emotet | abe53fe71c14dc30e3345e204d148cf666002438ee9d150910076c739eef3fb2

Analysis

max time kernel
147s
max time network
147s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
10/11/2022, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
abe53fe71c14dc30e3345e204d148cf666002438ee9d150910076c739eef3fb2.xls
Size 91KB
Sample221110-kk3ppaabfl
SHA256 abe53fe71c14dc30e3345e204d148cf666002438ee9d150910076c739eef3fb2
MD5 5f7fd90c820da1f73522e1d24321c012
SHA1 e7febe42c1d0643d077723875e89c91590619289
SHA512 46245c0b1a855a3073cfc08416c5e8cd6d533a303c34c5da2f3562724291cc1473fdc767522e33732767bb22e92bedf7734ea9c6156159d77b9e0fb905ff1660
SSDEEP 1536:wKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgGbCXuZH4gb4CEn9J4Z/Cs9o2:wKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper
https://bosny.com/aspnet_client/R50QIOGjmvVlr/
xlm40.dropper
http://navylin.com/autopoisonous/4fZQW/
xlm40.dropper
http://asrani.garudaputih.com/nutabalong/bJYqoUIr99qNfoPDx/
xlm40.dropper
http://db.rikaz.tech/lCx76IlkrBtEsqNFA7/zPYJzpOnzstNOiRHob/

Extracted

Family

emotet

Botnet

Epoch5

202.28.34.99:8080
80.211.107.116:8080
175.126.176.79:8080
218.38.121.17:443
139.196.72.155:8080
103.71.99.57:8080
87.106.97.83:7080
178.62.112.199:8080
64.227.55.231:8080
46.101.98.60:8080
54.37.228.122:443
128.199.217.206:443
190.145.8.4:443
209.239.112.82:8080
85.214.67.203:8080
198.199.70.22:8080
128.199.242.164:8080
178.238.225.252:8080
103.85.95.4:8080
103.126.216.86:443
104.244.79.94:443
36.67.23.59:443
37.44.244.177:8080
160.16.143.191:8080
85.25.120.45:8080
103.56.149.105:8080
210.57.209.142:8080
195.77.239.39:8080
62.171.178.147:8080
118.98.72.86:443
103.224.241.74:8080
185.148.169.10:8080
103.41.204.169:8080
186.250.48.5:443
165.22.254.236:8080
93.104.209.107:8080
139.59.80.108:8080
196.44.98.190:8080
114.79.130.68:443
115.178.55.22:80
103.254.12.236:7080
172.105.115.71:8080
174.138.33.49:7080
51.75.33.122:443
83.229.80.93:8080
78.47.204.80:443
188.165.79.151:443
202.134.4.210:7080
82.98.180.154:7080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4384	1776	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1392	1776	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	808	1776	regsvr32.exe	65
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3316	1776	regsvr32.exe	65

Downloads MZ/PE file

Loads dropped DLL 4 IoCs

pid	Process
4384	regsvr32.exe
1392	regsvr32.exe
808	regsvr32.exe
3316	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vxKbbdwuIux.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\ZfRqUFGaEVDomFsVo\\vxKbbdwuIux.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1776	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
4384	regsvr32.exe
4384	regsvr32.exe
488	regsvr32.exe
488	regsvr32.exe
488	regsvr32.exe
488	regsvr32.exe
1392	regsvr32.exe
1392	regsvr32.exe
1244	regsvr32.exe
1244	regsvr32.exe
1244	regsvr32.exe
1244	regsvr32.exe
808	regsvr32.exe
808	regsvr32.exe
3328	regsvr32.exe
3328	regsvr32.exe
3316	regsvr32.exe
3316	regsvr32.exe
3328	regsvr32.exe
3328	regsvr32.exe
2356	regsvr32.exe
2356	regsvr32.exe
2356	regsvr32.exe
2356	regsvr32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1776	EXCEL.EXE
1776	EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE
1776	EXCEL.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 4384	1776	EXCEL.EXE	74
PID 1776 wrote to memory of 4384	1776	EXCEL.EXE	74
PID 4384 wrote to memory of 488	4384	regsvr32.exe	75
PID 4384 wrote to memory of 488	4384	regsvr32.exe	75
PID 1776 wrote to memory of 1392	1776	EXCEL.EXE	76
PID 1776 wrote to memory of 1392	1776	EXCEL.EXE	76
PID 1392 wrote to memory of 1244	1392	regsvr32.exe	77
PID 1392 wrote to memory of 1244	1392	regsvr32.exe	77
PID 1776 wrote to memory of 808	1776	EXCEL.EXE	78
PID 1776 wrote to memory of 808	1776	EXCEL.EXE	78
PID 808 wrote to memory of 3328	808	regsvr32.exe	79
PID 808 wrote to memory of 3328	808	regsvr32.exe	79
PID 1776 wrote to memory of 3316	1776	EXCEL.EXE	80
PID 1776 wrote to memory of 3316	1776	EXCEL.EXE	80
PID 3316 wrote to memory of 2356	3316	regsvr32.exe	81
PID 3316 wrote to memory of 2356	3316	regsvr32.exe	81

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\abe53fe71c14dc30e3345e204d148cf666002438ee9d150910076c739eef3fb2.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZfRqUFGaEVDomFsVo\vxKbbdwuIux.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:488
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KwsfkqcZNxlRloO\sxLZHwHzS.dll"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1244
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XmSggMUdVlMKZ\pRxB.dll"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3328
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JODuLz\FEnZa.dll"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elv1.ooocccxxx

Path C:\Users\Admin\elv1.ooocccxxx
Size 621KB
SHA256 fe2b6400e9a7680a04815ad12011a10b3b2b7ff89871855d1504676f0240b153
MD5 6f46703601b158ca71e3ceb22ac22de1
SHA1 20fdbd004fc1fbacc8633d7726eea18303740d1a
SHA512 2c14c44e05eaeef4955e3007a8879e51a3c2fb9c4e5f40b193568738d3c3a78d08549affd3b52ebe06fe145c3cd82d929addeb636c6b3ca23e8cfa7ee857b719
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWiJgQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XcZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path C:\Users\Admin\elv2.ooocccxxx
Size 621KB
SHA256 c2033cf265e874e22763b3229d04748022883a0dae8775f1be7fc5b5db4a4442
MD5 47b7691bd6083388ed9b8ec8d7faabed
SHA1 ac7b7313cbc0f1568dfc5ac597fc9447eaeab7c4
SHA512 7a45befda864b762a8626b92b5808188c49c4dffd2804d86a2bda1fedc3f4687224edd8da91ef33db5a977e7893529957aecc889a10e898d962b5401cc97cae2
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWiWgQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XJZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path C:\Users\Admin\elv3.ooocccxxx
Size 621KB
SHA256 72a643e76d2b5a9921405d546d2b0ce1e74e7d516c59def5bd42157446b35c82
MD5 1340a41ba28e563e706b0b58e099e299
SHA1 241825989b93ad58d3b9ca15d6fcee5878429ac8
SHA512 c5a8281afc1630fd13078f31487d34ea7dec360020365f731287307c9cf0d18fbd8c073b5642a45f5d1a7767ed1623923ce1f5e35957847a109b31a303b9a806
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWizgQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XWZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path C:\Users\Admin\elv4.ooocccxxx
Size 621KB
SHA256 8212fc22cf0020b991c5f837c7eb6b7fac0291dc2755a6c74893684262f2226c
MD5 48bde808acebb316414f2395639193d8
SHA1 1154d11c06414d7c28139898522441e0e43af8de
SHA512 1e850588b9f86b3570df29d0ac9f61af4f0e121d791fd9b82503a4cba7c6bda029f4115f44039775c107620c4b1bb171209eb497e1e63953bde2ac08c810f612
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWi8gQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XnZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv1.ooocccxxx

Path \Users\Admin\elv1.ooocccxxx
Size 621KB
SHA256 fe2b6400e9a7680a04815ad12011a10b3b2b7ff89871855d1504676f0240b153
MD5 6f46703601b158ca71e3ceb22ac22de1
SHA1 20fdbd004fc1fbacc8633d7726eea18303740d1a
SHA512 2c14c44e05eaeef4955e3007a8879e51a3c2fb9c4e5f40b193568738d3c3a78d08549affd3b52ebe06fe145c3cd82d929addeb636c6b3ca23e8cfa7ee857b719
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWiJgQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XcZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv2.ooocccxxx

Path \Users\Admin\elv2.ooocccxxx
Size 621KB
SHA256 c2033cf265e874e22763b3229d04748022883a0dae8775f1be7fc5b5db4a4442
MD5 47b7691bd6083388ed9b8ec8d7faabed
SHA1 ac7b7313cbc0f1568dfc5ac597fc9447eaeab7c4
SHA512 7a45befda864b762a8626b92b5808188c49c4dffd2804d86a2bda1fedc3f4687224edd8da91ef33db5a977e7893529957aecc889a10e898d962b5401cc97cae2
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWiWgQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XJZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv3.ooocccxxx

Path \Users\Admin\elv3.ooocccxxx
Size 621KB
SHA256 72a643e76d2b5a9921405d546d2b0ce1e74e7d516c59def5bd42157446b35c82
MD5 1340a41ba28e563e706b0b58e099e299
SHA1 241825989b93ad58d3b9ca15d6fcee5878429ac8
SHA512 c5a8281afc1630fd13078f31487d34ea7dec360020365f731287307c9cf0d18fbd8c073b5642a45f5d1a7767ed1623923ce1f5e35957847a109b31a303b9a806
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWizgQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XWZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

elv4.ooocccxxx

Path \Users\Admin\elv4.ooocccxxx
Size 621KB
SHA256 8212fc22cf0020b991c5f837c7eb6b7fac0291dc2755a6c74893684262f2226c
MD5 48bde808acebb316414f2395639193d8
SHA1 1154d11c06414d7c28139898522441e0e43af8de
SHA512 1e850588b9f86b3570df29d0ac9f61af4f0e121d791fd9b82503a4cba7c6bda029f4115f44039775c107620c4b1bb171209eb497e1e63953bde2ac08c810f612
SSDEEP 6144:S6/ptuaN+qWUILr1HRf/9Mu1vHLI7U9XWi8gQ30/bP/09Xls9HV6MExbnyDAzlsH:S6/ptu/qerXtU7U9XnZWYobyDAzl+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1776-341-0x00007FFA5CE30000-0x00007FFA5CE40000-memory.dmp

Download

memory/1776-340-0x00007FFA5CE30000-0x00007FFA5CE40000-memory.dmp

Download

memory/1776-339-0x00007FFA5CE30000-0x00007FFA5CE40000-memory.dmp

Download

memory/1776-129-0x00007FFA5A110000-0x00007FFA5A120000-memory.dmp

Download

memory/1776-128-0x00007FFA5A110000-0x00007FFA5A120000-memory.dmp

Download

memory/1776-119-0x00007FFA5CE30000-0x00007FFA5CE40000-memory.dmp

Download

memory/1776-116-0x00007FFA5CE30000-0x00007FFA5CE40000-memory.dmp

Download

memory/1776-118-0x00007FFA5CE30000-0x00007FFA5CE40000-memory.dmp

Download

memory/1776-117-0x00007FFA5CE30000-0x00007FFA5CE40000-memory.dmp

Download

memory/1776-338-0x00007FFA5CE30000-0x00007FFA5CE40000-memory.dmp

Download

memory/4384-260-0x0000000002C00000-0x0000000002C2E000-memory.dmp

Download