emotet | 460342a05051b974d40ef02b1db38920ccea1c3d675f3c0717bf52cfe8f0df45

Analysis

max time kernel
207s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2023, 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO 03082023.doc
Size

519.6MB
MD5

eae07af58bf8661fb1a3ff24ffdb7d98
SHA1

496219e9ea5f5c0beee00311471853759028029a
SHA256

93fda5715150ad97dfd2e12320e7535360e07f05ea5f40a16c9f6bf73ece15e5
SHA512

6acc93a954018e6c515abe3d63ae381ee12457516c57a9e9df22cb1a90dd957c55bc811c3656c7af4d50e7c0194749fd2577c55565d6268903c5069e0176027e
SSDEEP

12288:sSVFHNUr1LCHFIAHrQk6VDL6P+4f1IzSmkuH3gv:sSVFH48HFIABZfSzQ

Score

10^/10

emotet epoch4 banker persistence trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

164.68.99.3:8080

164.90.222.65:443

186.194.240.217:443

1.234.2.232:8080

103.75.201.2:443

187.63.160.88:80

147.139.166.154:8080

91.207.28.33:8080

5.135.159.50:443

153.92.5.27:8080

213.239.212.5:443

103.43.75.120:443

159.65.88.10:8080

167.172.253.162:8080

153.126.146.25:7080

119.59.103.152:8080

107.170.39.149:8080

183.111.227.137:8080

159.89.202.34:443

110.232.117.186:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2512	2288	regsvr32.exe	19

Loads dropped DLL 2 IoCs

pid	Process
2512	regsvr32.exe
4620	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dFEgSbKwzoZuYUk.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\Kpbkj\\dFEgSbKwzoZuYUk.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	42	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	47	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	78	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 4 IoCs

pid	Process
2288	WINWORD.EXE
2288	WINWORD.EXE
1612	WINWORD.EXE
1612	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2512	regsvr32.exe
2512	regsvr32.exe
4620	regsvr32.exe
4620	regsvr32.exe
4620	regsvr32.exe
4620	regsvr32.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
2288	WINWORD.EXE
1612	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2512	2288	WINWORD.EXE	103
PID 2288 wrote to memory of 2512	2288	WINWORD.EXE	103
PID 2512 wrote to memory of 4620	2512	regsvr32.exe	105
PID 2512 wrote to memory of 4620	2512	regsvr32.exe	105

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO 03082023.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\201603.tmp"
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\Kpbkj\dFEgSbKwzoZuYUk.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4620

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:5056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1180

C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.CampaignStates.json

Filesize
537B

MD5
c3f9745c5d18da14e7c1d71faadfe19e

SHA1
7cb864bd1a30094b90e687df5343de1d454f0bba

SHA256
437552fb49d5bbbbc4ec44578fcf8d9a2046d296c378694cfc1d7555dadcdfa3

SHA512
02289fe0ea70f1d3f2f68cc21d9b5f4756ad0871218d489cc6a6c764511e68e1163304b7438bb241dd60bf51534a7fe533ea5f3c8cc12ef2380252ef13cc350e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.GovernedChannelStates.json

Filesize
417B

MD5
c56ff60fbd601e84edd5a0ff1010d584

SHA1
342abb130dabeacde1d8ced806d67a3aef00a749

SHA256
200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c

SHA512
acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.Settings.json

Filesize
87B

MD5
e4e83f8123e9740b8aa3c3dfa77c1c04

SHA1
5281eae96efde7b0e16a1d977f005f0d3bd7aad0

SHA256
6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31

SHA512
bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyEventActivityStats.json

Filesize
111B

MD5
94aa909586ec77323e4263747e6384ae

SHA1
49c937b93a6ef4ce5f998f99875c876168858d42

SHA256
8ff86b0bd232f2b6ae7a401ac31af17d9c15fe69651d3da8ff082d0aa22e78ee

SHA512
f28dee08a89061e95b6e7b3aa06a884ac95906c959f2b6f374d4d18ba5223f817a6d6598c80646d4d16b0e5616298482bd0529d5c995421145624f92b9258f26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Word.SurveyHistoryStats.json

Filesize
14B

MD5
6ca4960355e4951c72aa5f6364e459d5

SHA1
2fd90b4ec32804dff7a41b6e63c8b0a40b592113

SHA256
88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3

SHA512
8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

Filesize
329KB

MD5
49197d4a91c33d9ec952ff98318e296a

SHA1
7d87bb7418298e9aa71bc88e65789fa537a6ed1e

SHA256
a98a89d805bfa81e15eb1a88ff08f63e6a652769357043a12db2b27250942abd

SHA512
14424a8436d2c363d9776384ecde188032ec70d8dd6428ca54ecbb59acaabf5cf61007f87a14c4e02d5c143d6105c19127301feac6f79c5cc34f5d801ada73b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\201603.tmp

Filesize
500.5MB

MD5
158526a1deea136b3aa47d9760232b2b

SHA1
c10d0fc5571d0c614cd31a211e567c3475ef41f5

SHA256
a7668de557a819939d7c61ebb1ea4db50b18e3a863c1b8176df0bff5ce4169cc

SHA512
a12af0d7906303b48f9c0be58d354a5bf4d765cd71b58891f4d01391cde81854939696eeaa4a7c370ae18e10303e57cbcac161aac9e3583cefb9bd0775c89750

Download Submit
C:\Users\Admin\AppData\Local\Temp\201603.tmp

Filesize
500.5MB

MD5
158526a1deea136b3aa47d9760232b2b

SHA1
c10d0fc5571d0c614cd31a211e567c3475ef41f5

SHA256
a7668de557a819939d7c61ebb1ea4db50b18e3a863c1b8176df0bff5ce4169cc

SHA512
a12af0d7906303b48f9c0be58d354a5bf4d765cd71b58891f4d01391cde81854939696eeaa4a7c370ae18e10303e57cbcac161aac9e3583cefb9bd0775c89750

Download Submit
C:\Users\Admin\AppData\Local\Temp\201647.zip

Filesize
795KB

MD5
7200a9fb6680cf36b8284742b2bbe0e3

SHA1
ab7f0edb20ba53418705af038907137cd87c6753

SHA256
4bf24e067d21602596bfa0d702ab8c881c84612fe5bbcd7ccb295559f96fc539

SHA512
c3969295c42d0c2a2ecdd5c71c316946b02e9820af66fc47f4313f43a44a70da3fbeb73617aec5ab0b189790f61c785f73e0b2305893389e684b47cdc8bf7dec

Download Submit
C:\Windows\System32\Kpbkj\dFEgSbKwzoZuYUk.dll

Filesize
500.5MB

MD5
158526a1deea136b3aa47d9760232b2b

SHA1
c10d0fc5571d0c614cd31a211e567c3475ef41f5

SHA256
a7668de557a819939d7c61ebb1ea4db50b18e3a863c1b8176df0bff5ce4169cc

SHA512
a12af0d7906303b48f9c0be58d354a5bf4d765cd71b58891f4d01391cde81854939696eeaa4a7c370ae18e10303e57cbcac161aac9e3583cefb9bd0775c89750

Download Submit
memory/1612-214-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/1612-210-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/1612-219-0x00007FFBAF200000-0x00007FFBAF210000-memory.dmp

Filesize
64KB

Download
memory/1612-215-0x00007FFBAF200000-0x00007FFBAF210000-memory.dmp

Filesize
64KB

Download
memory/1612-213-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/1612-212-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/1612-211-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/2288-208-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/2288-209-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/2288-207-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/2288-133-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/2288-206-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/2288-139-0x00007FFBAF200000-0x00007FFBAF210000-memory.dmp

Filesize
64KB

Download
memory/2288-138-0x00007FFBAF200000-0x00007FFBAF210000-memory.dmp

Filesize
64KB

Download
memory/2288-137-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/2288-136-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/2288-135-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/2288-134-0x00007FFBB13F0000-0x00007FFBB1400000-memory.dmp

Filesize
64KB

Download
memory/2512-184-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/2512-179-0x0000000180000000-0x000000018002D000-memory.dmp

Filesize
180KB

Download