emotet | a66276f066d74f9bd08be56707f334df41ad38561a2b39381a68a166fd4ac35c

General

Target

Fattura 98978.doc
Size

537.3MB
MD5

8064fcb1beed9f3ae6d71c5c18f7da08
SHA1

bc964aeda83f862e4f0b5248fc3d9c2ed5949cff
SHA256

01792c064f0125ee220c2665746b52dfd91e1eeb8b5f58b0dc4f8d19212c5e07
SHA512

ce5d7cba167dc3b2c6822f847afa8acd250c9d6d5a8aa6db0d007422d08166b132e63d4795c6bd5293265079d3bcbce50ed6738a85b3b224a2d5fc3af2602cf5
SSDEEP

6144:1620tqUx3Xu+7ZkRIDNGi9a0Va5UAClo:1620tqm3+I2ezcz5U3lo

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

164.68.99.3:8080

164.90.222.65:443

186.194.240.217:443

1.234.2.232:8080

103.75.201.2:443

187.63.160.88:80

147.139.166.154:8080

91.207.28.33:8080

5.135.159.50:443

153.92.5.27:8080

213.239.212.5:443

103.43.75.120:443

159.65.88.10:8080

167.172.253.162:8080

153.126.146.25:7080

119.59.103.152:8080

107.170.39.149:8080

183.111.227.137:8080

159.89.202.34:443

110.232.117.186:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1056	4620	regsvr32.exe	WINWORD.EXE

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1056 regsvr32.exe

pid	process
1056	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	34	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	37	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4620 WINWORD.EXE
4620 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1056 regsvr32.exe
1056 regsvr32.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

WINWORD.EXE

pid process

4620 WINWORD.EXE
4620 WINWORD.EXE
4620 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

4620 WINWORD.EXE
4620 WINWORD.EXE
4620 WINWORD.EXE
4620 WINWORD.EXE
4620 WINWORD.EXE
4620 WINWORD.EXE
4620 WINWORD.EXE

pid	process
4620	WINWORD.EXE
4620	WINWORD.EXE

pid	process
1056	regsvr32.exe
1056	regsvr32.exe

pid	process
4620	WINWORD.EXE
4620	WINWORD.EXE
4620	WINWORD.EXE

pid	process
4620	WINWORD.EXE
4620	WINWORD.EXE
4620	WINWORD.EXE
4620	WINWORD.EXE
4620	WINWORD.EXE
4620	WINWORD.EXE
4620	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 4620 wrote to memory of 1056	4620	WINWORD.EXE	regsvr32.exe
PID 4620 wrote to memory of 1056	4620	WINWORD.EXE	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Fattura 98978.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4620

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\090827.tmp"
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1056

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZfIizpFJ\lwqGoxlPu.dll"
3⤵
PID:3328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\090827.tmp
Filesize
424.2MB

MD5
ce71a3224d901325fa7d6b568a2dae27

SHA1
1eb95b8cd273dde4d1f7bf2198397a27be6556c1

SHA256
0755966660e9576f548ad4fd6397668383a789e3c8d27aa1c88ddd2def64e29f

SHA512
87aa83fe2de4d09d5fb8f93f70d2d8ae770c030e3f88a7df01eb3b8ed32cff260e2922e29cf163411125bd77d45f319d47e7eb6f6bd20d5069d0add5d457b2ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\090827.tmp
Filesize
395.5MB

MD5
dceb94bd5159b00e8427ac7ee2f226d5

SHA1
e2eecd382e4e31771641072fdbda0ac98335333d

SHA256
b2c235578e67987d13df747befb615dd5d8514833028b21df83bdaecf788fd72

SHA512
efe72f9a1067cbc14bb84c682ee4b6cf3818bfada88215154d3efaa3850d75c2419c6fbdc463c1d43cb5345826f0c60b104c618e7a568a31151df909392bd784

Download Submit
C:\Users\Admin\AppData\Local\Temp\090832.zip
Filesize
848KB

MD5
6ca08498216e84fe3c72d921398f0795

SHA1
66d202b530cf08f7482d0a99c96b11528ec6fd44

SHA256
c3d815983921d2913b0f92f45e75068044fd0652ad7983cb96470034cd13591d

SHA512
145af7b6fef38976c8c5e83b0c9e3a365921b0907be171a9d6c16d6a72221ae293710c03453168761fd9e0b026212268dd58b78c36f46dc3bb3e71f080cccddb

Download Submit
C:\Windows\System32\ZfIizpFJ\lwqGoxlPu.dll
Filesize
384.6MB

MD5
0509c051092cc287db3b48948d25497e

SHA1
728c607e6472e8aee2333ac4e0c7a8b9037129ce

SHA256
6eeb35f086a25d004b7e7aa0a8a4dc89e0df8f36866a3c25a94c4f3e8b1d0ea5

SHA512
3a66893244d4055abf07311185bd1b13c68f6dcdecf973f892a07d82675520f679ac21fc3146dad1099c08897f10c0c12cfe3b6578de7550fa550bacce78c7f4

Download Submit
memory/1056-179-0x0000000000D00000-0x0000000000D2D000-memory.dmp

Filesize
180KB

Download
memory/1056-182-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/4620-134-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/4620-136-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/4620-135-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/4620-139-0x00007FFAE71F0000-0x00007FFAE7200000-memory.dmp

Filesize
64KB

Download
memory/4620-137-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/4620-138-0x00007FFAE71F0000-0x00007FFAE7200000-memory.dmp

Filesize
64KB

Download
memory/4620-133-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/4620-206-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/4620-209-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/4620-208-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download
memory/4620-207-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads