emotet | 655d910f284bd28364f826c9001492dc528846a392c10052c4ba1d1e4e436762

General

Target

1.xls
Size

255KB
MD5

a1a832bedb8e1773a616cfe4ea57667d
SHA1

e6b7d0279681155adbaa6ae520ebdca55591d0a3
SHA256

655d910f284bd28364f826c9001492dc528846a392c10052c4ba1d1e4e436762
SHA512

2a68205052c9b8665ba9668493fcd54f4f4af27a97b1048e3776cf7cc7fedc70231cc23018effb49cd4d298a2be03c0c86bae18e3ce99f1f79cf8a1960a499c8
SSDEEP

6144:bKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgzmnaVGraWWqXqzzyd17O6t0RmUoBQ:aXWWqazOd165RmvQ

Score

10^/10

emotet epoch5 banker persistence trojan

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://datie-tw.com/img/SvH/

xlm40.dropper

http://central-nutrition.com/wp-content/Nh1L6YR4qlDFWS58cVB/

xlm40.dropper

http://championsfactorysampaios.com.br/xt5HKu/tDs8WsKOxQFq/

xlm40.dropper

https://dacsandongthapmuoi.vn/system/cron/HwOtNCFo/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4424	1980	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3044	1980	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4864	1980	regsvr32.exe	EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5028	1980	regsvr32.exe	EXCEL.EXE

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

5028 regsvr32.exe

pid	process
5028	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KKDvAUcHHTCDYu.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\AMTiR\\KKDvAUcHHTCDYu.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1980 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

5028 regsvr32.exe
5028 regsvr32.exe
4660 regsvr32.exe
4660 regsvr32.exe
4660 regsvr32.exe
4660 regsvr32.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

1980 EXCEL.EXE
1980 EXCEL.EXE

pid	process
5028	regsvr32.exe
5028	regsvr32.exe
4660	regsvr32.exe
4660	regsvr32.exe
4660	regsvr32.exe
4660	regsvr32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
1980	EXCEL.EXE
1980	EXCEL.EXE
1980	EXCEL.EXE
1980	EXCEL.EXE
1980	EXCEL.EXE
1980	EXCEL.EXE
1980	EXCEL.EXE
1980	EXCEL.EXE
1980	EXCEL.EXE
1980	EXCEL.EXE
1980	EXCEL.EXE
1980	EXCEL.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

EXCEL.EXEregsvr32.exe

description	pid	process	target process
PID 1980 wrote to memory of 4424	1980	EXCEL.EXE	regsvr32.exe
PID 1980 wrote to memory of 4424	1980	EXCEL.EXE	regsvr32.exe
PID 1980 wrote to memory of 3044	1980	EXCEL.EXE	regsvr32.exe
PID 1980 wrote to memory of 3044	1980	EXCEL.EXE	regsvr32.exe
PID 1980 wrote to memory of 4864	1980	EXCEL.EXE	regsvr32.exe
PID 1980 wrote to memory of 4864	1980	EXCEL.EXE	regsvr32.exe
PID 1980 wrote to memory of 5028	1980	EXCEL.EXE	regsvr32.exe
PID 1980 wrote to memory of 5028	1980	EXCEL.EXE	regsvr32.exe
PID 5028 wrote to memory of 4660	5028	regsvr32.exe	regsvr32.exe
PID 5028 wrote to memory of 4660	5028	regsvr32.exe	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:4424
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:3044
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
  2⤵
  - Process spawned unexpected child process
  PID:4864
- C:\Windows\System32\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AMTiR\KKDvAUcHHTCDYu.dll"
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\oxnv2.ooccxx

Filesize
888B

MD5
998bed8bb5fb5a2207b8d94268d1e0b9

SHA1
58f3f1208b7d8d2fd0298dd804ebab5d3d91b40c

SHA256
4dd3d615813a715cd47725ce1afc19ba31787b11523081a307288a1aa0ad509c

SHA512
2c4626646fc8a48344c6de7c470a4cb5c956690ebcd34aecb5418ab29fe2866075838352b413cab34125d00fa55f5c10d40815e839c31192ca2072cfcb614529

Download Submit
C:\Users\Admin\oxnv3.ooccxx

Filesize
773B

MD5
b30aa7e985bf41477a23491eae987ae6

SHA1
0541fa57c2a8debf5c428d8cd6fbe74c81e4794a

SHA256
1e3aa4cbfb10fad2b2ad72b0634d574d051b75febda62f664cfa03eacbfdbf9b

SHA512
db7b5fdbcb0ea13058912c8574bb4d84ad002e561cddc8b512c801d7b3bed762556ed683b22a06a9ec058148487231f252314b52206aa1468a6e2c85ccd2aec5

Download Submit
C:\Users\Admin\oxnv4.ooccxx

Filesize
570KB

MD5
ee15dbb42e1c2d8f5b3e2a8558994d54

SHA1
f92371dee2dfb9fdaabdf8c36d8f2ef614972ade

SHA256
77e8629423878a042c368984a1c567194b97b05bbd240f6be6fd0c4366f82b3b

SHA512
3a1b7c8286c6ad179a29fa1edd720db50f77e263acf92e0a08a2d43733f33015b11fee6e9e0989109a86535e35724b55da558354e22b9ba824944bd057b95b3a

Download Submit
\Users\Admin\oxnv4.ooccxx

Filesize
570KB

MD5
ee15dbb42e1c2d8f5b3e2a8558994d54

SHA1
f92371dee2dfb9fdaabdf8c36d8f2ef614972ade

SHA256
77e8629423878a042c368984a1c567194b97b05bbd240f6be6fd0c4366f82b3b

SHA512
3a1b7c8286c6ad179a29fa1edd720db50f77e263acf92e0a08a2d43733f33015b11fee6e9e0989109a86535e35724b55da558354e22b9ba824944bd057b95b3a

Download Submit
memory/1980-120-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/1980-132-0x00007FFF49220000-0x00007FFF49230000-memory.dmp

Filesize
64KB

Download
memory/1980-133-0x00007FFF49220000-0x00007FFF49230000-memory.dmp

Filesize
64KB

Download
memory/1980-123-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/1980-122-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/1980-121-0x00007FFF4CAC0000-0x00007FFF4CAD0000-memory.dmp

Filesize
64KB

Download
memory/3044-262-0x0000000000000000-mapping.dmp

Download
memory/4424-261-0x0000000000000000-mapping.dmp

Download
memory/4660-278-0x0000000000000000-mapping.dmp

Download
memory/4864-264-0x0000000000000000-mapping.dmp

Download
memory/5028-268-0x0000000000000000-mapping.dmp

Download
memory/5028-271-0x0000000180000000-0x0000000180030000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads