emotet | 8c3cfdd7e1e162129eedf2c3d9f6f63c133622bfe5d04bccbd823486a85b69ed

General

Target

K-1 form.xls
Size

255KB
MD5

18252d898a785e916760be3e63c29a78
SHA1

769301632d80a6c5996e7f9514786e79d044db17
SHA256

8c3cfdd7e1e162129eedf2c3d9f6f63c133622bfe5d04bccbd823486a85b69ed
SHA512

86507a8d28982194e8cca9e95da98d17fde400393997eeb6df980e1da6549c8cb869ad347a0792423be75c8dcaaeb73df8d6e512bc363140cc06be834d60c775
SSDEEP

6144:NKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg9Niwrfx9rNFMMrttRzV5Dz3UxqC8LUcSw:mNbDjP9XH5XIqZLnSw

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://www.spinbalence.com/admin3693/Z6WQpmNRNj6041fU2zpt/

xlm40.dropper

http://kabaruntukrakyat.com/wp-content/ES/

xlm40.dropper

https://chobemaster.com/INFECTED/LEdXM4gdwN4mgnlC/

xlm40.dropper

http://cngst.com/data/fXWpDbJ3KwAybE/

Extracted

Family

emotet

Botnet

Epoch4

C2

45.235.8.30:8080

94.23.45.86:4143

119.59.103.152:8080

169.60.181.70:8080

164.68.99.3:8080

172.105.226.75:8080

107.170.39.149:8080

206.189.28.199:8080

1.234.2.232:8080

188.44.20.25:443

186.194.240.217:443

103.43.75.120:443

149.28.143.92:443

159.89.202.34:443

209.97.163.214:443

183.111.227.137:8080

129.232.188.93:443

139.59.126.41:443

110.232.117.186:8080

139.59.56.73:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4540	2548	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1196	2548	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4684	2548	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3156	2548	regsvr32.exe	EXCEL.EXE

Downloads MZ/PE file
Loads dropped DLL 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4684 regsvr32.exe
3792 regsvr32.exe

pid	process
4684	regsvr32.exe
3792	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2548 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4684 regsvr32.exe
4684 regsvr32.exe
3792 regsvr32.exe
3792 regsvr32.exe
3792 regsvr32.exe
3792 regsvr32.exe

pid	process
4684	regsvr32.exe
4684	regsvr32.exe
3792	regsvr32.exe
3792	regsvr32.exe
3792	regsvr32.exe
3792	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE
2548	EXCEL.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

EXCEL.EXEregsvr32.exe

description	pid	process	target process
PID 2548 wrote to memory of 4540	2548	EXCEL.EXE	regsvr32.exe
PID 2548 wrote to memory of 4540	2548	EXCEL.EXE	regsvr32.exe
PID 2548 wrote to memory of 1196	2548	EXCEL.EXE	regsvr32.exe
PID 2548 wrote to memory of 1196	2548	EXCEL.EXE	regsvr32.exe
PID 2548 wrote to memory of 4684	2548	EXCEL.EXE	regsvr32.exe
PID 2548 wrote to memory of 4684	2548	EXCEL.EXE	regsvr32.exe
PID 4684 wrote to memory of 3792	4684	regsvr32.exe	regsvr32.exe
PID 4684 wrote to memory of 3792	4684	regsvr32.exe	regsvr32.exe
PID 2548 wrote to memory of 3156	2548	EXCEL.EXE	regsvr32.exe
PID 2548 wrote to memory of 3156	2548	EXCEL.EXE	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\K-1 form.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
2⤵
- Process spawned unexpected child process
PID:4540

C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
2⤵
- Process spawned unexpected child process
PID:1196

C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZRlSu\ocsdAPfsrG.dll"
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3792

C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
2⤵
- Process spawned unexpected child process
PID:3156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv3.ooccxx
Filesize
575KB

MD5
41e82dccd7687de38408b2acf54ba3b3

SHA1
3a2411866f05c8148ebe69fa8ee542bf70d59167

SHA256
9efdbe83c874a14282b0105fcec8dc46d9ba1de6496f5d570fa14915b8fd3285

SHA512
d20e9eaec301991e3cd125090a5679c19395c8d64fcf7bd710082600b7fee8ce8a8f7af94561f57ece985350bc10f060c18c2aabc37dda5fa413ea687d794e37

Download Submit
C:\Users\Admin\oxnv3.ooccxx
Filesize
575KB

MD5
41e82dccd7687de38408b2acf54ba3b3

SHA1
3a2411866f05c8148ebe69fa8ee542bf70d59167

SHA256
9efdbe83c874a14282b0105fcec8dc46d9ba1de6496f5d570fa14915b8fd3285

SHA512
d20e9eaec301991e3cd125090a5679c19395c8d64fcf7bd710082600b7fee8ce8a8f7af94561f57ece985350bc10f060c18c2aabc37dda5fa413ea687d794e37

Download Submit
C:\Users\Admin\oxnv4.ooccxx
Filesize
2KB

MD5
d6070bab3f3979868ff300eb3dffc72c

SHA1
6fa4d73760015589f933674b082281801e73ce0c

SHA256
8f89a4c2fccb6aeae7679673c17f1cb797c2867a1304ae7978bd36af31f3a1fa

SHA512
51f0dfa5f51c20c75c709c3f3e380187fb09a6b147b38a4785fd08199bc6ec15b68f53a371b6a3d1b57ee7b5752b7c302156cddf15162a0da80ea7d676c494f4

Download Submit
C:\Windows\System32\ZRlSu\ocsdAPfsrG.dll
Filesize
575KB

MD5
41e82dccd7687de38408b2acf54ba3b3

SHA1
3a2411866f05c8148ebe69fa8ee542bf70d59167

SHA256
9efdbe83c874a14282b0105fcec8dc46d9ba1de6496f5d570fa14915b8fd3285

SHA512
d20e9eaec301991e3cd125090a5679c19395c8d64fcf7bd710082600b7fee8ce8a8f7af94561f57ece985350bc10f060c18c2aabc37dda5fa413ea687d794e37

Download Submit
memory/1196-140-0x0000000000000000-mapping.dmp

Download
memory/2548-132-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

Filesize
64KB

Download
memory/2548-138-0x00007FF809A10000-0x00007FF809A20000-memory.dmp

Filesize
64KB

Download
memory/2548-137-0x00007FF809A10000-0x00007FF809A20000-memory.dmp

Filesize
64KB

Download
memory/2548-134-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

Filesize
64KB

Download
memory/2548-133-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

Filesize
64KB

Download
memory/2548-135-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

Filesize
64KB

Download
memory/2548-136-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

Filesize
64KB

Download
memory/3156-152-0x0000000000000000-mapping.dmp

Download
memory/3792-147-0x0000000000000000-mapping.dmp

Download
memory/4540-139-0x0000000000000000-mapping.dmp

Download
memory/4684-141-0x0000000000000000-mapping.dmp

Download
memory/4684-144-0x0000000180000000-0x000000018002F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads