emotet | 7c770b145f142724d5456c26af22c7ad87406f2246faeeee0919a67edbb2b4dd

Analysis

max time kernel
148s
max time network
155s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
09/11/2022, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c770b145f142724d5456c26af22c7ad87406f2246faeeee0919a67edbb2b4dd.xls
Size 91KB
Sample221109-wmprdsbaa3
SHA256 7c770b145f142724d5456c26af22c7ad87406f2246faeeee0919a67edbb2b4dd
MD5 645602ce81a8e4998e1e13c39310a1af
SHA1 f622d8767ea2d0a6149136eb153eff871a113a96
SHA512 7a9d9872ffdec9aa76010de6c97215ffb840bf8f0bd4c9d2ce852c2e18431c8c9300b62b9ec054322385eb544ec7a33390608ff081056c30d369a0ddda039e0e
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZwEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/
xlm40.dropper
http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/
xlm40.dropper
https://wijsneusmedia.nl/cgi-bin/kFB/
xlm40.dropper
http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3724	2668	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1020	2668	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	60	2668	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	220	2668	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 3 IoCs

pid	Process
3724	regsvr32.exe
60	regsvr32.exe
220	regsvr32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IcZTnWb.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\NCtiuXd\\IcZTnWb.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iGRrPw.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\PwEqhgHOeCGdf\\iGRrPw.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2668	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3724	regsvr32.exe
3724	regsvr32.exe
4928	regsvr32.exe
4928	regsvr32.exe
4928	regsvr32.exe
4928	regsvr32.exe
60	regsvr32.exe
60	regsvr32.exe
4572	regsvr32.exe
4572	regsvr32.exe
4572	regsvr32.exe
4572	regsvr32.exe
220	regsvr32.exe
220	regsvr32.exe
2256	regsvr32.exe
2256	regsvr32.exe
2256	regsvr32.exe
2256	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2668	EXCEL.EXE
2668	EXCEL.EXE
2668	EXCEL.EXE
2668	EXCEL.EXE
2668	EXCEL.EXE
2668	EXCEL.EXE
2668	EXCEL.EXE
2668	EXCEL.EXE
2668	EXCEL.EXE
2668	EXCEL.EXE
2668	EXCEL.EXE
2668	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 3724	2668	EXCEL.EXE	70
PID 2668 wrote to memory of 3724	2668	EXCEL.EXE	70
PID 3724 wrote to memory of 4928	3724	regsvr32.exe	72
PID 3724 wrote to memory of 4928	3724	regsvr32.exe	72
PID 2668 wrote to memory of 1020	2668	EXCEL.EXE	75
PID 2668 wrote to memory of 1020	2668	EXCEL.EXE	75
PID 2668 wrote to memory of 60	2668	EXCEL.EXE	77
PID 2668 wrote to memory of 60	2668	EXCEL.EXE	77
PID 60 wrote to memory of 4572	60	regsvr32.exe	78
PID 60 wrote to memory of 4572	60	regsvr32.exe	78
PID 2668 wrote to memory of 220	2668	EXCEL.EXE	79
PID 2668 wrote to memory of 220	2668	EXCEL.EXE	79
PID 220 wrote to memory of 2256	220	regsvr32.exe	80
PID 220 wrote to memory of 2256	220	regsvr32.exe	80

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7c770b145f142724d5456c26af22c7ad87406f2246faeeee0919a67edbb2b4dd.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EhPUJ\loYbnCSGh.dll"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4928
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:1020
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NCtiuXd\IcZTnWb.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4572
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PwEqhgHOeCGdf\iGRrPw.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 8ec8b43c05aab5322350b3fc9aa494a21888a75483d4045a6acd60d3aec2dbbb
MD5 f500e1c68c7e56bcde533bdf056c3bb6
SHA1 063dd8eba8d03900908b63b2c301c7d47bc2dfa8
SHA512 d730181e81cf52063b57bcbcabf0ab645f7a66508dd654ea362d6f0d5e4e7dffed021c78b6c1ab07e27192d8b5600aa50e79a4191fe438b616dc4b880fd3f6ed
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzl:ObB2Xq/cmRq2B+4VJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 2106f04f97ab9a01799a215cdfd41c63ab5dbb8b2115f215c16b3a552278e5e1
MD5 3bf79f71d78a391064a714a01e1e8bbc
SHA1 11d86918531cc6c2c6a22f145af8e9019fe87787
SHA512 99b92872826e0c92ceed52c714e55dbb2331c1ab7de11a284fcdb1e6ea353027d6f9446b830b598d1a5d021e3f77e48a5b9bd274476670982215053323ca4901
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzb:ObB2Xq/cmRq2B+4Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 b0f95adedc1680a37108adef1302bbc5e05aef90eda39e74deebf663de2f940f
MD5 b9b46e8e37175733064b17ebe75a9a35
SHA1 422f2f65a005687ead780520abe38a06b8ac6f98
SHA512 e59c55ca8b1a6c0123fe5654ad6ad5befcdf98e560cc03c5f861c10de25d0202d03bde9d45fc6b491e8c9795975925ae4b7a2caac7acb75c5d0d626ac2e97588
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzj:ObB2Xq/cmRq2B+4V/
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path \Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 8ec8b43c05aab5322350b3fc9aa494a21888a75483d4045a6acd60d3aec2dbbb
MD5 f500e1c68c7e56bcde533bdf056c3bb6
SHA1 063dd8eba8d03900908b63b2c301c7d47bc2dfa8
SHA512 d730181e81cf52063b57bcbcabf0ab645f7a66508dd654ea362d6f0d5e4e7dffed021c78b6c1ab07e27192d8b5600aa50e79a4191fe438b616dc4b880fd3f6ed
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzl:ObB2Xq/cmRq2B+4VJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path \Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 2106f04f97ab9a01799a215cdfd41c63ab5dbb8b2115f215c16b3a552278e5e1
MD5 3bf79f71d78a391064a714a01e1e8bbc
SHA1 11d86918531cc6c2c6a22f145af8e9019fe87787
SHA512 99b92872826e0c92ceed52c714e55dbb2331c1ab7de11a284fcdb1e6ea353027d6f9446b830b598d1a5d021e3f77e48a5b9bd274476670982215053323ca4901
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzb:ObB2Xq/cmRq2B+4Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path \Users\Admin\elv4.ooocccxxx
Size 434KB
SHA256 b0f95adedc1680a37108adef1302bbc5e05aef90eda39e74deebf663de2f940f
MD5 b9b46e8e37175733064b17ebe75a9a35
SHA1 422f2f65a005687ead780520abe38a06b8ac6f98
SHA512 e59c55ca8b1a6c0123fe5654ad6ad5befcdf98e560cc03c5f861c10de25d0202d03bde9d45fc6b491e8c9795975925ae4b7a2caac7acb75c5d0d626ac2e97588
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzj:ObB2Xq/cmRq2B+4V/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2668-128-0x00007FFAB7880000-0x00007FFAB7890000-memory.dmp

Download

memory/2668-352-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

Download

memory/2668-115-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

Download

memory/2668-127-0x00007FFAB7880000-0x00007FFAB7890000-memory.dmp

Download

memory/2668-118-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

Download

memory/2668-353-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

Download

memory/2668-116-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

Download

memory/2668-117-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

Download

memory/2668-351-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

Download

memory/2668-350-0x00007FFABA900000-0x00007FFABA910000-memory.dmp

Download

memory/3724-279-0x0000000180000000-0x0000000180030000-memory.dmp

Download