emotet | ecde4954ce5a3bf8bf76b66005218084f670b6406d276e58688523e7b10d9b0f

Analysis

max time kernel
148s
max time network
140s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
09/11/2022, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ecde4954ce5a3bf8bf76b66005218084f670b6406d276e58688523e7b10d9b0f.xls
Size 91KB
Sample221109-wec3maceej
SHA256 ecde4954ce5a3bf8bf76b66005218084f670b6406d276e58688523e7b10d9b0f
MD5 24c9471ef8ca7f4acfbac2ba476cb479
SHA1 31ee92bfd42e2c9e675726f215d7e08fb9561d3c
SHA512 fb9c29d1126eb8e940ceca0f49142840aec14ba2b3bfae7427f92ddfbfccb8e5fd7de29869f3664c8666d5e40dd6b48d9d91ed7fcd05b7e7f59fc1572d711f04
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2bCXuZH4gb4CEn9J4Zmcvp:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://bundlefilm.com/headers/lkfBH3Czw9CjEW07P2/
xlm40.dropper
http://camsanparke.net/wp-content/h2Ja5bwB03hnyfCb/
xlm40.dropper
http://royreid.co.uk/wp-content/dCwG/
xlm40.dropper
https://cs.com.sg/admin/a1lR5wu/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4860	3048	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4932	3048	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3644	3048	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	400	3048	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
4860	regsvr32.exe
4932	regsvr32.exe
3644	regsvr32.exe
400	regsvr32.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WlVAjwighx.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\CZznXeemPGzgwS\\WlVAjwighx.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsOMW.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\TyuHLssnSDMCTj\\lsOMW.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MdFqgfsgZnWDKJ.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\JUycjq\\MdFqgfsgZnWDKJ.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\btVrMyS.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\RmbPijq\\btVrMyS.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3048	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4860	regsvr32.exe
4860	regsvr32.exe
3968	regsvr32.exe
3968	regsvr32.exe
4932	regsvr32.exe
4932	regsvr32.exe
3968	regsvr32.exe
3968	regsvr32.exe
4808	regsvr32.exe
4808	regsvr32.exe
4808	regsvr32.exe
4808	regsvr32.exe
3644	regsvr32.exe
3644	regsvr32.exe
1696	regsvr32.exe
1696	regsvr32.exe
1696	regsvr32.exe
1696	regsvr32.exe
400	regsvr32.exe
400	regsvr32.exe
1276	regsvr32.exe
1276	regsvr32.exe
1276	regsvr32.exe
1276	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3048	EXCEL.EXE
3048	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE
3048	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4860	3048	EXCEL.EXE	68
PID 3048 wrote to memory of 4860	3048	EXCEL.EXE	68
PID 4860 wrote to memory of 3968	4860	regsvr32.exe	70
PID 4860 wrote to memory of 3968	4860	regsvr32.exe	70
PID 3048 wrote to memory of 4932	3048	EXCEL.EXE	71
PID 3048 wrote to memory of 4932	3048	EXCEL.EXE	71
PID 4932 wrote to memory of 4808	4932	regsvr32.exe	72
PID 4932 wrote to memory of 4808	4932	regsvr32.exe	72
PID 3048 wrote to memory of 3644	3048	EXCEL.EXE	73
PID 3048 wrote to memory of 3644	3048	EXCEL.EXE	73
PID 3644 wrote to memory of 1696	3644	regsvr32.exe	74
PID 3644 wrote to memory of 1696	3644	regsvr32.exe	74
PID 3048 wrote to memory of 400	3048	EXCEL.EXE	75
PID 3048 wrote to memory of 400	3048	EXCEL.EXE	75
PID 400 wrote to memory of 1276	400	regsvr32.exe	76
PID 400 wrote to memory of 1276	400	regsvr32.exe	76

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ecde4954ce5a3bf8bf76b66005218084f670b6406d276e58688523e7b10d9b0f.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CZznXeemPGzgwS\WlVAjwighx.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3968
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TyuHLssnSDMCTj\lsOMW.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4808
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JUycjq\MdFqgfsgZnWDKJ.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1696
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RmbPijq\btVrMyS.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 6b7960465c82610ed19d5542f8938c47116f3d15f6fb26afe999a579fe42e70e
MD5 2b01afff93eb3ac8ef044330952bb449
SHA1 041971195e4e346114ca70bafd3e2037868d7b33
SHA512 c0e0141875a374f845f69504c720deaddf472a276685cf1d77f983809fd91ec03f643a3ab89e9d3b32457af9eb96dce1fe277bae9745656971e11edd1d5e4f42
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzn:ObB2Xq/cmRq2B+4VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 507484687dc668e9f85d82c72c4265454e960a43bb06251c5c9f05120fce228b
MD5 b4615208e738afb3570067c1718f87b6
SHA1 a183c17279422c283adfa181fb4d6ae22c9dc7b4
SHA512 63f8bd0b1e79eb1a24242f9eadf2d9c46c713ae7f3f0a5625cb99eff82deee09a1cfa5d97fc6e6ed6f829131e3497331292d439d11537f2d239ef33a4b0c5dc8
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz1:ObB2Xq/cmRq2B+4VR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 ef799bc3753c2b38ef45bd3ac1852230eff22e3db5053f8756b457e3450ed724
MD5 6f81ce384f4e430fdf5bed2f1e0c331b
SHA1 16b074a8464f927f514543099bf3c1fd26da41da
SHA512 ba39d08930b660362b8064d050bf9ce0e04eafaaba2d252facd665565840b5fa9051c76ebbba2640e3d60e0db3b409ffe59c617dfc66400049e86df9c4e9ffdf
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzn:ObB2Xq/cmRq2B+4Vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 f07f2fbc4a13c007b92c6e5f3b384b5d0fdaeab53f1bf244e0cb91eeecba3932
MD5 c5ba8ada0d7e0bc3f618dcab8c7ac327
SHA1 fdfaba9b8194e65562f282bd8b17837cbd7da8f4
SHA512 1cf4b9ce5495e0d01b62318f1ac61e895683ff13aa3993947b7d5e7aeeb69d2d189bc6a206c44fe6579b0ef9f6458173ca624b0fc042b6808095e263fc213057
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzW:ObB2Xq/cmRq2B+4VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path \Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 6b7960465c82610ed19d5542f8938c47116f3d15f6fb26afe999a579fe42e70e
MD5 2b01afff93eb3ac8ef044330952bb449
SHA1 041971195e4e346114ca70bafd3e2037868d7b33
SHA512 c0e0141875a374f845f69504c720deaddf472a276685cf1d77f983809fd91ec03f643a3ab89e9d3b32457af9eb96dce1fe277bae9745656971e11edd1d5e4f42
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzn:ObB2Xq/cmRq2B+4VT
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path \Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 507484687dc668e9f85d82c72c4265454e960a43bb06251c5c9f05120fce228b
MD5 b4615208e738afb3570067c1718f87b6
SHA1 a183c17279422c283adfa181fb4d6ae22c9dc7b4
SHA512 63f8bd0b1e79eb1a24242f9eadf2d9c46c713ae7f3f0a5625cb99eff82deee09a1cfa5d97fc6e6ed6f829131e3497331292d439d11537f2d239ef33a4b0c5dc8
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz1:ObB2Xq/cmRq2B+4VR
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path \Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 ef799bc3753c2b38ef45bd3ac1852230eff22e3db5053f8756b457e3450ed724
MD5 6f81ce384f4e430fdf5bed2f1e0c331b
SHA1 16b074a8464f927f514543099bf3c1fd26da41da
SHA512 ba39d08930b660362b8064d050bf9ce0e04eafaaba2d252facd665565840b5fa9051c76ebbba2640e3d60e0db3b409ffe59c617dfc66400049e86df9c4e9ffdf
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzn:ObB2Xq/cmRq2B+4Vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path \Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 f07f2fbc4a13c007b92c6e5f3b384b5d0fdaeab53f1bf244e0cb91eeecba3932
MD5 c5ba8ada0d7e0bc3f618dcab8c7ac327
SHA1 fdfaba9b8194e65562f282bd8b17837cbd7da8f4
SHA512 1cf4b9ce5495e0d01b62318f1ac61e895683ff13aa3993947b7d5e7aeeb69d2d189bc6a206c44fe6579b0ef9f6458173ca624b0fc042b6808095e263fc213057
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4XlzW:ObB2Xq/cmRq2B+4VK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3048-130-0x00007FFED41A0000-0x00007FFED41B0000-memory.dmp

Download

memory/3048-129-0x00007FFED41A0000-0x00007FFED41B0000-memory.dmp

Download

memory/3048-120-0x00007FFED6D40000-0x00007FFED6D50000-memory.dmp

Download

memory/3048-119-0x00007FFED6D40000-0x00007FFED6D50000-memory.dmp

Download

memory/3048-117-0x00007FFED6D40000-0x00007FFED6D50000-memory.dmp

Download

memory/3048-118-0x00007FFED6D40000-0x00007FFED6D50000-memory.dmp

Download

memory/4860-254-0x0000000180000000-0x0000000180030000-memory.dmp

Download