emotet | c9f3d307c9df6c3ffa8bd5a1e29521548c042888452e4bcd0d017badb3da115a

Analysis

max time kernel
146s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6291.xls
Size 91KB
Sample221109-vk16zaccbl
SHA256 c9f3d307c9df6c3ffa8bd5a1e29521548c042888452e4bcd0d017badb3da115a
MD5 21572e735fb22c64bda3b743952b0ea2
SHA1 fc93ac49839f249b29f51162b188b658e331c9b7
SHA512 0baf45d9eb6366ada782372f23ed9e2af8858769a106f259cff1f5f7ca7d2683f03fd9f49546f481136105752dee8804ea759a8d33e24ab16fd5397e34718555
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZgEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/
xlm40.dropper
http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/
xlm40.dropper
https://wijsneusmedia.nl/cgi-bin/kFB/
xlm40.dropper
http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	544	4384	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3552	4384	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1932	4384	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1852	4384	regsvr32.exe	80

Downloads MZ/PE file

Loads dropped DLL 8 IoCs

pid	Process
544	regsvr32.exe
2364	regsvr32.exe
3552	regsvr32.exe
2444	regsvr32.exe
1932	regsvr32.exe
2284	regsvr32.exe
1852	regsvr32.exe
3160	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wuSbOW.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\GsMlHVYdbPrNsZdB\\wuSbOW.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GmCsfBGQJ.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\HcmrgoJkCTf\\GmCsfBGQJ.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hxqwHqnCfRZkrbeQ.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\QUSfCVsHHA\\hxqwHqnCfRZkrbeQ.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mdWWnNGCsi.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\IJLjXGPwtqhkurf\\mdWWnNGCsi.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4384	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
544	regsvr32.exe
544	regsvr32.exe
2364	regsvr32.exe
2364	regsvr32.exe
2364	regsvr32.exe
2364	regsvr32.exe
3552	regsvr32.exe
3552	regsvr32.exe
2444	regsvr32.exe
2444	regsvr32.exe
1932	regsvr32.exe
1932	regsvr32.exe
2444	regsvr32.exe
2444	regsvr32.exe
2284	regsvr32.exe
2284	regsvr32.exe
2284	regsvr32.exe
2284	regsvr32.exe
1852	regsvr32.exe
1852	regsvr32.exe
3160	regsvr32.exe
3160	regsvr32.exe
3160	regsvr32.exe
3160	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4384	EXCEL.EXE
4384	EXCEL.EXE
4384	EXCEL.EXE
4384	EXCEL.EXE
4384	EXCEL.EXE
4384	EXCEL.EXE
4384	EXCEL.EXE
4384	EXCEL.EXE
4384	EXCEL.EXE
4384	EXCEL.EXE
4384	EXCEL.EXE
4384	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 544	4384	EXCEL.EXE	85
PID 4384 wrote to memory of 544	4384	EXCEL.EXE	85
PID 544 wrote to memory of 2364	544	regsvr32.exe	87
PID 544 wrote to memory of 2364	544	regsvr32.exe	87
PID 4384 wrote to memory of 3552	4384	EXCEL.EXE	88
PID 4384 wrote to memory of 3552	4384	EXCEL.EXE	88
PID 3552 wrote to memory of 2444	3552	regsvr32.exe	91
PID 3552 wrote to memory of 2444	3552	regsvr32.exe	91
PID 4384 wrote to memory of 1932	4384	EXCEL.EXE	92
PID 4384 wrote to memory of 1932	4384	EXCEL.EXE	92
PID 1932 wrote to memory of 2284	1932	regsvr32.exe	93
PID 1932 wrote to memory of 2284	1932	regsvr32.exe	93
PID 4384 wrote to memory of 1852	4384	EXCEL.EXE	94
PID 4384 wrote to memory of 1852	4384	EXCEL.EXE	94
PID 1852 wrote to memory of 3160	1852	regsvr32.exe	95
PID 1852 wrote to memory of 3160	1852	regsvr32.exe	95

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6291.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GsMlHVYdbPrNsZdB\wuSbOW.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2364
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IJLjXGPwtqhkurf\mdWWnNGCsi.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2444
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QUSfCVsHHA\hxqwHqnCfRZkrbeQ.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2284
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\HcmrgoJkCTf\GmCsfBGQJ.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 10f055e9da8d91195b421c7d0115b5555d5347e94ec5d384dca663361f7e3778
MD5 44c91bd113fdd0a052f122acd635618b
SHA1 20156a544b22d006372d9160f5aee0418a515be1
SHA512 b4d761215d732be34061c08d0ef5a92b419966a2a915371fc83be271b7d024a3094135a17b35527fcf59374ac704657e4e2fc0e449922cf0fca1bf02243ecbe5
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzd:ObB2Xq/cmRq2B+4VR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 10f055e9da8d91195b421c7d0115b5555d5347e94ec5d384dca663361f7e3778
MD5 44c91bd113fdd0a052f122acd635618b
SHA1 20156a544b22d006372d9160f5aee0418a515be1
SHA512 b4d761215d732be34061c08d0ef5a92b419966a2a915371fc83be271b7d024a3094135a17b35527fcf59374ac704657e4e2fc0e449922cf0fca1bf02243ecbe5
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzd:ObB2Xq/cmRq2B+4VR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 c2cb2f4085150a7ddea8dec5ff306ea56c1c81a72c044ab0f7e9f611e6b3442d
MD5 0e3d240205748f064eaef52bc3471fea
SHA1 9eae50982fd022ec0ecc6cab49b725dc13d1a603
SHA512 89e97f290e9e79aeb0c0b96fee22ee5f4aa0ecf51b18b50ade2d07eb747dbc79cb9b7ef25eee2407138500f0043544eec334b1a66cbd6c7d5d627b12713d8a14
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzV:ObB2Xq/cmRq2B+4VJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 c2cb2f4085150a7ddea8dec5ff306ea56c1c81a72c044ab0f7e9f611e6b3442d
MD5 0e3d240205748f064eaef52bc3471fea
SHA1 9eae50982fd022ec0ecc6cab49b725dc13d1a603
SHA512 89e97f290e9e79aeb0c0b96fee22ee5f4aa0ecf51b18b50ade2d07eb747dbc79cb9b7ef25eee2407138500f0043544eec334b1a66cbd6c7d5d627b12713d8a14
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzV:ObB2Xq/cmRq2B+4VJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 05b407d953d3113b0bfda2f11fa1dd86cc5e4a9325e9ab8c5c98a05b8c5eda2c
MD5 bf42ae174141c534203716a4339914c7
SHA1 2f470c0b4a9bbcf2b509a6cc67bbcb7ed511ac24
SHA512 ea006bd00e57172eddf6fc47a0d9bad4a52cc39307f40fc07afa7b7aabf2d9b751d31870369d5b3c401045d523ba3948d3e7f9a5fe6e317f9b3fd9c69f3354ba
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzh:ObB2Xq/cmRq2B+4VN
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 05b407d953d3113b0bfda2f11fa1dd86cc5e4a9325e9ab8c5c98a05b8c5eda2c
MD5 bf42ae174141c534203716a4339914c7
SHA1 2f470c0b4a9bbcf2b509a6cc67bbcb7ed511ac24
SHA512 ea006bd00e57172eddf6fc47a0d9bad4a52cc39307f40fc07afa7b7aabf2d9b751d31870369d5b3c401045d523ba3948d3e7f9a5fe6e317f9b3fd9c69f3354ba
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzh:ObB2Xq/cmRq2B+4VN
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 b04cc3783c4041a107d8ca42ca7a0b8a46e9d207196ce0a7c681f67d6d282067
MD5 d08c096bf9239d820f344c5feb8e35f8
SHA1 5fdc6c31ee59bf9b38ba78f5f90c9e11354bcc53
SHA512 43c745f81103c319e2010240d69dadaadc9b5498d189f14549dc078206775a183b6e54f67e0b9ddcd878ff8d0b286c252b0910f9037546eb80fe69c0df81047c
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzp:ObB2Xq/cmRq2B+4Vl
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 b04cc3783c4041a107d8ca42ca7a0b8a46e9d207196ce0a7c681f67d6d282067
MD5 d08c096bf9239d820f344c5feb8e35f8
SHA1 5fdc6c31ee59bf9b38ba78f5f90c9e11354bcc53
SHA512 43c745f81103c319e2010240d69dadaadc9b5498d189f14549dc078206775a183b6e54f67e0b9ddcd878ff8d0b286c252b0910f9037546eb80fe69c0df81047c
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzp:ObB2Xq/cmRq2B+4Vl
MD5 SHA1 SHA512 SSDEEP

Submit Download

wuSbOW.dll

Path C:\Windows\System32\GsMlHVYdbPrNsZdB\wuSbOW.dll
Size 434KB
SHA256 10f055e9da8d91195b421c7d0115b5555d5347e94ec5d384dca663361f7e3778
MD5 44c91bd113fdd0a052f122acd635618b
SHA1 20156a544b22d006372d9160f5aee0418a515be1
SHA512 b4d761215d732be34061c08d0ef5a92b419966a2a915371fc83be271b7d024a3094135a17b35527fcf59374ac704657e4e2fc0e449922cf0fca1bf02243ecbe5
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzd:ObB2Xq/cmRq2B+4VR
MD5 SHA1 SHA512 SSDEEP

Submit Download

GmCsfBGQJ.dll

Path C:\Windows\System32\HcmrgoJkCTf\GmCsfBGQJ.dll
Size 434KB
SHA256 b04cc3783c4041a107d8ca42ca7a0b8a46e9d207196ce0a7c681f67d6d282067
MD5 d08c096bf9239d820f344c5feb8e35f8
SHA1 5fdc6c31ee59bf9b38ba78f5f90c9e11354bcc53
SHA512 43c745f81103c319e2010240d69dadaadc9b5498d189f14549dc078206775a183b6e54f67e0b9ddcd878ff8d0b286c252b0910f9037546eb80fe69c0df81047c
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzp:ObB2Xq/cmRq2B+4Vl
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdWWnNGCsi.dll

Path C:\Windows\System32\IJLjXGPwtqhkurf\mdWWnNGCsi.dll
Size 434KB
SHA256 c2cb2f4085150a7ddea8dec5ff306ea56c1c81a72c044ab0f7e9f611e6b3442d
MD5 0e3d240205748f064eaef52bc3471fea
SHA1 9eae50982fd022ec0ecc6cab49b725dc13d1a603
SHA512 89e97f290e9e79aeb0c0b96fee22ee5f4aa0ecf51b18b50ade2d07eb747dbc79cb9b7ef25eee2407138500f0043544eec334b1a66cbd6c7d5d627b12713d8a14
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzV:ObB2Xq/cmRq2B+4VJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hxqwHqnCfRZkrbeQ.dll

Path C:\Windows\System32\QUSfCVsHHA\hxqwHqnCfRZkrbeQ.dll
Size 434KB
SHA256 05b407d953d3113b0bfda2f11fa1dd86cc5e4a9325e9ab8c5c98a05b8c5eda2c
MD5 bf42ae174141c534203716a4339914c7
SHA1 2f470c0b4a9bbcf2b509a6cc67bbcb7ed511ac24
SHA512 ea006bd00e57172eddf6fc47a0d9bad4a52cc39307f40fc07afa7b7aabf2d9b751d31870369d5b3c401045d523ba3948d3e7f9a5fe6e317f9b3fd9c69f3354ba
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzh:ObB2Xq/cmRq2B+4VN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/544-142-0x0000000180000000-0x0000000180030000-memory.dmp

Download

memory/4384-138-0x00007FF925010000-0x00007FF925020000-memory.dmp

Download

memory/4384-136-0x00007FF927810000-0x00007FF927820000-memory.dmp

Download

memory/4384-137-0x00007FF925010000-0x00007FF925020000-memory.dmp

Download

memory/4384-135-0x00007FF927810000-0x00007FF927820000-memory.dmp

Download

memory/4384-134-0x00007FF927810000-0x00007FF927820000-memory.dmp

Download

memory/4384-132-0x00007FF927810000-0x00007FF927820000-memory.dmp

Download

memory/4384-133-0x00007FF927810000-0x00007FF927820000-memory.dmp

Download