emotet | 764cdc4c238f8b37ccc4551df843bc7d9a5fec5ca76fa0385bce426a2b525bd5

Analysis

max time kernel
102s
max time network
153s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
09/11/2022, 16:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
764cdc4c238f8b37ccc4551df843bc7d9a5fec5ca76fa0385bce426a2b525bd5.xls
Size 91KB
Sample221109-vg29vsaeh6
SHA256 764cdc4c238f8b37ccc4551df843bc7d9a5fec5ca76fa0385bce426a2b525bd5
MD5 63ceef8622627689ce7953aea1db63ac
SHA1 236ea460649a8af942907361511ade8abab68a2e
SHA512 42be6b160cda800e66367090a13de4104e36eb05aca9dd8923035099e73bfb104c5e94218360b09064d159e47eebc0ba0de4203d291564fa74f99133fadde294
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4Z8EM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/
xlm40.dropper
http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/
xlm40.dropper
https://wijsneusmedia.nl/cgi-bin/kFB/
xlm40.dropper
http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3488	2728	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4520	2728	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1480	2728	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2928	2728	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
3488	regsvr32.exe
4520	regsvr32.exe
1480	regsvr32.exe
2928	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BLJTW.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\EzPbWSpVmtcUf\\BLJTW.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OydZNtCcNPEtuNWC.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\QHGwHVGNggwS\\OydZNtCcNPEtuNWC.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AKquNyR.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\TMQqbaUDSX\\AKquNyR.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SnZbeDl.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\SVktKzkssmvldFMlA\\SnZbeDl.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2728	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3488	regsvr32.exe
3488	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
4592	regsvr32.exe
4520	regsvr32.exe
4520	regsvr32.exe
4408	regsvr32.exe
4408	regsvr32.exe
4408	regsvr32.exe
4408	regsvr32.exe
1480	regsvr32.exe
1480	regsvr32.exe
4312	regsvr32.exe
4312	regsvr32.exe
4312	regsvr32.exe
4312	regsvr32.exe
2928	regsvr32.exe
2928	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe
2232	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2728	EXCEL.EXE
2728	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE
2728	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 3488	2728	EXCEL.EXE	70
PID 2728 wrote to memory of 3488	2728	EXCEL.EXE	70
PID 3488 wrote to memory of 4592	3488	regsvr32.exe	73
PID 3488 wrote to memory of 4592	3488	regsvr32.exe	73
PID 2728 wrote to memory of 4520	2728	EXCEL.EXE	75
PID 2728 wrote to memory of 4520	2728	EXCEL.EXE	75
PID 4520 wrote to memory of 4408	4520	regsvr32.exe	76
PID 4520 wrote to memory of 4408	4520	regsvr32.exe	76
PID 2728 wrote to memory of 1480	2728	EXCEL.EXE	78
PID 2728 wrote to memory of 1480	2728	EXCEL.EXE	78
PID 1480 wrote to memory of 4312	1480	regsvr32.exe	79
PID 1480 wrote to memory of 4312	1480	regsvr32.exe	79
PID 2728 wrote to memory of 2928	2728	EXCEL.EXE	80
PID 2728 wrote to memory of 2928	2728	EXCEL.EXE	80
PID 2928 wrote to memory of 2232	2928	regsvr32.exe	81
PID 2928 wrote to memory of 2232	2928	regsvr32.exe	81

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\764cdc4c238f8b37ccc4551df843bc7d9a5fec5ca76fa0385bce426a2b525bd5.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3488
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SVktKzkssmvldFMlA\SnZbeDl.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4592
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EzPbWSpVmtcUf\BLJTW.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4408
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QHGwHVGNggwS\OydZNtCcNPEtuNWC.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4312
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TMQqbaUDSX\AKquNyR.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 9edeb044af1a98169a0cb28994c1cff70def8643c8445a267163e6b3315495a2
MD5 30e5853603526906f7ecb806d3a9c596
SHA1 da799705197d7618505a5c96f0f6642fa391346a
SHA512 ce98453f5f3dafa1f451fec614a6a5040f9e72e4a8efd0082b358b1406f0d8f1126807e1f7e0b810a8b70338ddc03d89ab8356f22e04277d7ffcce0b47f9c732
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzS:ObB2Xq/cmRq2B+4Vu
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 c2cb2f4085150a7ddea8dec5ff306ea56c1c81a72c044ab0f7e9f611e6b3442d
MD5 0e3d240205748f064eaef52bc3471fea
SHA1 9eae50982fd022ec0ecc6cab49b725dc13d1a603
SHA512 89e97f290e9e79aeb0c0b96fee22ee5f4aa0ecf51b18b50ade2d07eb747dbc79cb9b7ef25eee2407138500f0043544eec334b1a66cbd6c7d5d627b12713d8a14
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzV:ObB2Xq/cmRq2B+4VJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 05b407d953d3113b0bfda2f11fa1dd86cc5e4a9325e9ab8c5c98a05b8c5eda2c
MD5 bf42ae174141c534203716a4339914c7
SHA1 2f470c0b4a9bbcf2b509a6cc67bbcb7ed511ac24
SHA512 ea006bd00e57172eddf6fc47a0d9bad4a52cc39307f40fc07afa7b7aabf2d9b751d31870369d5b3c401045d523ba3948d3e7f9a5fe6e317f9b3fd9c69f3354ba
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzh:ObB2Xq/cmRq2B+4VN
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 4664ab70edf93460db95d15a3136e3513a96a28d165cd550803acc04b01749a5
MD5 d89b96fcd70cd685ea9700653dcecf89
SHA1 d9ff8f5dd746c1c09e9ba0aa20a0c421edec8b67
SHA512 d48b2f63b8c633803a5d4d751f0c4e19cb43c3084f95ba7f755cdc970cd578e914af984e0eb7caf89526491753ef9113eb0de27dc40b6e3934832ebaf7495ff9
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzB:ObB2Xq/cmRq2B+4Vl
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path \Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 9edeb044af1a98169a0cb28994c1cff70def8643c8445a267163e6b3315495a2
MD5 30e5853603526906f7ecb806d3a9c596
SHA1 da799705197d7618505a5c96f0f6642fa391346a
SHA512 ce98453f5f3dafa1f451fec614a6a5040f9e72e4a8efd0082b358b1406f0d8f1126807e1f7e0b810a8b70338ddc03d89ab8356f22e04277d7ffcce0b47f9c732
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzS:ObB2Xq/cmRq2B+4Vu
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path \Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 c2cb2f4085150a7ddea8dec5ff306ea56c1c81a72c044ab0f7e9f611e6b3442d
MD5 0e3d240205748f064eaef52bc3471fea
SHA1 9eae50982fd022ec0ecc6cab49b725dc13d1a603
SHA512 89e97f290e9e79aeb0c0b96fee22ee5f4aa0ecf51b18b50ade2d07eb747dbc79cb9b7ef25eee2407138500f0043544eec334b1a66cbd6c7d5d627b12713d8a14
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzV:ObB2Xq/cmRq2B+4VJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path \Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 05b407d953d3113b0bfda2f11fa1dd86cc5e4a9325e9ab8c5c98a05b8c5eda2c
MD5 bf42ae174141c534203716a4339914c7
SHA1 2f470c0b4a9bbcf2b509a6cc67bbcb7ed511ac24
SHA512 ea006bd00e57172eddf6fc47a0d9bad4a52cc39307f40fc07afa7b7aabf2d9b751d31870369d5b3c401045d523ba3948d3e7f9a5fe6e317f9b3fd9c69f3354ba
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzh:ObB2Xq/cmRq2B+4VN
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path \Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 4664ab70edf93460db95d15a3136e3513a96a28d165cd550803acc04b01749a5
MD5 d89b96fcd70cd685ea9700653dcecf89
SHA1 d9ff8f5dd746c1c09e9ba0aa20a0c421edec8b67
SHA512 d48b2f63b8c633803a5d4d751f0c4e19cb43c3084f95ba7f755cdc970cd578e914af984e0eb7caf89526491753ef9113eb0de27dc40b6e3934832ebaf7495ff9
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzB:ObB2Xq/cmRq2B+4Vl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2728-128-0x00007FFCBB190000-0x00007FFCBB1A0000-memory.dmp

Download

memory/2728-338-0x00007FFCBEB70000-0x00007FFCBEB80000-memory.dmp

Download

memory/2728-339-0x00007FFCBEB70000-0x00007FFCBEB80000-memory.dmp

Download

memory/2728-340-0x00007FFCBEB70000-0x00007FFCBEB80000-memory.dmp

Download

memory/2728-337-0x00007FFCBEB70000-0x00007FFCBEB80000-memory.dmp

Download

memory/2728-115-0x00007FFCBEB70000-0x00007FFCBEB80000-memory.dmp

Download

memory/2728-127-0x00007FFCBB190000-0x00007FFCBB1A0000-memory.dmp

Download

memory/2728-118-0x00007FFCBEB70000-0x00007FFCBEB80000-memory.dmp

Download

memory/2728-117-0x00007FFCBEB70000-0x00007FFCBEB80000-memory.dmp

Download

memory/2728-116-0x00007FFCBEB70000-0x00007FFCBEB80000-memory.dmp

Download

memory/3488-255-0x0000000180000000-0x0000000180030000-memory.dmp

Download