emotet | c6d750d9cae9fcd030fe2c95a4755e250430d5b0d9351661d9593aeaeb020d5a

General

Target

17_62561.doc
Size

525.2MB
MD5

8639c3d193b8211d1fe561b896716f89
SHA1

508d00b731259c63a1e7aaa1030e96a62f4c241a
SHA256

988d82d5b1032b465b0e0c3b60fd5f822209f4cdc9ab04de91139be98dac9ecd
SHA512

9fc1773a40eb49f063f2ecab55f91c8851f320b26918305a05a310411289c08f9053af26389e3e24195804b405a7d358facffbd720bfbc1e7996262bb4d47030
SSDEEP

3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3572	1664	regsvr32.exe	83

Loads dropped DLL 1 IoCs

pid	Process
3572	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	89	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1664	WINWORD.EXE
1664	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3572	regsvr32.exe
3572	regsvr32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1664	WINWORD.EXE
1664	WINWORD.EXE
1664	WINWORD.EXE
1664	WINWORD.EXE
1664	WINWORD.EXE
1664	WINWORD.EXE
1664	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 3572	1664	WINWORD.EXE	99
PID 1664 wrote to memory of 3572	1664	WINWORD.EXE	99

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\17_62561.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\180352.tmp"
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:3572
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JXyrKXUCAtF\lFMaiQtAiKXKEDF.dll"
    3⤵
    PID:1136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\180352.tmp

Filesize
422.3MB

MD5
e5ff32f6bba052c35cd4d76b79c5f082

SHA1
0308ea9fc416b8cf713c38e8cbf2c737b48fca7d

SHA256
bd7b6371746c052c153e76302a43602dd160689b42d73bc39e286b484472de07

SHA512
ac593d448103dceb32018015993b21ee96b4314dfac5063534ca8b9a6bc676b5f949df5fdc8a45d354579054ea9570ea23368e9e45904cc9fcdfd7c03000f4cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\180352.tmp

Filesize
411.4MB

MD5
5fab6f95b07c08ba97ac69aebcb1f0b7

SHA1
db5a735f16d6058792578ecd96613190947e4f26

SHA256
1b387a63df507616e7cbbe634462b7cb3d1a3968638fe65f5f4a47d84c8d7a53

SHA512
368c4975ffde4379415b4c7dd32f3bc56c4ac24f45a8a25b0f5ec2fd03a06a85f20defc58b1fc1e84be26b9ab3ac0bdabc460548097214210bb7b2a29e979022

Download Submit
C:\Users\Admin\AppData\Local\Temp\180432.zip

Filesize
886KB

MD5
c0bac72ad97c272fc2d150c5dbf016d2

SHA1
b899b29530ac17f23153da0a069f568fdbb44e99

SHA256
bb1664730efed30b2183adb6b265d98a2fbf12a3a0b857b5a325f7b4037a89b6

SHA512
c89f7484ef6cbaaeaeb01a1a151b431304565d4ed7f2ccbe2150d92f8d586212f9e1b7e7a0b3673c5e98f46d446c35413c52aab6610522f05b19f1aefa37d0f7

Download Submit
C:\Windows\System32\JXyrKXUCAtF\lFMaiQtAiKXKEDF.dll

Filesize
341.0MB

MD5
c2268fbb5b031ba9bc13b0e9f6c2e3ef

SHA1
42d7341fc25efcf409412b413181d27a5cc0a869

SHA256
b2f52d57a21d8a0708d04cdfba63b723b75ee1332028bbd0151a3c7e663111d1

SHA512
7398d528ad63dea6d06ff3998492764363ddca5040a919b335eba2cc67c7fa812efeecdf5d53524dbd02563ca51a3fc1dd79d82a90e3f791f75dc04ccac87d17

Download Submit
C:\Windows\System32\JXyrKXUCAtF\lFMaiQtAiKXKEDF.dll

Filesize
353.6MB

MD5
c9d35ac0d410f6246778fe60ee878316

SHA1
e4121aa694bae319667492416b01bb05abcbf8c5

SHA256
0bb357243909c42d6ea3ec47266b4d53a8fdb82163b5e2e0eeedcf4a06e8149f

SHA512
4c135d4d49b300e84b27e9c4c3f972bc3a616045db98d47c2bfc8fd718155b886b07c7400d9e111047a7fe3b18a62baf94f527ec1fff2780ebfa52997f5ef43d

Download Submit
memory/1136-191-0x0000000001F80000-0x0000000002034000-memory.dmp

Filesize
720KB

Download
memory/1136-184-0x0000000001F80000-0x0000000002034000-memory.dmp

Filesize
720KB

Download
memory/1664-133-0x00007FFAA71D0000-0x00007FFAA71E0000-memory.dmp

Filesize
64KB

Download
memory/1664-137-0x00007FFAA71D0000-0x00007FFAA71E0000-memory.dmp

Filesize
64KB

Download
memory/1664-136-0x00007FFAA71D0000-0x00007FFAA71E0000-memory.dmp

Filesize
64KB

Download
memory/1664-138-0x00007FFAA50B0000-0x00007FFAA50C0000-memory.dmp

Filesize
64KB

Download
memory/1664-134-0x00007FFAA71D0000-0x00007FFAA71E0000-memory.dmp

Filesize
64KB

Download
memory/1664-135-0x00007FFAA71D0000-0x00007FFAA71E0000-memory.dmp

Filesize
64KB

Download
memory/1664-139-0x00007FFAA50B0000-0x00007FFAA50C0000-memory.dmp

Filesize
64KB

Download
memory/1664-217-0x00007FFAA71D0000-0x00007FFAA71E0000-memory.dmp

Filesize
64KB

Download
memory/1664-218-0x00007FFAA71D0000-0x00007FFAA71E0000-memory.dmp

Filesize
64KB

Download
memory/1664-219-0x00007FFAA71D0000-0x00007FFAA71E0000-memory.dmp

Filesize
64KB

Download
memory/1664-220-0x00007FFAA71D0000-0x00007FFAA71E0000-memory.dmp

Filesize
64KB

Download
memory/3572-178-0x0000000180000000-0x000000018002D000-memory.dmp

Filesize
180KB

Download
memory/3572-181-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads