emotet | 063765712d9b927f451d12c8942b49ef16314a40eb0b712705890938621507e1

General

Target

063765712d9b927f451d12c8942b49ef16314a40eb0b712705890938621507e1.doc
Size

517.3MB
MD5

fe0663ef96b6e916a839fbb851e384ba
SHA1

e97c8595049212855ddeb47fec02601b6307d035
SHA256

063765712d9b927f451d12c8942b49ef16314a40eb0b712705890938621507e1
SHA512

da5bc32fe37542dc4a9d3929a188a7e02a25072982775b6662ca96bd68017ab221f1f03fa495ef669bd3225c30e6b1f2be7935e65837b99cdcad59f788ebae59
SSDEEP

3072:uosSDQfMMRS6l3qqwaYnM9qpHibAdQO1UWT+BMF6pxg+ksaWslSTZ5kEqzIoDK6:uohMR1w9pHicdQOoXpS+aWCBEoI

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4640	4100	regsvr32.exe	WINWORD.EXE

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exe

pid process

4640 regsvr32.exe
4640 regsvr32.exe

pid	process
4640	regsvr32.exe
4640	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4100 WINWORD.EXE
4100 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

4640 regsvr32.exe
4640 regsvr32.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

WINWORD.EXE

pid process

4100 WINWORD.EXE
4100 WINWORD.EXE
4100 WINWORD.EXE
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

WINWORD.EXE

pid process

4100 WINWORD.EXE
4100 WINWORD.EXE
4100 WINWORD.EXE
4100 WINWORD.EXE
4100 WINWORD.EXE
4100 WINWORD.EXE
4100 WINWORD.EXE
4100 WINWORD.EXE

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
4100	WINWORD.EXE
4100	WINWORD.EXE

pid	process
4640	regsvr32.exe
4640	regsvr32.exe

pid	process
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE

pid	process
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE
4100	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

WINWORD.EXEregsvr32.exe

description	pid	process	target process
PID 4100 wrote to memory of 4640	4100	WINWORD.EXE	regsvr32.exe
PID 4100 wrote to memory of 4640	4100	WINWORD.EXE	regsvr32.exe
PID 4640 wrote to memory of 2308	4640	regsvr32.exe	regsvr32.exe
PID 4640 wrote to memory of 2308	4640	regsvr32.exe	regsvr32.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\063765712d9b927f451d12c8942b49ef16314a40eb0b712705890938621507e1.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\214751.tmp"
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DPzcMkSCqbGST\JSMQBosHTlSL.dll"
3⤵
PID:2308

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\55f8c9f1912c4113b612c9267b27b6c6 /t 5096 /p 4100
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\214751.tmp

Filesize
530.5MB

MD5
02bef99bf9889832a623aa330e7b2af1

SHA1
9289749437d8c4ae863af4f9b2275ef0023e645f

SHA256
2c948b98ee6a3d417795cc97bc506f1b8d1292d1527e99c1a7b1cb21ae043bed

SHA512
198c0a9cfa1db9545f54f77f542cf7bf5422bb413a14218ef978a5d9f5e069560913c72aca4116bfb2e2fdc2c2026af2415c4b9dd7c73c494c01eb19b38d307d

Download Submit
C:\Users\Admin\AppData\Local\Temp\214752.zip

Filesize
815KB

MD5
2fa0aea593ea66b53d1c6117445ca136

SHA1
69a692bfdc635544a99038fb794fdfb037359545

SHA256
059c96c37fe1a1fa46513c8218d5c7d031400d4f37ced761d4e05d1539acf3c0

SHA512
791c6c78885a6cb7e2af8698c3fc7b9f42edd25fefc5a70bc02cb693df129d342ea5efe3b9df271742976b5d65cb31f33a6b5258caf42f0fd15a0cdcae3b6766

Download Submit
\Users\Admin\AppData\Local\Temp\214751.tmp

Filesize
530.5MB

MD5
02bef99bf9889832a623aa330e7b2af1

SHA1
9289749437d8c4ae863af4f9b2275ef0023e645f

SHA256
2c948b98ee6a3d417795cc97bc506f1b8d1292d1527e99c1a7b1cb21ae043bed

SHA512
198c0a9cfa1db9545f54f77f542cf7bf5422bb413a14218ef978a5d9f5e069560913c72aca4116bfb2e2fdc2c2026af2415c4b9dd7c73c494c01eb19b38d307d

Download Submit
\Users\Admin\AppData\Local\Temp\214751.tmp

Filesize
530.5MB

MD5
02bef99bf9889832a623aa330e7b2af1

SHA1
9289749437d8c4ae863af4f9b2275ef0023e645f

SHA256
2c948b98ee6a3d417795cc97bc506f1b8d1292d1527e99c1a7b1cb21ae043bed

SHA512
198c0a9cfa1db9545f54f77f542cf7bf5422bb413a14218ef978a5d9f5e069560913c72aca4116bfb2e2fdc2c2026af2415c4b9dd7c73c494c01eb19b38d307d

Download Submit
memory/4100-122-0x00007FFF21FF0000-0x00007FFF22000000-memory.dmp

Filesize
64KB

Download
memory/4100-123-0x00007FFF21FF0000-0x00007FFF22000000-memory.dmp

Filesize
64KB

Download
memory/4100-119-0x00007FFF25A60000-0x00007FFF25A70000-memory.dmp

Filesize
64KB

Download
memory/4100-118-0x00007FFF25A60000-0x00007FFF25A70000-memory.dmp

Filesize
64KB

Download
memory/4100-116-0x00007FFF25A60000-0x00007FFF25A70000-memory.dmp

Filesize
64KB

Download
memory/4100-117-0x00007FFF25A60000-0x00007FFF25A70000-memory.dmp

Filesize
64KB

Download
memory/4640-349-0x0000000002270000-0x00000000022F8000-memory.dmp

Filesize
544KB

Download
memory/4640-351-0x0000000180000000-0x000000018002D000-memory.dmp

Filesize
180KB

Download
memory/4640-361-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/4640-383-0x0000000002270000-0x00000000022F8000-memory.dmp

Filesize
544KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads