emotet | bda0510e2a2c21529799941f7805e8b7f9437a0192304a758ba5ad672640eba9

Resubmissions

07/03/2023, 23:26

230307-3e18sacb8v8

07/03/2023, 22:59

07/03/2023, 22:50

07/03/2023, 22:45

07/03/2023, 22:34

Analysis

max time kernel
14s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2023, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
documento 0803.doc
Size 548.3MB
Sample230307-2splgacf32
SHA256 a85fa869a88e0c5464efb2e86ab86b97035374ea96bcc9c59a4fd7f7e3ba5de1
MD5 df03ab3720154f245c109759ae06913e
SHA1 1f4ae4072ca354d3337f578b74b7526f7fb2bbee
SHA512 cdc65bbde648ac2349b566003be8b6f9f9a74c1439f09faa81d0d3b29ff4037be57d9bbb4a2588847b1ac528cec82c5e205ac02862dfd64cac90ea0c0e3d0b56
SSDEEP 6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

129.232.188.93:443
164.90.222.65:443
159.65.88.10:8080
172.105.226.75:8080
115.68.227.76:8080
187.63.160.88:80
169.57.156.166:8080
185.4.135.165:8080
153.126.146.25:7080
197.242.150.244:8080
139.59.126.41:443
186.194.240.217:443
103.132.242.26:8080
206.189.28.199:8080
163.44.196.120:8080
95.217.221.146:8080
159.89.202.34:443
119.59.103.152:8080
183.111.227.137:8080
201.94.166.162:443
103.75.201.2:443
149.56.131.28:8080
79.137.35.198:8080
5.135.159.50:443
66.228.32.31:7080
91.121.146.47:8080
153.92.5.27:8080
45.235.8.30:8080
72.15.201.15:8080
107.170.39.149:8080
45.176.232.124:443
82.223.21.224:8080
167.172.199.165:8080
213.239.212.5:443
202.129.205.3:8080
94.23.45.86:4143
147.139.166.154:8080
167.172.253.162:8080
91.207.28.33:8080
188.44.20.25:443
104.168.155.143:8080
110.232.117.186:8080
164.68.99.3:8080
1.234.2.232:8080
173.212.193.249:8080
182.162.143.56:443
160.16.142.56:8080
101.50.0.91:8080
103.43.75.120:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1368	3728	regsvr32.exe	80

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3728	WINWORD.EXE
3728	WINWORD.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3728	WINWORD.EXE
3728	WINWORD.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3728	WINWORD.EXE
3728	WINWORD.EXE
3728	WINWORD.EXE
3728	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\documento 0803.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3728
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\235745.tmp"
  2⤵
  - Process spawned unexpected child process
  PID:1368
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PiFflqCszjQ\SQIIVebnfNwnERg.dll"
    3⤵
    PID:3112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

235745.tmp

Path C:\Users\Admin\AppData\Local\Temp\235745.tmp
Size 289.4MB
SHA256 bfbf0f3d53688e6de260581c7002e7d0a6e2e9559b5e127e393e1eb76a828eb0
MD5 06e263e63f237243e847ad10e9f1890e
SHA1 2f5edafed8ff8763b7a7317776f6765f35119930
SHA512 ce84b336da528d97ffc34548be2d398cf748b7cf9a7a83e95c9da3e86bb58860da6bcbb859e3b5ce6ffe997064890b1971c680bf1b0d3624da7d640c9e40c205
SSDEEP 24576:4E4cLCJMj2C8c3wCRSNWiy/eK5xDegO82/gkU8jG:4GLCJMjl8c3wKwKXeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

235745.tmp

Path C:\Users\Admin\AppData\Local\Temp\235745.tmp
Size 254.9MB
SHA256 881e261c35be709dad9e00e42ac6c94dd0b7a38b9b1f68c7d0eed0b414dcbf99
MD5 bf3358a456496c6120e334108b93598c
SHA1 47108a13866c7958400954b2964324a8ab168599
SHA512 95544c43dc029797eda37387fb0b9b9579fc1280233bc6222caf3afa60647726ce428b5eb1893bcf579152b40f3e459860c36c71596a54f5184cb06b747a008d
SSDEEP 24576:4E4cLCJMj2C8c3wCRSNWiy/eK5xDegO82/gkU8jG:4GLCJMjl8c3wKwKXeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

235746.zip

Path C:\Users\Admin\AppData\Local\Temp\235746.zip
Size 861KB
SHA256 6ce0ef62a201f70b24655f88ba8cee0b74656814c3c078c5d5573af8bb9d70f4
MD5 55bf4c58736e0da06b0e1652acfd073d
SHA1 ea589407ece093433d16cd705b0606211b4f88eb
SHA512 2dad6fccb606005220bb44d8e0ed3b14b47e1c9f81570a57bc22430daa5114bde843aaeb0a38aef9ba80c2d61db16eddc9164a056d04889cf2b781ab049bef99
SSDEEP 12288:64DKwKHCjAbD7j9kd1j89Gpm19Fkf7/sk:devtlkdJe4m19Fgd
MD5 SHA1 SHA512 SSDEEP

Submit Download

SQIIVebnfNwnERg.dll

Path C:\Windows\System32\PiFflqCszjQ\SQIIVebnfNwnERg.dll
Size 250.6MB
SHA256 9502d7b3536ffefbed93096b538f97fb61948293ead267d9efbd498282a2de1f
MD5 e46fcf10941decfc0197f5d033525e31
SHA1 b0a4d745d5a6896b388bc6c50b4b6a2b8adf9009
SHA512 6ec514750f03c83f7e5a031a3dcc11aac8c5836a4142cbda1860473c8ff4da5037583e36d0a79756a7e4d836b7e627818faa7af14091c5458120d2364621cda1
SSDEEP 24576:4E4cLCJMj2C8c3wCRSNWiy/eK5xDegO82/gkU8jG:4GLCJMjl8c3wKwKXeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1368-182-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/1368-176-0x0000000180000000-0x000000018002D000-memory.dmp

Download

memory/3112-187-0x0000000000400000-0x00000000004B0000-memory.dmp

Download

memory/3728-136-0x00007FFB8FA90000-0x00007FFB8FAA0000-memory.dmp

Download

memory/3728-139-0x00007FFB8D670000-0x00007FFB8D680000-memory.dmp

Download

memory/3728-138-0x00007FFB8D670000-0x00007FFB8D680000-memory.dmp

Download

memory/3728-137-0x00007FFB8FA90000-0x00007FFB8FAA0000-memory.dmp

Download

memory/3728-133-0x00007FFB8FA90000-0x00007FFB8FAA0000-memory.dmp

Download

memory/3728-134-0x00007FFB8FA90000-0x00007FFB8FAA0000-memory.dmp

Download

memory/3728-135-0x00007FFB8FA90000-0x00007FFB8FAA0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads