emotet | 1b6f88dcf4163f96e35c19aa2bd43b1b5fdcf731ca2b361e00f2caa29253b31e

Analysis

max time kernel
151s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29479865955.xls
Size 91KB
Sample221109-2wg1sscha5
SHA256 1b6f88dcf4163f96e35c19aa2bd43b1b5fdcf731ca2b361e00f2caa29253b31e
MD5 ae27d8249db46e75e2321e0df4a4d6cd
SHA1 f967b0eb2e926caadc1a6b4ef8cc27938160ff36
SHA512 e36c1c130a943551782788a26f00ede3b8bc1854186065d95526b70552be913e439a1cda44fca7d39882b08b5249784d25b24224f7c3eb4dec0042d2960a4fbd
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgMbCXuZH4gb4CEn9J4ZWX3O:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
https://encuadernacionesartis.com/Vk2Z1Na/IZpyySkbU/
xlm40.dropper
http://eznetb.synology.me/@eaDir/E36Y/
xlm40.dropper
http://bytesendesign.nl/cgi-bin/LolX/
xlm40.dropper
http://choltice.eu/mwc/syl3Y/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1316	2252	regsvr32.exe	77
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2328	2252	regsvr32.exe	77
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	364	2252	regsvr32.exe	77
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1592	2252	regsvr32.exe	77

Downloads MZ/PE file

Loads dropped DLL 6 IoCs

pid	Process
2328	regsvr32.exe
3844	regsvr32.exe
364	regsvr32.exe
3840	regsvr32.exe
1592	regsvr32.exe
2124	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vqYJG.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\Kuoxp\\vqYJG.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2252	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2328	regsvr32.exe
2328	regsvr32.exe
3844	regsvr32.exe
3844	regsvr32.exe
364	regsvr32.exe
364	regsvr32.exe
3844	regsvr32.exe
3844	regsvr32.exe
3840	regsvr32.exe
3840	regsvr32.exe
3840	regsvr32.exe
3840	regsvr32.exe
1592	regsvr32.exe
1592	regsvr32.exe
2124	regsvr32.exe
2124	regsvr32.exe
2124	regsvr32.exe
2124	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2252	EXCEL.EXE
2252	EXCEL.EXE
2252	EXCEL.EXE
2252	EXCEL.EXE
2252	EXCEL.EXE
2252	EXCEL.EXE
2252	EXCEL.EXE
2252	EXCEL.EXE
2252	EXCEL.EXE
2252	EXCEL.EXE
2252	EXCEL.EXE
2252	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 1316	2252	EXCEL.EXE	83
PID 2252 wrote to memory of 1316	2252	EXCEL.EXE	83
PID 2252 wrote to memory of 2328	2252	EXCEL.EXE	84
PID 2252 wrote to memory of 2328	2252	EXCEL.EXE	84
PID 2252 wrote to memory of 364	2252	EXCEL.EXE	85
PID 2252 wrote to memory of 364	2252	EXCEL.EXE	85
PID 2328 wrote to memory of 3844	2328	regsvr32.exe	86
PID 2328 wrote to memory of 3844	2328	regsvr32.exe	86
PID 364 wrote to memory of 3840	364	regsvr32.exe	87
PID 364 wrote to memory of 3840	364	regsvr32.exe	87
PID 2252 wrote to memory of 1592	2252	EXCEL.EXE	88
PID 2252 wrote to memory of 1592	2252	EXCEL.EXE	88
PID 1592 wrote to memory of 2124	1592	regsvr32.exe	89
PID 1592 wrote to memory of 2124	1592	regsvr32.exe	89

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\29479865955.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:1316
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SFcYdWGnvS\HYGSVC.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3844
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KNzMSyrd\FMKO.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:3840
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Kuoxp\vqYJG.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 591KB
SHA256 758c19df0bb5a4d9b8620c4c1f68d28f29dcdb28fc759fa6b10424eea36561c1
MD5 ce4a24ac64c1413acc2fc4f559f98655
SHA1 de50f8f6dc5c483d79e0656baa2f375842ec892e
SHA512 d9e9ce247c3ac3cde320c19d310a48d7a528b308c1d14b01822b1b8dbb72ce05e95335febeb6fe7ea2c4d5261b9075811d595cede363a437236a85ef833fc2e8
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmO1L:1ml8U52n1pkxoI0nwfmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 591KB
SHA256 758c19df0bb5a4d9b8620c4c1f68d28f29dcdb28fc759fa6b10424eea36561c1
MD5 ce4a24ac64c1413acc2fc4f559f98655
SHA1 de50f8f6dc5c483d79e0656baa2f375842ec892e
SHA512 d9e9ce247c3ac3cde320c19d310a48d7a528b308c1d14b01822b1b8dbb72ce05e95335febeb6fe7ea2c4d5261b9075811d595cede363a437236a85ef833fc2e8
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmO1L:1ml8U52n1pkxoI0nwfmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 591KB
SHA256 bb3c07a7f878dcea1d5558e4aab132040560872d830d53ed955638d53a7bb48e
MD5 605f49d4caf0a13acac37ed9fa85edc8
SHA1 d2259321f0b2008a3a5b9f6c5d0e1e9766bd3195
SHA512 dd2b8aefbf4ef584a2adb2c84642fa2064d040777456556a621bff34466d1dedb5eea6658c8f92f0886886aa318cefb663d9731fd590e5bf4ef0d7efc48dffea
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmX1L:1ml8U52n1pkxoI0nwfmF
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 591KB
SHA256 bb3c07a7f878dcea1d5558e4aab132040560872d830d53ed955638d53a7bb48e
MD5 605f49d4caf0a13acac37ed9fa85edc8
SHA1 d2259321f0b2008a3a5b9f6c5d0e1e9766bd3195
SHA512 dd2b8aefbf4ef584a2adb2c84642fa2064d040777456556a621bff34466d1dedb5eea6658c8f92f0886886aa318cefb663d9731fd590e5bf4ef0d7efc48dffea
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmX1L:1ml8U52n1pkxoI0nwfmF
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 591KB
SHA256 67a39e1931db39046d3a14c6e5584cf2c41b913472758b25682c66da8cf24389
MD5 27b634fbc63d9675ae0f6a71ddac8740
SHA1 7bd5b2791d3daa5f96633107eedb3d7da3fee64e
SHA512 121472bf4d26711e6afed8fc8dc5966fc19c1dcbd2558d64b34c18542e74a5cf81d495aa3604e14166b2f512f52b86cb4c956d8bcc67fd933963b4b035d2c230
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfm71L:1ml8U52n1pkxoI0nwfmZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 591KB
SHA256 67a39e1931db39046d3a14c6e5584cf2c41b913472758b25682c66da8cf24389
MD5 27b634fbc63d9675ae0f6a71ddac8740
SHA1 7bd5b2791d3daa5f96633107eedb3d7da3fee64e
SHA512 121472bf4d26711e6afed8fc8dc5966fc19c1dcbd2558d64b34c18542e74a5cf81d495aa3604e14166b2f512f52b86cb4c956d8bcc67fd933963b4b035d2c230
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfm71L:1ml8U52n1pkxoI0nwfmZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

FMKO.dll

Path C:\Windows\System32\KNzMSyrd\FMKO.dll
Size 591KB
SHA256 bb3c07a7f878dcea1d5558e4aab132040560872d830d53ed955638d53a7bb48e
MD5 605f49d4caf0a13acac37ed9fa85edc8
SHA1 d2259321f0b2008a3a5b9f6c5d0e1e9766bd3195
SHA512 dd2b8aefbf4ef584a2adb2c84642fa2064d040777456556a621bff34466d1dedb5eea6658c8f92f0886886aa318cefb663d9731fd590e5bf4ef0d7efc48dffea
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmX1L:1ml8U52n1pkxoI0nwfmF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vqYJG.dll

Path C:\Windows\System32\Kuoxp\vqYJG.dll
Size 591KB
SHA256 67a39e1931db39046d3a14c6e5584cf2c41b913472758b25682c66da8cf24389
MD5 27b634fbc63d9675ae0f6a71ddac8740
SHA1 7bd5b2791d3daa5f96633107eedb3d7da3fee64e
SHA512 121472bf4d26711e6afed8fc8dc5966fc19c1dcbd2558d64b34c18542e74a5cf81d495aa3604e14166b2f512f52b86cb4c956d8bcc67fd933963b4b035d2c230
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfm71L:1ml8U52n1pkxoI0nwfmZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

HYGSVC.dll

Path C:\Windows\System32\SFcYdWGnvS\HYGSVC.dll
Size 591KB
SHA256 758c19df0bb5a4d9b8620c4c1f68d28f29dcdb28fc759fa6b10424eea36561c1
MD5 ce4a24ac64c1413acc2fc4f559f98655
SHA1 de50f8f6dc5c483d79e0656baa2f375842ec892e
SHA512 d9e9ce247c3ac3cde320c19d310a48d7a528b308c1d14b01822b1b8dbb72ce05e95335febeb6fe7ea2c4d5261b9075811d595cede363a437236a85ef833fc2e8
SSDEEP 12288:d5xml1eXk52nn1pCBrPFogSShuJN/x6O9cDzfmO1L:1ml8U52n1pkxoI0nwfmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2252-134-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Download

memory/2252-132-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Download

memory/2252-138-0x00007FFD531B0000-0x00007FFD531C0000-memory.dmp

Download

memory/2252-137-0x00007FFD531B0000-0x00007FFD531C0000-memory.dmp

Download

memory/2252-136-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Download

memory/2252-177-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Download

memory/2252-135-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Download

memory/2252-176-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Download

memory/2252-133-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Download

memory/2252-174-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Download

memory/2252-175-0x00007FFD55B10000-0x00007FFD55B20000-memory.dmp

Download

memory/2328-143-0x0000000002450000-0x0000000002480000-memory.dmp

Download