emotet | 0ec6e38d48f00dcf50d2f7cc98034cdac78b5760b1bba1f21900e3acde65a849

General

Target

Rechnung 2023.14.03_1102.doc
Size

517.3MB
MD5

40ac024d3b10c4496f47f9adfb80962b
SHA1

e000a44c935d53b2dc99ceef3cd4d28ffe90c1bb
SHA256

bc1694b34546b4fa07862b44651d11686f92ccfa9ef7069499c191794daef0db
SHA512

cb0d139b73833398a39caadb57b48379adf9300e6bbcf1b1bb6d5b8c18a53978f2ba89b786f8d1b0733b565d67e1e5f63da2c9cdf412bc283db05d27e350d3a3
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

164.68.99.3:8080

164.90.222.65:443

186.194.240.217:443

1.234.2.232:8080

103.75.201.2:443

187.63.160.88:80

147.139.166.154:8080

91.207.28.33:8080

5.135.159.50:443

153.92.5.27:8080

213.239.212.5:443

103.43.75.120:443

159.65.88.10:8080

167.172.253.162:8080

153.126.146.25:7080

119.59.103.152:8080

107.170.39.149:8080

183.111.227.137:8080

159.89.202.34:443

110.232.117.186:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	984	4728	regsvr32.exe	WINWORD.EXE

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

984 regsvr32.exe

pid	process
984	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	46	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	30	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4728 WINWORD.EXE
4728 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

984 regsvr32.exe
984 regsvr32.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

WINWORD.EXE

pid process

4728 WINWORD.EXE
4728 WINWORD.EXE
4728 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

4728 WINWORD.EXE
4728 WINWORD.EXE
4728 WINWORD.EXE
4728 WINWORD.EXE
4728 WINWORD.EXE
4728 WINWORD.EXE
4728 WINWORD.EXE

pid	process
4728	WINWORD.EXE
4728	WINWORD.EXE

pid	process
984	regsvr32.exe
984	regsvr32.exe

pid	process
4728	WINWORD.EXE
4728	WINWORD.EXE
4728	WINWORD.EXE

pid	process
4728	WINWORD.EXE
4728	WINWORD.EXE
4728	WINWORD.EXE
4728	WINWORD.EXE
4728	WINWORD.EXE
4728	WINWORD.EXE
4728	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 4728 wrote to memory of 984	4728	WINWORD.EXE	regsvr32.exe
PID 4728 wrote to memory of 984	4728	WINWORD.EXE	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Rechnung 2023.14.03_1102.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\113014.tmp"
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:984

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JqrBDOnkf\vueyZRweWPIaADk.dll"
3⤵
PID:4608

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\113014.tmp
Filesize
533.8MB

MD5
61915102b5ae6a07e47400577361cfd4

SHA1
7826a2e11b3b6d6fc238b1d0dca2b978ced9ea50

SHA256
acb04f6e81ea9fc74cd71b0d1fae47b7803c8e46fcdc89829ad82a26e1471ad6

SHA512
758f5e785d9a93bcb7f47c718b68d2d771d6e76ba8fa08b88133e5a77738820a54d9359d43d0f09a1319b0b51cc1200c3c4f1fd9e2bcd8edcbc39209d4fbaace

Download Submit
C:\Users\Admin\AppData\Local\Temp\113014.tmp
Filesize
548.5MB

MD5
054707d15f01bb9a9142822a51a4494d

SHA1
cef49b0cc657be309fd002b41ef746a46592545d

SHA256
777d51734dd0d52d204be4bd3bf45fbdaf98b395d1818bf03bd53e41a8cb588c

SHA512
6102880474f61d1784458d4dba6b9f8e347dae64fccfb1cb221af16089a58bfecbc2a8f61652803cd2650966d6db40c5d0bf88dd050f9048002026659f500641

Download Submit
C:\Users\Admin\AppData\Local\Temp\113050.zip
Filesize
854KB

MD5
4e68ba145fa85af5242dfb5be4ac1f24

SHA1
5e948284d6378eee6ec448c944faff43bb2eea37

SHA256
5e73dbb35541709ac1a5887167dd503e7b1bffd3f5acf115df521cb8ea9a63ff

SHA512
9b4b16b253ed6120d97c60f36203e3a764e093902e59d0d415086eb3154ffc6f98d41d81c3c93462fdbbe0d23482cd54e270faa23a480846ea5f2e12af1ba4fc

Download Submit
C:\Windows\System32\JqrBDOnkf\vueyZRweWPIaADk.dll
Filesize
508.3MB

MD5
6c08308f35b121c72860e927be5e4cd3

SHA1
12a37976533102de705bad76197f9ca5c841b9f5

SHA256
a460829b41eb065a0c9e43fe8f580ad53bc4b6043c93fc9011ec8a2132a0d1fc

SHA512
e6a7b83a1e8ae0d7d17a0ec5b4569c7dab1c13d9f7d154c590f03887d4a595c5f008f57c2e7f1b6e97c4d6aba29244d6571695ce21b0ead8a6745104a62e25ca

Download Submit
memory/984-182-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/984-179-0x0000000002A50000-0x0000000002A7D000-memory.dmp

Filesize
180KB

Download
memory/4728-136-0x00007FFB14BD0000-0x00007FFB14BE0000-memory.dmp

Filesize
64KB

Download
memory/4728-139-0x00007FFB12B70000-0x00007FFB12B80000-memory.dmp

Filesize
64KB

Download
memory/4728-138-0x00007FFB12B70000-0x00007FFB12B80000-memory.dmp

Filesize
64KB

Download
memory/4728-137-0x00007FFB14BD0000-0x00007FFB14BE0000-memory.dmp

Filesize
64KB

Download
memory/4728-133-0x00007FFB14BD0000-0x00007FFB14BE0000-memory.dmp

Filesize
64KB

Download
memory/4728-134-0x00007FFB14BD0000-0x00007FFB14BE0000-memory.dmp

Filesize
64KB

Download
memory/4728-135-0x00007FFB14BD0000-0x00007FFB14BE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads