emotet | d3e8995eee55343adfb95958d9fc77ceac88308a086c2c6b6fd7e9a95b91124e

Analysis

max time kernel
163s
max time network
187s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
09/11/2022, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3e8995eee55343adfb95958d9fc77ceac88308a086c2c6b6fd7e9a95b91124e.xls
Size 91KB
Sample221109-vmzqxsafe2
SHA256 d3e8995eee55343adfb95958d9fc77ceac88308a086c2c6b6fd7e9a95b91124e
MD5 8b963a68f2793032da3ca336a71051de
SHA1 4ba8a8c2fc83ed63d19aa97c73bf361003beb3b3
SHA512 c7bd2b90f3f420098dfdeae17678576766fa012ec4fb9cc342907fb8b5fdeb5afe43a313912226f70fd177bf4a7e3de78c1dcae401c7e403790dc54f09849ad8
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZwEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/
xlm40.dropper
http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/
xlm40.dropper
https://wijsneusmedia.nl/cgi-bin/kFB/
xlm40.dropper
http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4372	3772	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4552	3772	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1144	3772	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1636	3772	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
4372	regsvr32.exe
4552	regsvr32.exe
1144	regsvr32.exe
1636	regsvr32.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zbQJePhpPdeSa.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\KtoneGQ\\zbQJePhpPdeSa.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oHZFCwzCIQB.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\FZUppQwUcrfnZFwJ\\oHZFCwzCIQB.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qYqyT.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\VzyXugk\\qYqyT.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3772	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4372	regsvr32.exe
4372	regsvr32.exe
4712	regsvr32.exe
4712	regsvr32.exe
4712	regsvr32.exe
4712	regsvr32.exe
4552	regsvr32.exe
4552	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
4728	regsvr32.exe
1144	regsvr32.exe
1144	regsvr32.exe
1344	regsvr32.exe
1344	regsvr32.exe
1344	regsvr32.exe
1344	regsvr32.exe
1636	regsvr32.exe
1636	regsvr32.exe
2228	regsvr32.exe
2228	regsvr32.exe
2228	regsvr32.exe
2228	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3772	EXCEL.EXE
3772	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3772	EXCEL.EXE
3772	EXCEL.EXE
3772	EXCEL.EXE
3772	EXCEL.EXE
3772	EXCEL.EXE
3772	EXCEL.EXE
3772	EXCEL.EXE
3772	EXCEL.EXE
3772	EXCEL.EXE
3772	EXCEL.EXE
3772	EXCEL.EXE
3772	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 4372	3772	EXCEL.EXE	70
PID 3772 wrote to memory of 4372	3772	EXCEL.EXE	70
PID 4372 wrote to memory of 4712	4372	regsvr32.exe	74
PID 4372 wrote to memory of 4712	4372	regsvr32.exe	74
PID 3772 wrote to memory of 4552	3772	EXCEL.EXE	75
PID 3772 wrote to memory of 4552	3772	EXCEL.EXE	75
PID 4552 wrote to memory of 4728	4552	regsvr32.exe	76
PID 4552 wrote to memory of 4728	4552	regsvr32.exe	76
PID 3772 wrote to memory of 1144	3772	EXCEL.EXE	77
PID 3772 wrote to memory of 1144	3772	EXCEL.EXE	77
PID 1144 wrote to memory of 1344	1144	regsvr32.exe	78
PID 1144 wrote to memory of 1344	1144	regsvr32.exe	78
PID 3772 wrote to memory of 1636	3772	EXCEL.EXE	79
PID 3772 wrote to memory of 1636	3772	EXCEL.EXE	79
PID 1636 wrote to memory of 2228	1636	regsvr32.exe	80
PID 1636 wrote to memory of 2228	1636	regsvr32.exe	80

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d3e8995eee55343adfb95958d9fc77ceac88308a086c2c6b6fd7e9a95b91124e.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KtoneGQ\zbQJePhpPdeSa.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4712
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WEoSsIMPoSiF\EXahNOwOsxba.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4728
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VzyXugk\qYqyT.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1344
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FZUppQwUcrfnZFwJ\oHZFCwzCIQB.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 10f055e9da8d91195b421c7d0115b5555d5347e94ec5d384dca663361f7e3778
MD5 44c91bd113fdd0a052f122acd635618b
SHA1 20156a544b22d006372d9160f5aee0418a515be1
SHA512 b4d761215d732be34061c08d0ef5a92b419966a2a915371fc83be271b7d024a3094135a17b35527fcf59374ac704657e4e2fc0e449922cf0fca1bf02243ecbe5
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzd:ObB2Xq/cmRq2B+4VR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 31100701bdec93f070a4d641b8fe74fd224155b7e3e27e92c351564e20d0ee5b
MD5 b13bb0abf61595b17ca6b75027a59786
SHA1 e5f9db7926c3b92568b05a70c9afac74c5e34436
SHA512 4d588db712c2bdfb645496202a7f9d24905c368a8009e9369e5bca0582b9555c56cc6ecf3c62d05cbad7bb5b720158d295c62f63f5ad406e35dd134c552aaf9b
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzp:ObB2Xq/cmRq2B+4VN
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 6fc01c0253d9e9dca43d6b065a66ab7052abb39ceccfbf69eccbad0b70229650
MD5 cb846fe5641d305101a4368ecf2a6379
SHA1 cc9763e48989c5254af32bcdc953f4c17d5b5516
SHA512 00442c4cac533cd36d35e15040599b8d00e98290977b50cf6e8653b09d664302e05279d5b54bba6d4c7c0d3bcd0d596c5e3443f1f331b9597cef9989c1345be5
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzH:ObB2Xq/cmRq2B+4Vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 b04cc3783c4041a107d8ca42ca7a0b8a46e9d207196ce0a7c681f67d6d282067
MD5 d08c096bf9239d820f344c5feb8e35f8
SHA1 5fdc6c31ee59bf9b38ba78f5f90c9e11354bcc53
SHA512 43c745f81103c319e2010240d69dadaadc9b5498d189f14549dc078206775a183b6e54f67e0b9ddcd878ff8d0b286c252b0910f9037546eb80fe69c0df81047c
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzp:ObB2Xq/cmRq2B+4Vl
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path \Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 10f055e9da8d91195b421c7d0115b5555d5347e94ec5d384dca663361f7e3778
MD5 44c91bd113fdd0a052f122acd635618b
SHA1 20156a544b22d006372d9160f5aee0418a515be1
SHA512 b4d761215d732be34061c08d0ef5a92b419966a2a915371fc83be271b7d024a3094135a17b35527fcf59374ac704657e4e2fc0e449922cf0fca1bf02243ecbe5
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzd:ObB2Xq/cmRq2B+4VR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path \Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 31100701bdec93f070a4d641b8fe74fd224155b7e3e27e92c351564e20d0ee5b
MD5 b13bb0abf61595b17ca6b75027a59786
SHA1 e5f9db7926c3b92568b05a70c9afac74c5e34436
SHA512 4d588db712c2bdfb645496202a7f9d24905c368a8009e9369e5bca0582b9555c56cc6ecf3c62d05cbad7bb5b720158d295c62f63f5ad406e35dd134c552aaf9b
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzp:ObB2Xq/cmRq2B+4VN
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path \Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 6fc01c0253d9e9dca43d6b065a66ab7052abb39ceccfbf69eccbad0b70229650
MD5 cb846fe5641d305101a4368ecf2a6379
SHA1 cc9763e48989c5254af32bcdc953f4c17d5b5516
SHA512 00442c4cac533cd36d35e15040599b8d00e98290977b50cf6e8653b09d664302e05279d5b54bba6d4c7c0d3bcd0d596c5e3443f1f331b9597cef9989c1345be5
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzH:ObB2Xq/cmRq2B+4Vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path \Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 b04cc3783c4041a107d8ca42ca7a0b8a46e9d207196ce0a7c681f67d6d282067
MD5 d08c096bf9239d820f344c5feb8e35f8
SHA1 5fdc6c31ee59bf9b38ba78f5f90c9e11354bcc53
SHA512 43c745f81103c319e2010240d69dadaadc9b5498d189f14549dc078206775a183b6e54f67e0b9ddcd878ff8d0b286c252b0910f9037546eb80fe69c0df81047c
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzp:ObB2Xq/cmRq2B+4Vl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3772-118-0x00007FF851770000-0x00007FF851780000-memory.dmp

Download

memory/3772-334-0x00007FF851770000-0x00007FF851780000-memory.dmp

Download

memory/3772-337-0x00007FF851770000-0x00007FF851780000-memory.dmp

Download

memory/3772-131-0x00007FF84DFE0000-0x00007FF84DFF0000-memory.dmp

Download

memory/3772-130-0x00007FF84DFE0000-0x00007FF84DFF0000-memory.dmp

Download

memory/3772-121-0x00007FF851770000-0x00007FF851780000-memory.dmp

Download

memory/3772-336-0x00007FF851770000-0x00007FF851780000-memory.dmp

Download

memory/3772-335-0x00007FF851770000-0x00007FF851780000-memory.dmp

Download

memory/3772-120-0x00007FF851770000-0x00007FF851780000-memory.dmp

Download

memory/3772-119-0x00007FF851770000-0x00007FF851780000-memory.dmp

Download

memory/4372-258-0x0000000180000000-0x0000000180030000-memory.dmp

Download