emotet | 5bcaaf09ff44c5954eea03169880273a28bc3d23cf7658c0fe238397fbb14929

Analysis

max time kernel
150s
max time network
163s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
09/11/2022, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5bcaaf09ff44c5954eea03169880273a28bc3d23cf7658c0fe238397fbb14929.xls
Size 91KB
Sample221109-wk7t7acehm
SHA256 5bcaaf09ff44c5954eea03169880273a28bc3d23cf7658c0fe238397fbb14929
MD5 40b5b773a41e794b248515d3b425dbcb
SHA1 9c3b660d210e77ee1f4494b12494866cc00a4b78
SHA512 64faa53909f68aa92a5c3621b45bb7a7d2d35b3f8fb207d30b41aef99ecf88693ea5f8dee9fd9995eda0991c231b5a760520c2709d44b574bf7034473ced2b39
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZgEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/
xlm40.dropper
http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/
xlm40.dropper
https://wijsneusmedia.nl/cgi-bin/kFB/
xlm40.dropper
http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3132	4124	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5000	4124	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1440	4124	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1500	4124	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 3 IoCs

pid	Process
3132	regsvr32.exe
1440	regsvr32.exe
1500	regsvr32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vdNCFZKD.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\AzRNnrbMI\\vdNCFZKD.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vZwWfNFj.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\WgLjFHXaWwevy\\vZwWfNFj.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4124	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3132	regsvr32.exe
3132	regsvr32.exe
4864	regsvr32.exe
4864	regsvr32.exe
4864	regsvr32.exe
4864	regsvr32.exe
1440	regsvr32.exe
1440	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1712	regsvr32.exe
1500	regsvr32.exe
1500	regsvr32.exe
2312	regsvr32.exe
2312	regsvr32.exe
2312	regsvr32.exe
2312	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4124	EXCEL.EXE
4124	EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4124	EXCEL.EXE
4124	EXCEL.EXE
4124	EXCEL.EXE
4124	EXCEL.EXE
4124	EXCEL.EXE
4124	EXCEL.EXE
4124	EXCEL.EXE
4124	EXCEL.EXE
4124	EXCEL.EXE
4124	EXCEL.EXE
4124	EXCEL.EXE
4124	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 3132	4124	EXCEL.EXE	70
PID 4124 wrote to memory of 3132	4124	EXCEL.EXE	70
PID 3132 wrote to memory of 4864	3132	regsvr32.exe	72
PID 3132 wrote to memory of 4864	3132	regsvr32.exe	72
PID 4124 wrote to memory of 5000	4124	EXCEL.EXE	73
PID 4124 wrote to memory of 5000	4124	EXCEL.EXE	73
PID 4124 wrote to memory of 1440	4124	EXCEL.EXE	76
PID 4124 wrote to memory of 1440	4124	EXCEL.EXE	76
PID 1440 wrote to memory of 1712	1440	regsvr32.exe	77
PID 1440 wrote to memory of 1712	1440	regsvr32.exe	77
PID 4124 wrote to memory of 1500	4124	EXCEL.EXE	78
PID 4124 wrote to memory of 1500	4124	EXCEL.EXE	78
PID 1500 wrote to memory of 2312	1500	regsvr32.exe	80
PID 1500 wrote to memory of 2312	1500	regsvr32.exe	80

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\5bcaaf09ff44c5954eea03169880273a28bc3d23cf7658c0fe238397fbb14929.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WgLjFHXaWwevy\vZwWfNFj.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4864
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:5000
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZvfKfyQaapAksAfo\AzKLTLOxQPafk.dll"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1712
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AzRNnrbMI\vdNCFZKD.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Size 61KB
SHA256 40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1
MD5 3dcf580a93972319e82cafbc047d34d5
SHA1 8528d2a1363e5de77dc3b1142850e51ead0f4b6b
SHA512 98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42
SSDEEP 1536:d+OfVxHl7Wyf11lYom3xQcRVOtPHwQV4rP6Ji7:d+OxHxJlZcuPt4b6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Size 61KB
SHA256 40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1
MD5 3dcf580a93972319e82cafbc047d34d5
SHA1 8528d2a1363e5de77dc3b1142850e51ead0f4b6b
SHA512 98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42
SSDEEP 1536:d+OfVxHl7Wyf11lYom3xQcRVOtPHwQV4rP6Ji7:d+OxHxJlZcuPt4b6q
MD5 SHA1 SHA512 SSDEEP

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 fd3181cdb9020049e1994b1d5ca893b704580cace9f8be0e3951c8e372f13a3b
MD5 96e99a42e333d097670e884878b1bc58
SHA1 542008f9e7059cab7ed46a1d41e61c4bb2d06fec
SHA512 fdf814e5c99ffe261796b89cc6fb052395e4857cedcabaedb519fc82912a634ee51fb15da3c424cd274c1dd3d3e0434da804f0b73ebd3741f5ca3bb34b982cbe
MD5 SHA1 SHA512

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 ebe756756575e4d17fc01bc6edaccfc7c401ccc0842af9b7fbf923425c1a6fc2
MD5 5e78a843d2a7e9164cb24e3eea0134dc
SHA1 36cc350204ab407603da8b1029f980162af2c156
SHA512 b2203d98f69258c787460371917c5f8b88ba3ce1916c0392ecfd5fb5f7abc0a76408f30cc92dfc3633afb7634824843131dac70180d816a73c1e6811c48c165d
MD5 SHA1 SHA512

Submit Download

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 8ec8b43c05aab5322350b3fc9aa494a21888a75483d4045a6acd60d3aec2dbbb
MD5 f500e1c68c7e56bcde533bdf056c3bb6
SHA1 063dd8eba8d03900908b63b2c301c7d47bc2dfa8
SHA512 d730181e81cf52063b57bcbcabf0ab645f7a66508dd654ea362d6f0d5e4e7dffed021c78b6c1ab07e27192d8b5600aa50e79a4191fe438b616dc4b880fd3f6ed
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzl:ObB2Xq/cmRq2B+4VJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 2106f04f97ab9a01799a215cdfd41c63ab5dbb8b2115f215c16b3a552278e5e1
MD5 3bf79f71d78a391064a714a01e1e8bbc
SHA1 11d86918531cc6c2c6a22f145af8e9019fe87787
SHA512 99b92872826e0c92ceed52c714e55dbb2331c1ab7de11a284fcdb1e6ea353027d6f9446b830b598d1a5d021e3f77e48a5b9bd274476670982215053323ca4901
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzb:ObB2Xq/cmRq2B+4Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 639d41e9fac859f2355ade27674169d776af83ad7bf36e05b64ee5e50bf67aff
MD5 08219c406788974431eb7f60dfd5ec13
SHA1 b6aeee04d02316931d551ddbc2fa6cf37aedc6aa
SHA512 beaece25c5106552bde7e779d074eb41d951d6f35b4b9dc9b061e66d68da98954616205d3c3573d7a571b6850265e0741cb1148c2825ca222cb4680a45f1df53
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz8:ObB2Xq/cmRq2B+4Vo
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path \Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 8ec8b43c05aab5322350b3fc9aa494a21888a75483d4045a6acd60d3aec2dbbb
MD5 f500e1c68c7e56bcde533bdf056c3bb6
SHA1 063dd8eba8d03900908b63b2c301c7d47bc2dfa8
SHA512 d730181e81cf52063b57bcbcabf0ab645f7a66508dd654ea362d6f0d5e4e7dffed021c78b6c1ab07e27192d8b5600aa50e79a4191fe438b616dc4b880fd3f6ed
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzl:ObB2Xq/cmRq2B+4VJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path \Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 2106f04f97ab9a01799a215cdfd41c63ab5dbb8b2115f215c16b3a552278e5e1
MD5 3bf79f71d78a391064a714a01e1e8bbc
SHA1 11d86918531cc6c2c6a22f145af8e9019fe87787
SHA512 99b92872826e0c92ceed52c714e55dbb2331c1ab7de11a284fcdb1e6ea353027d6f9446b830b598d1a5d021e3f77e48a5b9bd274476670982215053323ca4901
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzb:ObB2Xq/cmRq2B+4Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path \Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 639d41e9fac859f2355ade27674169d776af83ad7bf36e05b64ee5e50bf67aff
MD5 08219c406788974431eb7f60dfd5ec13
SHA1 b6aeee04d02316931d551ddbc2fa6cf37aedc6aa
SHA512 beaece25c5106552bde7e779d074eb41d951d6f35b4b9dc9b061e66d68da98954616205d3c3573d7a571b6850265e0741cb1148c2825ca222cb4680a45f1df53
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz8:ObB2Xq/cmRq2B+4Vo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3132-256-0x0000000180000000-0x0000000180030000-memory.dmp

Download

memory/4124-128-0x00007FFCE52B0000-0x00007FFCE52C0000-memory.dmp

Download

memory/4124-116-0x00007FFCE8030000-0x00007FFCE8040000-memory.dmp

Download

memory/4124-129-0x00007FFCE52B0000-0x00007FFCE52C0000-memory.dmp

Download

memory/4124-119-0x00007FFCE8030000-0x00007FFCE8040000-memory.dmp

Download

memory/4124-118-0x00007FFCE8030000-0x00007FFCE8040000-memory.dmp

Download

memory/4124-117-0x00007FFCE8030000-0x00007FFCE8040000-memory.dmp

Download

memory/4124-333-0x00007FFCE8030000-0x00007FFCE8040000-memory.dmp

Download

memory/4124-334-0x00007FFCE8030000-0x00007FFCE8040000-memory.dmp

Download

memory/4124-335-0x00007FFCE8030000-0x00007FFCE8040000-memory.dmp

Download

memory/4124-336-0x00007FFCE8030000-0x00007FFCE8040000-memory.dmp

Download