emotet | 8c9068ba10a1e96dfbff0d53492dc251f0d203ff01eed75f7661a918cfff7d34

Resubmissions

08/03/2023, 02:21

230308-cs4mysde97 8

08/03/2023, 01:53

230308-ca7lwsch8w 10

Analysis

max time kernel
6s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2023, 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-03-08_1035.doc
Size

517.3MB
MD5

bcae0aca1a3b2df9d5e85de2ed3666e9
SHA1

f56c3b72b7e8c55b9685e35765553fafbbb08e2b
SHA256

5a092b0034f937f68ad7e5679ed840039fb824df8cad8f74b890cb7f4e42f0cd
SHA512

4162200952e62402a6085ae5f1342a5b35d59f52a5ddf54d9eea3d318f62df9ca308cfc3e079cca484ab38af1ed17fa68fe9ad0c9541ff483aa3de20fff44afa
SSDEEP

6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4316	3992	regsvr32.exe	86

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	30	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3992	WINWORD.EXE
3992	WINWORD.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3992	WINWORD.EXE
3992	WINWORD.EXE
3992	WINWORD.EXE
3992	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2023-03-08_1035.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3992
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\015422.tmp"
  2⤵
  - Process spawned unexpected child process
  PID:4316
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FqFSlQKS\zaQEDCVxuosWQe.dll"
    3⤵
    PID:4068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\015422.tmp

Filesize
241.9MB

MD5
1252bf76cce1e86ece326c5aa7383a54

SHA1
2c25d637c2aefcc2f45aa0b25f5f9d0d2fcb6b2e

SHA256
447751cc330b2f586d05a6cb7e2287b008ebe60d8872da5cec6b3bacff99cabd

SHA512
5cd4c42ab3d251c8191a7644e5b4041792964382ae9a486293dbdd4beac514bc241525e42555ebdab6a57db58098237ca248c0cf560822fea2d4407b4471db51

Download Submit
C:\Users\Admin\AppData\Local\Temp\015422.tmp

Filesize
242.6MB

MD5
eeaa53b66e1451aa201db1dcb6898875

SHA1
9cf14eacefad079ab85a48bcf732465aa5d92910

SHA256
87ca2ad9e3dbba9169009a4b5ebd3b09ac15533f4e549360fcdf4c0e85f5fc55

SHA512
a9301ed0d6a7fdc8b637379b579a1291777868f63c1f8841c3317547ceabdfa7aa533e52e2a35af3f90d96d1aed287af09ac60eed80e2e6a5b59441e176928d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\015423.zip

Filesize
875KB

MD5
ec0b4c8e920c852946a0d690ee2cd586

SHA1
cb41f39dbe450baf40f9fbb4b1ec4e0607f1ae5a

SHA256
80149f6492b1d711bd03b600f2199f7a3db402acf72f4b48afd7dfe04fe5e57b

SHA512
0a60f530f26dc279f24f0a4792407f0055173a55cc6cec30ed49a3212a931cd36ebc38ad5da5cc00af53f41c8023ea3140d5c5c1c29fd1451457814e8f8f51a6

Download Submit
C:\Windows\System32\FqFSlQKS\zaQEDCVxuosWQe.dll

Filesize
230.2MB

MD5
32fa2bb4b77ddbb682bb0a51bccb3af7

SHA1
a52220f0af21941457bc10386172c259dff5c7d0

SHA256
e9c0cbf4a6e1250d3a843bfff7448441c7ab4fc6ef0bb83d9877c1440b8957fd

SHA512
7ee5152c6570346599ee175ded57101f6f41a5dfd46ab79a38ac6493ab54c03d6b3fc21ecadb20f6eefcc4700b35efa100668c4e78069bf1e0029dcd0af08ca8

Download Submit
C:\Windows\System32\FqFSlQKS\zaQEDCVxuosWQe.dll

Filesize
240.9MB

MD5
b71ef8880351219080677df9771fcbbe

SHA1
78d86cfba724ad3b1134001471a07758fd24409d

SHA256
0feb058be75548e923c60a036c9e5e3e39c86ee39d422d93943709bc947adbd8

SHA512
0daf3cce671641566b4cac74390eac07a168a229841d56fdfb4f3196560cf986e5e03bd6e93fd90264aa4adba61d665f87af84236795a3c9fe6e133be67b5f23

Download Submit
memory/3992-137-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/3992-139-0x00007FFAE71F0000-0x00007FFAE7200000-memory.dmp

Filesize
64KB

Download
memory/3992-138-0x00007FFAE71F0000-0x00007FFAE7200000-memory.dmp

Filesize
64KB

Download
memory/3992-218-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/3992-219-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/3992-220-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/3992-136-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/3992-217-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/3992-135-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/3992-134-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/3992-133-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/4068-191-0x00000000020B0000-0x0000000002160000-memory.dmp

Filesize
704KB

Download
memory/4068-185-0x00000000020B0000-0x0000000002160000-memory.dmp

Filesize
704KB

Download
memory/4316-176-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/4316-174-0x0000000180000000-0x000000018002D000-memory.dmp

Filesize
180KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads