emotet | bdc60ba4ecee2ab5de4d69144104a92b37ff8bf647c379c267dfd3bea62a785f

Analysis

max time kernel
149s
max time network
140s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
09/11/2022, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bdc60ba4ecee2ab5de4d69144104a92b37ff8bf647c379c267dfd3bea62a785f.xls
Size 91KB
Sample221109-vwc9aacdal
SHA256 bdc60ba4ecee2ab5de4d69144104a92b37ff8bf647c379c267dfd3bea62a785f
MD5 e885f4d009963ffbadd969ea58c7f24e
SHA1 b63362bb49643b49c7edfd0c7878daa6cb19d8d6
SHA512 32d9822d7aaa991046d6705c21cd2971b24cc0780996c9efd3ccee3f8a23485c753998268b0abc3f621a1633bd3fc026f3c3893d42bcf116fa1cc58d8f09de79
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2bCXuZH4gb4CEn9J4Zacvp:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://bundlefilm.com/headers/lkfBH3Czw9CjEW07P2/
xlm40.dropper
http://camsanparke.net/wp-content/h2Ja5bwB03hnyfCb/
xlm40.dropper
http://royreid.co.uk/wp-content/dCwG/
xlm40.dropper
https://cs.com.sg/admin/a1lR5wu/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5028	3064	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4996	3064	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4448	3064	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	600	3064	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
5028	regsvr32.exe
4996	regsvr32.exe
4448	regsvr32.exe
600	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iYwyTnyf.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\QNhdaVMtvPxbsnjQF\\iYwyTnyf.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xgSGqP.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\Igvre\\xgSGqP.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YMRHOpLNn.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\LVmCZp\\YMRHOpLNn.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XmOGsLRpBT.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\DRcFnjYegO\\XmOGsLRpBT.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3064	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5028	regsvr32.exe
5028	regsvr32.exe
2284	regsvr32.exe
2284	regsvr32.exe
4996	regsvr32.exe
4996	regsvr32.exe
2284	regsvr32.exe
2284	regsvr32.exe
4988	regsvr32.exe
4988	regsvr32.exe
4988	regsvr32.exe
4988	regsvr32.exe
4448	regsvr32.exe
4448	regsvr32.exe
5068	regsvr32.exe
5068	regsvr32.exe
5068	regsvr32.exe
5068	regsvr32.exe
600	regsvr32.exe
600	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe
1476	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3064	EXCEL.EXE
3064	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3064	EXCEL.EXE
3064	EXCEL.EXE
3064	EXCEL.EXE
3064	EXCEL.EXE
3064	EXCEL.EXE
3064	EXCEL.EXE
3064	EXCEL.EXE
3064	EXCEL.EXE
3064	EXCEL.EXE
3064	EXCEL.EXE
3064	EXCEL.EXE
3064	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 5028	3064	EXCEL.EXE	68
PID 3064 wrote to memory of 5028	3064	EXCEL.EXE	68
PID 5028 wrote to memory of 2284	5028	regsvr32.exe	70
PID 5028 wrote to memory of 2284	5028	regsvr32.exe	70
PID 3064 wrote to memory of 4996	3064	EXCEL.EXE	71
PID 3064 wrote to memory of 4996	3064	EXCEL.EXE	71
PID 4996 wrote to memory of 4988	4996	regsvr32.exe	72
PID 4996 wrote to memory of 4988	4996	regsvr32.exe	72
PID 3064 wrote to memory of 4448	3064	EXCEL.EXE	73
PID 3064 wrote to memory of 4448	3064	EXCEL.EXE	73
PID 4448 wrote to memory of 5068	4448	regsvr32.exe	74
PID 4448 wrote to memory of 5068	4448	regsvr32.exe	74
PID 3064 wrote to memory of 600	3064	EXCEL.EXE	75
PID 3064 wrote to memory of 600	3064	EXCEL.EXE	75
PID 600 wrote to memory of 1476	600	regsvr32.exe	76
PID 600 wrote to memory of 1476	600	regsvr32.exe	76

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\bdc60ba4ecee2ab5de4d69144104a92b37ff8bf647c379c267dfd3bea62a785f.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\LVmCZp\YMRHOpLNn.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2284
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DRcFnjYegO\XmOGsLRpBT.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4988
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QNhdaVMtvPxbsnjQF\iYwyTnyf.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:5068
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Igvre\xgSGqP.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 ae7ce4e31786a350226e1b7579452d08b303710832e45fdbaf693400007f321c
MD5 38a277c213cd54ab2ccbfb9aae51dd47
SHA1 4efe2907a2cde895b2a6d2e8009148c3002c4dc6
SHA512 21583714b9c4ce4adcd5fc1ac6fd9a3493b49fcfd92db4b86b94301fd3d930a0498592da652b3071c0ec7a189e6ff6d3293b737c2831e75ed1d2ca811fa74bb0
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzT:ObB2Xq/cmRq2B+4VH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 121d6a0c117738ef5eeb87476ba4e904b17e1a02cb231d8be084099a4a5952df
MD5 986abafe8ef90133e5f50cdf33a31381
SHA1 f27e610cb18ba942ef93f4bf27548f77394286ec
SHA512 8c3008f1a5cf7172cfb5055187b4d865cb125ac2a8dea9b4e6d8db1de0e03c17b6e5d570b8ba2746219f84475cc26682e6fcb38b53ed8ec28e688774ed13758a
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz2:ObB2Xq/cmRq2B+4Vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 57cba5d7b6b16c5e78b05561fd0c244d4b81eead3534399e1b145bf1e6102f3b
MD5 82a87297f76f463db207296a2953093b
SHA1 a33606db65f1aa96e70ff061ccb92e6367539477
SHA512 2f24c35017eeb32b47eb7820bfb224fb86dcfc6ceac4fea4f51018c2d4d510e7578baf02451a180d06ac9d159237217eebf28c53b5b11d51be9ea56418853bb9
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz6:ObB2Xq/cmRq2B+4Vm
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 9103cf4c45111e95ba573f83c42fba2340931bfbd9ecb6e00bc72d4d6296b836
MD5 e08d7167089bd126cfd16c7a26c65602
SHA1 93e86a39ff979ff578620ca3c2d9a8a75c214b67
SHA512 12f9deaef4536ae1adbbedc80fe9c90b8d785f7d0b29ad8f4093d8ff6d6594bac8a699a50b5b59bda64fa8df2824246613e2cfb2eaf7687fdcba7c96187bae34
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzu:ObB2Xq/cmRq2B+4VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path \Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 ae7ce4e31786a350226e1b7579452d08b303710832e45fdbaf693400007f321c
MD5 38a277c213cd54ab2ccbfb9aae51dd47
SHA1 4efe2907a2cde895b2a6d2e8009148c3002c4dc6
SHA512 21583714b9c4ce4adcd5fc1ac6fd9a3493b49fcfd92db4b86b94301fd3d930a0498592da652b3071c0ec7a189e6ff6d3293b737c2831e75ed1d2ca811fa74bb0
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzT:ObB2Xq/cmRq2B+4VH
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path \Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 121d6a0c117738ef5eeb87476ba4e904b17e1a02cb231d8be084099a4a5952df
MD5 986abafe8ef90133e5f50cdf33a31381
SHA1 f27e610cb18ba942ef93f4bf27548f77394286ec
SHA512 8c3008f1a5cf7172cfb5055187b4d865cb125ac2a8dea9b4e6d8db1de0e03c17b6e5d570b8ba2746219f84475cc26682e6fcb38b53ed8ec28e688774ed13758a
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz2:ObB2Xq/cmRq2B+4Vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path \Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 57cba5d7b6b16c5e78b05561fd0c244d4b81eead3534399e1b145bf1e6102f3b
MD5 82a87297f76f463db207296a2953093b
SHA1 a33606db65f1aa96e70ff061ccb92e6367539477
SHA512 2f24c35017eeb32b47eb7820bfb224fb86dcfc6ceac4fea4f51018c2d4d510e7578baf02451a180d06ac9d159237217eebf28c53b5b11d51be9ea56418853bb9
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz6:ObB2Xq/cmRq2B+4Vm
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path \Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 9103cf4c45111e95ba573f83c42fba2340931bfbd9ecb6e00bc72d4d6296b836
MD5 e08d7167089bd126cfd16c7a26c65602
SHA1 93e86a39ff979ff578620ca3c2d9a8a75c214b67
SHA512 12f9deaef4536ae1adbbedc80fe9c90b8d785f7d0b29ad8f4093d8ff6d6594bac8a699a50b5b59bda64fa8df2824246613e2cfb2eaf7687fdcba7c96187bae34
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzu:ObB2Xq/cmRq2B+4VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3064-133-0x00007FFD149C0000-0x00007FFD149D0000-memory.dmp

Download

memory/3064-120-0x00007FFD18360000-0x00007FFD18370000-memory.dmp

Download

memory/3064-132-0x00007FFD149C0000-0x00007FFD149D0000-memory.dmp

Download

memory/3064-123-0x00007FFD18360000-0x00007FFD18370000-memory.dmp

Download

memory/3064-122-0x00007FFD18360000-0x00007FFD18370000-memory.dmp

Download

memory/3064-121-0x00007FFD18360000-0x00007FFD18370000-memory.dmp

Download

memory/5028-257-0x0000000180000000-0x0000000180030000-memory.dmp

Download