emotet | c37e23c5d72ed93701fdc11010ba1aa6b7e6cb910e52b6053b1512fe072a7f33

Analysis

max time kernel
150s
max time network
139s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
09/11/2022, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c37e23c5d72ed93701fdc11010ba1aa6b7e6cb910e52b6053b1512fe072a7f33.xls
Size 91KB
Sample221109-vyvlcaagb8
SHA256 c37e23c5d72ed93701fdc11010ba1aa6b7e6cb910e52b6053b1512fe072a7f33
MD5 8842e281aa80fd05253b6c515ad3550a
SHA1 a89ab70a79fe4fe0ec80a3d70792bdc267ca58d4
SHA512 0658703235d48c94fd37d454437858a43ebf727c23829c3a2099d597f806b50d9926f79a5a789203097425e060fd231a1a2fb2e8f5f46f96199df0a802b00e94
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZsEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/
xlm40.dropper
http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/
xlm40.dropper
https://wijsneusmedia.nl/cgi-bin/kFB/
xlm40.dropper
http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5108	4796	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4648	4796	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3740	4796	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4772	4796	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
5108	regsvr32.exe
4648	regsvr32.exe
3740	regsvr32.exe
4772	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NfFqolcwNWuBd.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\ReOUsaav\\NfFqolcwNWuBd.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cGKf.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\YurxwAM\\cGKf.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\anFvpUZXrH.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\TWJnmrkRxjzEN\\anFvpUZXrH.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xZQMbCgXnRx.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\NgJdtkumQ\\xZQMbCgXnRx.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4796	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5108	regsvr32.exe
5108	regsvr32.exe
4672	regsvr32.exe
4672	regsvr32.exe
4672	regsvr32.exe
4672	regsvr32.exe
4648	regsvr32.exe
4648	regsvr32.exe
4724	regsvr32.exe
4724	regsvr32.exe
3740	regsvr32.exe
3740	regsvr32.exe
4724	regsvr32.exe
4724	regsvr32.exe
4696	regsvr32.exe
4696	regsvr32.exe
4696	regsvr32.exe
4696	regsvr32.exe
4772	regsvr32.exe
4772	regsvr32.exe
1056	regsvr32.exe
1056	regsvr32.exe
1056	regsvr32.exe
1056	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4796	EXCEL.EXE
4796	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4796	EXCEL.EXE
4796	EXCEL.EXE
4796	EXCEL.EXE
4796	EXCEL.EXE
4796	EXCEL.EXE
4796	EXCEL.EXE
4796	EXCEL.EXE
4796	EXCEL.EXE
4796	EXCEL.EXE
4796	EXCEL.EXE
4796	EXCEL.EXE
4796	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 5108	4796	EXCEL.EXE	68
PID 4796 wrote to memory of 5108	4796	EXCEL.EXE	68
PID 5108 wrote to memory of 4672	5108	regsvr32.exe	70
PID 5108 wrote to memory of 4672	5108	regsvr32.exe	70
PID 4796 wrote to memory of 4648	4796	EXCEL.EXE	71
PID 4796 wrote to memory of 4648	4796	EXCEL.EXE	71
PID 4648 wrote to memory of 4724	4648	regsvr32.exe	72
PID 4648 wrote to memory of 4724	4648	regsvr32.exe	72
PID 4796 wrote to memory of 3740	4796	EXCEL.EXE	73
PID 4796 wrote to memory of 3740	4796	EXCEL.EXE	73
PID 3740 wrote to memory of 4696	3740	regsvr32.exe	74
PID 3740 wrote to memory of 4696	3740	regsvr32.exe	74
PID 4796 wrote to memory of 4772	4796	EXCEL.EXE	75
PID 4796 wrote to memory of 4772	4796	EXCEL.EXE	75
PID 4772 wrote to memory of 1056	4772	regsvr32.exe	76
PID 4772 wrote to memory of 1056	4772	regsvr32.exe	76

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c37e23c5d72ed93701fdc11010ba1aa6b7e6cb910e52b6053b1512fe072a7f33.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TWJnmrkRxjzEN\anFvpUZXrH.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4672
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NgJdtkumQ\xZQMbCgXnRx.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4724
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ReOUsaav\NfFqolcwNWuBd.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4696
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\YurxwAM\cGKf.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 fdae0c53195e2c8cc2cda7ff499a427503a504856fe730d038de99fb671c7a40
MD5 d17a159f47a217723193730a3eeb6507
SHA1 87cdb977938f01569643cd1fd488bfc031e6e075
SHA512 5719c2b66178f02a9555ebeeae4e0d1b2ae0357945c67515957c870baf0564c49d635e5f957ac435fede8f9e1cef9eee4e7d31a5c85c0b1e998bc2fbc26b82c6
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzx:ObB2Xq/cmRq2B+4Vt
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 6b11ddd512522acd60fe1f324b0bea33f1fa27139739eada489abd7352965440
MD5 a7a63efa61dc45ca516d89aa31810450
SHA1 fe84ae81ed49e5fb3ebd6cac2f1737591da3d1b6
SHA512 56d58cff63264cfa2135664308dc71cfa631959f4bfa12ec75cea87479b735a66ed38276898bf85eda58f6c1f0591fa4a396b8edffc986c31871af2ff488b845
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzF:ObB2Xq/cmRq2B+4VR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 fdcd378839d0b8b5f43f69671261c8103022c809d61cf5b365405c34b43e0ca6
MD5 7b361631b6a15ea76da3740842f449fa
SHA1 2b3fdc2d4e1aafeeca92067099056f0384cdd97b
SHA512 0c23b696b8d37b87f66fc7b9203d84c890c8adbab665c680250a0fc3999c55246b4adeb9c1d084273b5deb5a3545ae6e0b240816718f5636586e15b8a4475714
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzV:ObB2Xq/cmRq2B+4VB
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 f7fd1f0d3cb46a0801715071a0803ded84df3ac085c8100c4decc00e25f3b05c
MD5 ebc1c225b95eda0a75b27b1681cf3e3b
SHA1 ea913ae4055e0859ac708811537063971a83fe4c
SHA512 c9a07de8ca9f57ef0f251c18ec61c2414bc5130379107379238dc63dbf35791b224ac5b2cd539a44a7fe5112c420b2868a07d3ae9abbd89c635f97054eaa7776
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz6:ObB2Xq/cmRq2B+4Vm
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path \Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 fdae0c53195e2c8cc2cda7ff499a427503a504856fe730d038de99fb671c7a40
MD5 d17a159f47a217723193730a3eeb6507
SHA1 87cdb977938f01569643cd1fd488bfc031e6e075
SHA512 5719c2b66178f02a9555ebeeae4e0d1b2ae0357945c67515957c870baf0564c49d635e5f957ac435fede8f9e1cef9eee4e7d31a5c85c0b1e998bc2fbc26b82c6
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzx:ObB2Xq/cmRq2B+4Vt
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path \Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 6b11ddd512522acd60fe1f324b0bea33f1fa27139739eada489abd7352965440
MD5 a7a63efa61dc45ca516d89aa31810450
SHA1 fe84ae81ed49e5fb3ebd6cac2f1737591da3d1b6
SHA512 56d58cff63264cfa2135664308dc71cfa631959f4bfa12ec75cea87479b735a66ed38276898bf85eda58f6c1f0591fa4a396b8edffc986c31871af2ff488b845
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzF:ObB2Xq/cmRq2B+4VR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path \Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 fdcd378839d0b8b5f43f69671261c8103022c809d61cf5b365405c34b43e0ca6
MD5 7b361631b6a15ea76da3740842f449fa
SHA1 2b3fdc2d4e1aafeeca92067099056f0384cdd97b
SHA512 0c23b696b8d37b87f66fc7b9203d84c890c8adbab665c680250a0fc3999c55246b4adeb9c1d084273b5deb5a3545ae6e0b240816718f5636586e15b8a4475714
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzV:ObB2Xq/cmRq2B+4VB
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path \Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 f7fd1f0d3cb46a0801715071a0803ded84df3ac085c8100c4decc00e25f3b05c
MD5 ebc1c225b95eda0a75b27b1681cf3e3b
SHA1 ea913ae4055e0859ac708811537063971a83fe4c
SHA512 c9a07de8ca9f57ef0f251c18ec61c2414bc5130379107379238dc63dbf35791b224ac5b2cd539a44a7fe5112c420b2868a07d3ae9abbd89c635f97054eaa7776
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz6:ObB2Xq/cmRq2B+4Vm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4796-120-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmp

Download

memory/4796-133-0x00007FFD9DD80000-0x00007FFD9DD90000-memory.dmp

Download

memory/4796-132-0x00007FFD9DD80000-0x00007FFD9DD90000-memory.dmp

Download

memory/4796-123-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmp

Download

memory/4796-122-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmp

Download

memory/4796-121-0x00007FFDA1840000-0x00007FFDA1850000-memory.dmp

Download

memory/5108-260-0x0000000180000000-0x0000000180030000-memory.dmp

Download