfc0bb8ae17ce8ff270a6fb7a3d1cb9477920fdb4fc3d3ff3ebdcb9f0e9c60d6ae1a79e43728f08d7ea7fd6ab7466967321167bb
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmg1L:1ml8U52n1pkxoI0nwfm2
MD5 SHA1 SHA512 SSDEEP

Submit Download

NtHfMgjeE.dll

Path C:\Windows\System32\KVJpVbrwvrY\NtHfMgjeE.dll
Size 591KB
SHA256 c6cd574ddef31474f34b8a2d921d3c5ebe1b59cd69b16b573e9430cbd613599b
MD5 4a5ab9863715d0778c91040cb2a9c3a8
SHA1 30dfa658ab6895c002c102c2b3009321beb37c5a
SHA512 5e422a91ba8dd43b37f36ac888a54617353c0eef89ba0dbc53e27ba8eefde435b21f2c6a6dcd552e92b3d8c2204f8991fa719d313eaa882575e891c32c5314c1
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmI1L:1ml8U52n1pkxoI0nwfm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tGvSlTjZVbxuKOUs.dll

Path C:\Windows\System32\RXeKoxvKAIs\tGvSlTjZVbxuKOUs.dll
Size 591KB
SHA256 7d5d2efe757a466425b4a8b21af0724b4e27ff66c7e9d91adc0011d790b88fa0
MD5 2f6b66b556069272ad46a89b57863c22
SHA1 45d5d758c10d88b504b25c9cb17b5328735ff652
SHA512 6630149d60428885c2508a4adec47151487b7f605a8cdca9ccb327d4f3654f48edb07d1c3cca5c42855b5a964061ecb4af8d9435f3c3d6b5ac7840ac3b5248e0
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmz1L:1ml8U52n1pkxoI0nwfmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1412-142-0x00000000027B0000-0x00000000027E0000-memory.dmp

Download

memory/4784-138-0x00007FF93F700000-0x00007FF93F710000-memory.dmp

Download

memory/4784-136-0x00007FF941D50000-0x00007FF941D60000-memory.dmp

Download

memory/4784-137-0x00007FF93F700000-0x00007FF93F710000-memory.dmp

Download

memory/4784-135-0x00007FF941D50000-0x00007FF941D60000-memory.dmp

Download

memory/4784-134-0x00007FF941D50000-0x00007FF941D60000-memory.dmp

Download

memory/4784-132-0x00007FF941D50000-0x00007FF941D60000-memory.dmp

Download

memory/4784-133-0x00007FF941D50000-0x00007FF941D60000-memory.dmp

Download

memory/4784-174-0x00007FF941D50000-0x00007FF941D60000-memory.dmp

Download

memory/4784-175-0x00007FF941D50000-0x00007FF941D60000-memory.dmp

Download

memory/4784-176-0x00007FF941D50000-0x00007FF941D60000-memory.dmp

Download

memory/4784-177-0x00007FF941D50000-0x00007FF941D60000-memory.dmp

Download