emotet | 48b9843bcbb25f7a71fce3de304c770ebbc732e230e22bd8e5f96e9d733d00ee

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2022, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Documentos-13536.xls
Size 91KB
Sample221109-y6mr9adefm
SHA256 48b9843bcbb25f7a71fce3de304c770ebbc732e230e22bd8e5f96e9d733d00ee
MD5 018c40d93a562f7287ed93aebe7c1e69
SHA1 e5874b1b6b7b1c02d12a80cba885c8040896bef0
SHA512 365531e8bcd031d7ab6949fabdf5a692c1d96eb04b2476ece4132abb044b88f91828221876427974eb75dc17c727e400dd3c57115ee58530025378eb0c12b9cc
SSDEEP 1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2bCXuZH4gb4CEn9J4ZWcvp:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
http://bundlefilm.com/headers/lkfBH3Czw9CjEW07P2/
xlm40.dropper
http://camsanparke.net/wp-content/h2Ja5bwB03hnyfCb/
xlm40.dropper
http://royreid.co.uk/wp-content/dCwG/
xlm40.dropper
https://cs.com.sg/admin/a1lR5wu/

Extracted

Family

emotet

Botnet

Epoch5

178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4256	5076	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3432	5076	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1444	5076	regsvr32.exe	80
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	448	5076	regsvr32.exe	80

Downloads MZ/PE file

Loads dropped DLL 6 IoCs

pid	Process
4256	regsvr32.exe
1124	regsvr32.exe
3432	regsvr32.exe
4780	regsvr32.exe
1444	regsvr32.exe
3600	regsvr32.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cVuXiVSzMWaYIJ.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\FjOMjsFgGGq\\cVuXiVSzMWaYIJ.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hNbqK.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\BRFeFIUJ\\hNbqK.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HHZluIkag.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\UFHIhsgxZFfIpW\\HHZluIkag.dll\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5076	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4256	regsvr32.exe
4256	regsvr32.exe
1124	regsvr32.exe
1124	regsvr32.exe
3432	regsvr32.exe
3432	regsvr32.exe
1124	regsvr32.exe
1124	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
1444	regsvr32.exe
1444	regsvr32.exe
4780	regsvr32.exe
4780	regsvr32.exe
3600	regsvr32.exe
3600	regsvr32.exe
3600	regsvr32.exe
3600	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5076	EXCEL.EXE
5076	EXCEL.EXE
5076	EXCEL.EXE
5076	EXCEL.EXE
5076	EXCEL.EXE
5076	EXCEL.EXE
5076	EXCEL.EXE
5076	EXCEL.EXE
5076	EXCEL.EXE
5076	EXCEL.EXE
5076	EXCEL.EXE
5076	EXCEL.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4256	5076	EXCEL.EXE	85
PID 5076 wrote to memory of 4256	5076	EXCEL.EXE	85
PID 4256 wrote to memory of 1124	4256	regsvr32.exe	87
PID 4256 wrote to memory of 1124	4256	regsvr32.exe	87
PID 5076 wrote to memory of 3432	5076	EXCEL.EXE	88
PID 5076 wrote to memory of 3432	5076	EXCEL.EXE	88
PID 3432 wrote to memory of 4780	3432	regsvr32.exe	91
PID 3432 wrote to memory of 4780	3432	regsvr32.exe	91
PID 5076 wrote to memory of 1444	5076	EXCEL.EXE	92
PID 5076 wrote to memory of 1444	5076	EXCEL.EXE	92
PID 1444 wrote to memory of 3600	1444	regsvr32.exe	93
PID 1444 wrote to memory of 3600	1444	regsvr32.exe	93
PID 5076 wrote to memory of 448	5076	EXCEL.EXE	94
PID 5076 wrote to memory of 448	5076	EXCEL.EXE	94

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Documentos-13536.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\UFHIhsgxZFfIpW\HHZluIkag.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1124
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FjOMjsFgGGq\cVuXiVSzMWaYIJ.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4780
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\BRFeFIUJ\hNbqK.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:3600
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  PID:448

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 83925232b3a7481d9dfea9dff016ae50071593d7b74bde391eafbc519b7f87b8
MD5 fa53a4050dad7b0d8e0dcf64aabe53ab
SHA1 4ca215cf558d6c3c7bdbe2235bae570a1ee93c34
SHA512 df3ebe6050e5402194ddfaf4559c7acb2c0ee5c644234231c261439b781832100013b04ecccf6c193c1731a19a995863572c5078f6529004180b78ff475c981e
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzz:ObB2Xq/cmRq2B+4Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 434KB
SHA256 83925232b3a7481d9dfea9dff016ae50071593d7b74bde391eafbc519b7f87b8
MD5 fa53a4050dad7b0d8e0dcf64aabe53ab
SHA1 4ca215cf558d6c3c7bdbe2235bae570a1ee93c34
SHA512 df3ebe6050e5402194ddfaf4559c7acb2c0ee5c644234231c261439b781832100013b04ecccf6c193c1731a19a995863572c5078f6529004180b78ff475c981e
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzz:ObB2Xq/cmRq2B+4Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 15d50319ab9a9423fdc4acb07f66d67e16bf3dc25005b43927476aa6160c6318
MD5 dbddfa9d95fbdbe57de3263da2ca0628
SHA1 f334ddeb7056899162720ea3d3a74c765fb3d04f
SHA512 a5bc5b45bc7078287524a9df91b8fb9eb43079dbbea217044fcfe57f65874dd9afbfa7b7d86b8e46627c22d4a5733687233f9c27c42d09a28fc9bcd1d1410240
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz2:ObB2Xq/cmRq2B+4Vi
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 434KB
SHA256 15d50319ab9a9423fdc4acb07f66d67e16bf3dc25005b43927476aa6160c6318
MD5 dbddfa9d95fbdbe57de3263da2ca0628
SHA1 f334ddeb7056899162720ea3d3a74c765fb3d04f
SHA512 a5bc5b45bc7078287524a9df91b8fb9eb43079dbbea217044fcfe57f65874dd9afbfa7b7d86b8e46627c22d4a5733687233f9c27c42d09a28fc9bcd1d1410240
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz2:ObB2Xq/cmRq2B+4Vi
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 c8a33677be039df4a999ab932321a102e08915a1db65e870f0d5210b950c688e
MD5 4238b18d847fd21a1eacae8a7e57a43c
SHA1 b6f66aabc4eec070af867f51aecb9bb6c5d5dbb8
SHA512 94ca95419848692ae52f211055f31fda729cc65b55ffadaeb4494134dd2cb2bc02fa7e66126ef6e5f1fca83a36094cb121eab8d5921c481b043095b6ee361f7c
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzt:ObB2Xq/cmRq2B+4VZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 434KB
SHA256 c8a33677be039df4a999ab932321a102e08915a1db65e870f0d5210b950c688e
MD5 4238b18d847fd21a1eacae8a7e57a43c
SHA1 b6f66aabc4eec070af867f51aecb9bb6c5d5dbb8
SHA512 94ca95419848692ae52f211055f31fda729cc65b55ffadaeb4494134dd2cb2bc02fa7e66126ef6e5f1fca83a36094cb121eab8d5921c481b043095b6ee361f7c
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzt:ObB2Xq/cmRq2B+4VZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hNbqK.dll

Path C:\Windows\System32\BRFeFIUJ\hNbqK.dll
Size 434KB
SHA256 c8a33677be039df4a999ab932321a102e08915a1db65e870f0d5210b950c688e
MD5 4238b18d847fd21a1eacae8a7e57a43c
SHA1 b6f66aabc4eec070af867f51aecb9bb6c5d5dbb8
SHA512 94ca95419848692ae52f211055f31fda729cc65b55ffadaeb4494134dd2cb2bc02fa7e66126ef6e5f1fca83a36094cb121eab8d5921c481b043095b6ee361f7c
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzt:ObB2Xq/cmRq2B+4VZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cVuXiVSzMWaYIJ.dll

Path C:\Windows\System32\FjOMjsFgGGq\cVuXiVSzMWaYIJ.dll
Size 434KB
SHA256 15d50319ab9a9423fdc4acb07f66d67e16bf3dc25005b43927476aa6160c6318
MD5 dbddfa9d95fbdbe57de3263da2ca0628
SHA1 f334ddeb7056899162720ea3d3a74c765fb3d04f
SHA512 a5bc5b45bc7078287524a9df91b8fb9eb43079dbbea217044fcfe57f65874dd9afbfa7b7d86b8e46627c22d4a5733687233f9c27c42d09a28fc9bcd1d1410240
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlz2:ObB2Xq/cmRq2B+4Vi
MD5 SHA1 SHA512 SSDEEP

Submit Download

HHZluIkag.dll

Path C:\Windows\System32\UFHIhsgxZFfIpW\HHZluIkag.dll
Size 434KB
SHA256 83925232b3a7481d9dfea9dff016ae50071593d7b74bde391eafbc519b7f87b8
MD5 fa53a4050dad7b0d8e0dcf64aabe53ab
SHA1 4ca215cf558d6c3c7bdbe2235bae570a1ee93c34
SHA512 df3ebe6050e5402194ddfaf4559c7acb2c0ee5c644234231c261439b781832100013b04ecccf6c193c1731a19a995863572c5078f6529004180b78ff475c981e
SSDEEP 12288:O2APV8K2Xtw/V6XHWRBkF2TlfnBBO4Xlzz:ObB2Xq/cmRq2B+4Vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4256-142-0x0000000180000000-0x0000000180030000-memory.dmp

Download

memory/5076-138-0x00007FFA93F80000-0x00007FFA93F90000-memory.dmp

Download

memory/5076-137-0x00007FFA93F80000-0x00007FFA93F90000-memory.dmp

Download

memory/5076-132-0x00007FFA96690000-0x00007FFA966A0000-memory.dmp

Download

memory/5076-136-0x00007FFA96690000-0x00007FFA966A0000-memory.dmp

Download

memory/5076-135-0x00007FFA96690000-0x00007FFA966A0000-memory.dmp

Download

memory/5076-134-0x00007FFA96690000-0x00007FFA966A0000-memory.dmp

Download

memory/5076-133-0x00007FFA96690000-0x00007FFA966A0000-memory.dmp

Download