emotet | bd62d5337ebb3e930c5353ce3b814f699687291d454347bb0ec5eab144c4f253

Analysis

max time kernel
151s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
48455638.xls
Size 91KB
Sample221109-1llesscdd6
SHA256 bd62d5337ebb3e930c5353ce3b814f699687291d454347bb0ec5eab144c4f253
MD5 c6bdba39597f80755c6c4ef3e71761fe
SHA1 7525b4be56f5b1cd4bed9dc5a486996c2208786f
SHA512 104eda7bbdfa5e652babd6a52162251a0359882c29b9f38575397902589478131d74a0bcbf7a8cd52dc7127e4adc02d41b60dd41918d34d2db7174af12d10903
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgMbCXuZH4gb4CEn9J4ZmX3O:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
https://encuadernacionesartis.com/Vk2Z1Na/IZpyySkbU/
xlm40.dropper
http://eznetb.synology.me/@eaDir/E36Y/
xlm40.dropper
http://bytesendesign.nl/cgi-bin/LolX/
xlm40.dropper
http://choltice.eu/mwc/syl3Y/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4824	1952	regsvr32.exe	83
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3632	1952	regsvr32.exe	83
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4172	1952	regsvr32.exe	83
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3720	1952	regsvr32.exe	83

Downloads MZ/PE file

Loads dropped DLL 8 IoCs

pid	Process
4824	regsvr32.exe
2792	regsvr32.exe
3632	regsvr32.exe
4172	regsvr32.exe
1392	regsvr32.exe
2484	regsvr32.exe
3720	regsvr32.exe
1720	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WOZvyLCUNeoZEJZh.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\QZIanpuAn\\WOZvyLCUNeoZEJZh.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SaZM.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\XfjBfftrW\\SaZM.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcAsSFwBLzcosI.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\CphKISZsiyJ\\tcAsSFwBLzcosI.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qqPpeRQjBnzFnv.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\ZaXSeahpavJu\\qqPpeRQjBnzFnv.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1952	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4824	regsvr32.exe
4824	regsvr32.exe
2792	regsvr32.exe
2792	regsvr32.exe
2792	regsvr32.exe
2792	regsvr32.exe
3632	regsvr32.exe
3632	regsvr32.exe
4172	regsvr32.exe
4172	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
2484	regsvr32.exe
2484	regsvr32.exe
3720	regsvr32.exe
3720	regsvr32.exe
2484	regsvr32.exe
2484	regsvr32.exe
1720	regsvr32.exe
1720	regsvr32.exe
1720	regsvr32.exe
1720	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 4824	1952	EXCEL.EXE	85
PID 1952 wrote to memory of 4824	1952	EXCEL.EXE	85
PID 4824 wrote to memory of 2792	4824	regsvr32.exe	86
PID 4824 wrote to memory of 2792	4824	regsvr32.exe	86
PID 1952 wrote to memory of 3632	1952	EXCEL.EXE	87
PID 1952 wrote to memory of 3632	1952	EXCEL.EXE	87
PID 1952 wrote to memory of 4172	1952	EXCEL.EXE	88
PID 1952 wrote to memory of 4172	1952	EXCEL.EXE	88
PID 3632 wrote to memory of 1392	3632	regsvr32.exe	89
PID 3632 wrote to memory of 1392	3632	regsvr32.exe	89
PID 4172 wrote to memory of 2484	4172	regsvr32.exe	90
PID 4172 wrote to memory of 2484	4172	regsvr32.exe	90
PID 1952 wrote to memory of 3720	1952	EXCEL.EXE	91
PID 1952 wrote to memory of 3720	1952	EXCEL.EXE	91
PID 3720 wrote to memory of 1720	3720	regsvr32.exe	94
PID 3720 wrote to memory of 1720	3720	regsvr32.exe	94

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\48455638.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CphKISZsiyJ\tcAsSFwBLzcosI.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2792
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZaXSeahpavJu\qqPpeRQjBnzFnv.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1392
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XfjBfftrW\SaZM.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2484
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QZIanpuAn\WOZvyLCUNeoZEJZh.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 591KB
SHA256 649d1384f8fc683d7336f9e073633580da96df9ebbfbe13e9e4e9c96bb82f1c3
MD5 e38648b258742750c79a13e898f8dc1f
SHA1 7d42e86dc4eff703715144a4ca3189432ce08212
SHA512 b33c89eff48f21bc9c20b4195ce802dacf238790bbdf272a771876bd221beb19ed800d5956986c0875a40dc3f44ced86d0230202e1e95c9a0debb27aa78e8afa
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfm11L:1ml8U52n1pkxoI0nwfmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 591KB
SHA256 649d1384f8fc683d7336f9e073633580da96df9ebbfbe13e9e4e9c96bb82f1c3
MD5 e38648b258742750c79a13e898f8dc1f
SHA1 7d42e86dc4eff703715144a4ca3189432ce08212
SHA512 b33c89eff48f21bc9c20b4195ce802dacf238790bbdf272a771876bd221beb19ed800d5956986c0875a40dc3f44ced86d0230202e1e95c9a0debb27aa78e8afa
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfm11L:1ml8U52n1pkxoI0nwfmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 591KB
SHA256 3d54ac2323138da765785ff95ffc2ce5549bc198aa614144d63f6a421526bbc9
MD5 8f4d432f9bbed89e1e40cf45f346f219
SHA1 43dacb6351e37e73246609558a3a39b03254dd61
SHA512 51c9d503199ea4c18bcacc81ccae1e128ceeb46286816660d1bcafe3e2598927eb2594982eeddd4f444ab337d83943b7cffc054971da20cd6651335eef605b8b
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmI1L:1ml8U52n1pkxoI0nwfm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 591KB
SHA256 3d54ac2323138da765785ff95ffc2ce5549bc198aa614144d63f6a421526bbc9
MD5 8f4d432f9bbed89e1e40cf45f346f219
SHA1 43dacb6351e37e73246609558a3a39b03254dd61
SHA512 51c9d503199ea4c18bcacc81ccae1e128ceeb46286816660d1bcafe3e2598927eb2594982eeddd4f444ab337d83943b7cffc054971da20cd6651335eef605b8b
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmI1L:1ml8U52n1pkxoI0nwfm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 591KB
SHA256 5e61bc486a756b004057483d4fb01aa1de2d1f95bf14841d9431223fde9cbc2d
MD5 62447c71a4b7479f04dd96a1bedf49d4
SHA1 e991c6c6aff03bc6d7d8f1032914eab38a3f596d
SHA512 66a5dfbcf0b3adc884e8a13ca70a95055791bc7b45857ce6736b0cdf2d8aa2dd023cbece334190db1c48319851e0b9170dd4a691fa6c2c61167822bd32efcb7c
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfm81L:1ml8U52n1pkxoI0nwfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 591KB
SHA256 5e61bc486a756b004057483d4fb01aa1de2d1f95bf14841d9431223fde9cbc2d
MD5 62447c71a4b7479f04dd96a1bedf49d4
SHA1 e991c6c6aff03bc6d7d8f1032914eab38a3f596d
SHA512 66a5dfbcf0b3adc884e8a13ca70a95055791bc7b45857ce6736b0cdf2d8aa2dd023cbece334190db1c48319851e0b9170dd4a691fa6c2c61167822bd32efcb7c
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfm81L:1ml8U52n1pkxoI0nwfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 591KB
SHA256 9cacf43abb2d6a750c4b67b72d5202527dfbc80236e235aa5e97302676124eb1
MD5 52a2c4a037e285bd0ab2716ef481d3dd
SHA1 b29ad867ba538914c0b818ef2590dd5704d1fafb
SHA512 3b65733050f79c1e98d1739e8b77a705cd97b62c270c30b6f5eeda6270c2a4cb5ceff9fde155dd3f41ae2ac0d906533371ebd1f30c2448bee8777fafcc4d046e
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmI1L:1ml8U52n1pkxoI0nwfm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 591KB
SHA256 9cacf43abb2d6a750c4b67b72d5202527dfbc80236e235aa5e97302676124eb1
MD5 52a2c4a037e285bd0ab2716ef481d3dd
SHA1 b29ad867ba538914c0b818ef2590dd5704d1fafb
SHA512 3b65733050f79c1e98d1739e8b77a705cd97b62c270c30b6f5eeda6270c2a4cb5ceff9fde155dd3f41ae2ac0d906533371ebd1f30c2448bee8777fafcc4d046e
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmI1L:1ml8U52n1pkxoI0nwfm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tcAsSFwBLzcosI.dll

Path C:\Windows\System32\CphKISZsiyJ\tcAsSFwBLzcosI.dll
Size 591KB
SHA256 649d1384f8fc683d7336f9e073633580da96df9ebbfbe13e9e4e9c96bb82f1c3
MD5 e38648b258742750c79a13e898f8dc1f
SHA1 7d42e86dc4eff703715144a4ca3189432ce08212
SHA512 b33c89eff48f21bc9c20b4195ce802dacf238790bbdf272a771876bd221beb19ed800d5956986c0875a40dc3f44ced86d0230202e1e95c9a0debb27aa78e8afa
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfm11L:1ml8U52n1pkxoI0nwfmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

WOZvyLCUNeoZEJZh.dll

Path C:\Windows\System32\QZIanpuAn\WOZvyLCUNeoZEJZh.dll
Size 591KB
SHA256 9cacf43abb2d6a750c4b67b72d5202527dfbc80236e235aa5e97302676124eb1
MD5 52a2c4a037e285bd0ab2716ef481d3dd
SHA1 b29ad867ba538914c0b818ef2590dd5704d1fafb
SHA512 3b65733050f79c1e98d1739e8b77a705cd97b62c270c30b6f5eeda6270c2a4cb5ceff9fde155dd3f41ae2ac0d906533371ebd1f30c2448bee8777fafcc4d046e
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmI1L:1ml8U52n1pkxoI0nwfm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SaZM.dll

Path C:\Windows\System32\XfjBfftrW\SaZM.dll
Size 591KB
SHA256 5e61bc486a756b004057483d4fb01aa1de2d1f95bf14841d9431223fde9cbc2d
MD5 62447c71a4b7479f04dd96a1bedf49d4
SHA1 e991c6c6aff03bc6d7d8f1032914eab38a3f596d
SHA512 66a5dfbcf0b3adc884e8a13ca70a95055791bc7b45857ce6736b0cdf2d8aa2dd023cbece334190db1c48319851e0b9170dd4a691fa6c2c61167822bd32efcb7c
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfm81L:1ml8U52n1pkxoI0nwfmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

qqPpeRQjBnzFnv.dll

Path C:\Windows\System32\ZaXSeahpavJu\qqPpeRQjBnzFnv.dll
Size 591KB
SHA256 3d54ac2323138da765785ff95ffc2ce5549bc198aa614144d63f6a421526bbc9
MD5 8f4d432f9bbed89e1e40cf45f346f219
SHA1 43dacb6351e37e73246609558a3a39b03254dd61
SHA512 51c9d503199ea4c18bcacc81ccae1e128ceeb46286816660d1bcafe3e2598927eb2594982eeddd4f444ab337d83943b7cffc054971da20cd6651335eef605b8b
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmI1L:1ml8U52n1pkxoI0nwfm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1952-134-0x00007FF96E950000-0x00007FF96E960000-memory.dmp

Download

memory/1952-135-0x00007FF96E950000-0x00007FF96E960000-memory.dmp

Download

memory/1952-133-0x00007FF96E950000-0x00007FF96E960000-memory.dmp

Download

memory/1952-132-0x00007FF96E950000-0x00007FF96E960000-memory.dmp

Download

memory/1952-136-0x00007FF96E950000-0x00007FF96E960000-memory.dmp

Download

memory/1952-138-0x00007FF96C4B0000-0x00007FF96C4C0000-memory.dmp

Download

memory/1952-137-0x00007FF96C4B0000-0x00007FF96C4C0000-memory.dmp

Download

memory/4824-142-0x0000000002660000-0x0000000002690000-memory.dmp

Download