emotet | a13b394e4017c0c77faf4fab6c3aea4de3443f11610cc85a1d677249b9b2bc3a

Analysis

max time kernel
19s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2023, 05:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2023-03-08_1344.doc
Size 531.3MB
Sample230311-ggcsbagf94
SHA256 a13b394e4017c0c77faf4fab6c3aea4de3443f11610cc85a1d677249b9b2bc3a
MD5 c94b346a8cd79d18355ca7496c244bd2
SHA1 1500305a5d96eb6944b890a776beaabd49b3382a
SHA512 b1392f8a7a849b1c7095a210c4b9213c165fe693eece7929e67735b34ce684feea9123e09716e5df8ec10e8cf4488049b1d37596d46f90da3ec971dbe9ea0baf
SSDEEP 6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

129.232.188.93:443
164.90.222.65:443
159.65.88.10:8080
172.105.226.75:8080
115.68.227.76:8080
187.63.160.88:80
169.57.156.166:8080
185.4.135.165:8080
153.126.146.25:7080
197.242.150.244:8080
139.59.126.41:443
186.194.240.217:443
103.132.242.26:8080
206.189.28.199:8080
163.44.196.120:8080
95.217.221.146:8080
159.89.202.34:443
119.59.103.152:8080
183.111.227.137:8080
201.94.166.162:443
103.75.201.2:443
149.56.131.28:8080
79.137.35.198:8080
5.135.159.50:443
66.228.32.31:7080
91.121.146.47:8080
153.92.5.27:8080
45.235.8.30:8080
72.15.201.15:8080
107.170.39.149:8080
45.176.232.124:443
82.223.21.224:8080
167.172.199.165:8080
213.239.212.5:443
202.129.205.3:8080
94.23.45.86:4143
147.139.166.154:8080
167.172.253.162:8080
91.207.28.33:8080
188.44.20.25:443
104.168.155.143:8080
110.232.117.186:8080
164.68.99.3:8080
1.234.2.232:8080
173.212.193.249:8080
182.162.143.56:443
160.16.142.56:8080
101.50.0.91:8080
103.43.75.120:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4344	1864	regsvr32.exe	38

Loads dropped DLL 3 IoCs

pid	Process
4344	regsvr32.exe
720	regsvr32.exe
720	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	45	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1864	WINWORD.EXE
1864	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4344	regsvr32.exe
4344	regsvr32.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE
1864	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4344	1864	WINWORD.EXE	90
PID 1864 wrote to memory of 4344	1864	WINWORD.EXE	90
PID 4344 wrote to memory of 720	4344	regsvr32.exe	93
PID 4344 wrote to memory of 720	4344	regsvr32.exe	93

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2023-03-08_1344.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\064728.tmp"
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CpVCKWcHIirbOH\TyRlZjIw.dll"
    3⤵
    - Loads dropped DLL
    PID:720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

064728.tmp

Path C:\Users\Admin\AppData\Local\Temp\064728.tmp
Size 543.7MB
SHA256 af9f8a5c3e4edb4798c25b6fe3e41eeba5d4a41782dbf81a7ba5b3a93652a02a
MD5 1cd2550e072ec2792339b133005549ed
SHA1 c2839a8bc63517bcee9ec16a222690e0f8aa3a74
SHA512 e77442d144cad2635a3078a5359b24d9febc164fdfb6424cff5b4d02775ece2df3bdf6575170a9eec9b1d3ce22370efb726c9c611db86fac8d530ce2e9a7903e
SSDEEP 24576:jdYCJMj0Bc3wxTwdmlyhHr7+k2bJuFKHQVZbb:jGCJMjmc3w3AT2b4FKG
MD5 SHA1 SHA512 SSDEEP

Submit Download

064728.tmp

Path C:\Users\Admin\AppData\Local\Temp\064728.tmp
Size 543.7MB
SHA256 af9f8a5c3e4edb4798c25b6fe3e41eeba5d4a41782dbf81a7ba5b3a93652a02a
MD5 1cd2550e072ec2792339b133005549ed
SHA1 c2839a8bc63517bcee9ec16a222690e0f8aa3a74
SHA512 e77442d144cad2635a3078a5359b24d9febc164fdfb6424cff5b4d02775ece2df3bdf6575170a9eec9b1d3ce22370efb726c9c611db86fac8d530ce2e9a7903e
SSDEEP 24576:jdYCJMj0Bc3wxTwdmlyhHr7+k2bJuFKHQVZbb:jGCJMjmc3w3AT2b4FKG
MD5 SHA1 SHA512 SSDEEP

Submit Download

064730.zip

Path C:\Users\Admin\AppData\Local\Temp\064730.zip
Size 867KB
SHA256 b2f19314b692f584203e6711e8d54f32b91a7864adbd203a4eaf6785042d47d9
MD5 6c839d892fef2f37d973ca28ce5e7a3b
SHA1 175ee07dc770ad81455d1f95152f1ae07e875e0e
SHA512 18a1ffa1876554a0e7716cbe5d77ce26a373aeb16992986bb8baaece2af502b576d7001a4271ceda09cec6fbbe750c06c8d40d4449ff8b52d01a924a49462af7
SSDEEP 6144:U0ODy+y5fPfnMe6OKYn02Fyrkw6ppGN8OoZf0cK2/KEPi9WP:UE+y5UeQ6okw6WN8OoOcv/KEPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TyRlZjIw.dll

Path C:\Windows\System32\CpVCKWcHIirbOH\TyRlZjIw.dll
Size 543.7MB
SHA256 af9f8a5c3e4edb4798c25b6fe3e41eeba5d4a41782dbf81a7ba5b3a93652a02a
MD5 1cd2550e072ec2792339b133005549ed
SHA1 c2839a8bc63517bcee9ec16a222690e0f8aa3a74
SHA512 e77442d144cad2635a3078a5359b24d9febc164fdfb6424cff5b4d02775ece2df3bdf6575170a9eec9b1d3ce22370efb726c9c611db86fac8d530ce2e9a7903e
SSDEEP 24576:jdYCJMj0Bc3wxTwdmlyhHr7+k2bJuFKHQVZbb:jGCJMjmc3w3AT2b4FKG
MD5 SHA1 SHA512 SSDEEP

Submit Download

TyRlZjIw.dll

Path C:\Windows\System32\CpVCKWcHIirbOH\TyRlZjIw.dll
Size 543.7MB
SHA256 af9f8a5c3e4edb4798c25b6fe3e41eeba5d4a41782dbf81a7ba5b3a93652a02a
MD5 1cd2550e072ec2792339b133005549ed
SHA1 c2839a8bc63517bcee9ec16a222690e0f8aa3a74
SHA512 e77442d144cad2635a3078a5359b24d9febc164fdfb6424cff5b4d02775ece2df3bdf6575170a9eec9b1d3ce22370efb726c9c611db86fac8d530ce2e9a7903e
SSDEEP 24576:jdYCJMj0Bc3wxTwdmlyhHr7+k2bJuFKHQVZbb:jGCJMjmc3w3AT2b4FKG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/720-191-0x0000000001E80000-0x0000000001F41000-memory.dmp

Download

memory/720-185-0x0000000001E80000-0x0000000001F41000-memory.dmp

Download

memory/1864-133-0x00007FFB42DD0000-0x00007FFB42DE0000-memory.dmp

Download

memory/1864-137-0x00007FFB42DD0000-0x00007FFB42DE0000-memory.dmp

Download

memory/1864-136-0x00007FFB42DD0000-0x00007FFB42DE0000-memory.dmp

Download

memory/1864-134-0x00007FFB42DD0000-0x00007FFB42DE0000-memory.dmp

Download

memory/1864-138-0x00007FFB40510000-0x00007FFB40520000-memory.dmp

Download

memory/1864-135-0x00007FFB42DD0000-0x00007FFB42DE0000-memory.dmp

Download

memory/1864-139-0x00007FFB40510000-0x00007FFB40520000-memory.dmp

Download

memory/1864-219-0x00007FFB42DD0000-0x00007FFB42DE0000-memory.dmp

Download

memory/1864-221-0x00007FFB42DD0000-0x00007FFB42DE0000-memory.dmp

Download

memory/1864-220-0x00007FFB42DD0000-0x00007FFB42DE0000-memory.dmp

Download

memory/1864-222-0x00007FFB42DD0000-0x00007FFB42DE0000-memory.dmp

Download

memory/4344-174-0x0000000180000000-0x000000018002D000-memory.dmp

Download

memory/4344-177-0x0000000001490000-0x0000000001491000-memory.dmp

Download