emotet | 61e39d6315924cf6e7bd41cdc6b81cc815ad0ef9f6d86f515c43b8f6b35211a4

General

Target

2023-03-08_1025.doc
Size

537.3MB
MD5

183aff7571708bfe62f6fa5970f9291e
SHA1

6e4cf58ed7fa40754f7cca2cb59d8342f47d5b4d
SHA256

a4cc1fff6eae705fab7fe91be559831ca6d55c604897edaeef099a7d9598dd42
SHA512

44c59f2d3178c3ffe0a3ae196cb8a12645e8ab81b4f40260622c6a7e5017840faca522ecc7ad6092e61af4996ce60f7e33121dcb2fae6e80343186435e3b1e30
SSDEEP

6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3336	4252	regsvr32.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 43 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4252 WINWORD.EXE
4252 WINWORD.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

4252 WINWORD.EXE
4252 WINWORD.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

WINWORD.EXE

pid process

4252 WINWORD.EXE
4252 WINWORD.EXE
4252 WINWORD.EXE
4252 WINWORD.EXE

description	flow	ioc
HTTP User-Agent header	43	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
4252	WINWORD.EXE
4252	WINWORD.EXE

pid	process
4252	WINWORD.EXE
4252	WINWORD.EXE

pid	process
4252	WINWORD.EXE
4252	WINWORD.EXE
4252	WINWORD.EXE
4252	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2023-03-08_1025.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4252

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\032255.tmp"
2⤵
- Process spawned unexpected child process
PID:3336

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XneqiYE\VtsWXsUyIyUpAl.dll"
3⤵
PID:4196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\032255.tmp
Filesize
453.2MB

MD5
48f7e1ee0066a764e799addad5005847

SHA1
ad9d398227fde348d21d027ed212735601778e42

SHA256
7034e7abe030982edddda45eb1c98b28fa2d8a95bff46d805eebcc264838476f

SHA512
8d8bbd440660dc1ea5030406cd676dce2ef8ec43a1d41c2710a49327e8d8634f8e0e3cf45724441c1fbdae0edfe8e257e287dabb6774f6695d8c7b86b4c1782a

Download Submit
C:\Users\Admin\AppData\Local\Temp\032255.tmp
Filesize
460.1MB

MD5
bf3151c2710b4fc5e3068fafe55c9312

SHA1
ac34d49716f4049c7787474175f6d564651b3d1a

SHA256
5c7e6a50db689c0dd0ffe3840684d1b4fd847750f5d681ba96fac054e49fd0b0

SHA512
2acd8312006da65ace9e1a73d3ec61db14f8bf5f5d73bd6b8092a205c15c04d6e3732e12f31d29acbf4a21f6d9877ac8b11b45106b58bd54a42996504bc624e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\032255.tmp
Filesize
432.6MB

MD5
72633e12ea3299336f5fe2b6f0233027

SHA1
ecee84d9c14fffb1f2eaf6c3d6373eeb6e8dda57

SHA256
b7fea9e904a2bc337b1061426c243a78070d88262181558192a71c41f374ed03

SHA512
e15b4e48f5496544905d59dfae6d1c7d2f0ea4b39fc2239b201dab2d7d1d6dca95219946d88dd614d8fc544f5bd2f137c30485aa19fb2d295dc597dbf3ecdbd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\032257.zip
Filesize
867KB

MD5
6c839d892fef2f37d973ca28ce5e7a3b

SHA1
175ee07dc770ad81455d1f95152f1ae07e875e0e

SHA256
b2f19314b692f584203e6711e8d54f32b91a7864adbd203a4eaf6785042d47d9

SHA512
18a1ffa1876554a0e7716cbe5d77ce26a373aeb16992986bb8baaece2af502b576d7001a4271ceda09cec6fbbe750c06c8d40d4449ff8b52d01a924a49462af7

Download Submit
C:\Windows\System32\XneqiYE\VtsWXsUyIyUpAl.dll
Filesize
382.3MB

MD5
45e06ae09990c671d265b326d44d881a

SHA1
3602d0ba2b79d842f6bae7cb2619e469266d6c01

SHA256
3893bb6861ee1acf0f4ca3f993ddc75d24a6c4ddd134f0b30d7b2998497bb800

SHA512
c88fb09c24d11ea6acf02773471edd45076cca9534a8a3bdd4cc3518b2b9b4e4adc478cb7f529b4899987b39481d19c936a95c8b974d86a3b136c3a93df9ea13

Download Submit
C:\Windows\System32\XneqiYE\VtsWXsUyIyUpAl.dll
Filesize
331.7MB

MD5
ab2d6612af5ec2a6cff820de392a4399

SHA1
c7a845ec527fe34ce5db9a985b41e1cdc9d7ed84

SHA256
1d8026b17dd8218bf59d7b78618efb2c7e3cc92a0235167732340b911bfc578b

SHA512
91c0a0d81f9783b4f37d4618f64baaecef7478633cf9e0969dc17db83d6f23ced8c6f69e6847103e3a355cbbc87af5eecc5417843c51eb8d26ae2eef5727789a

Download Submit
memory/3336-180-0x00000000021D0000-0x0000000002291000-memory.dmp

Filesize
772KB

Download
memory/3336-182-0x0000000180000000-0x000000018002D000-memory.dmp

Filesize
180KB

Download
memory/3336-186-0x00000000021D0000-0x0000000002291000-memory.dmp

Filesize
772KB

Download
memory/3336-185-0x00000000008F0000-0x00000000008F1000-memory.dmp

Filesize
4KB

Download
memory/4196-194-0x0000000001F30000-0x0000000001FF1000-memory.dmp

Filesize
772KB

Download
memory/4196-189-0x0000000001F30000-0x0000000001FF1000-memory.dmp

Filesize
772KB

Download
memory/4252-135-0x00007FFE548F0000-0x00007FFE54900000-memory.dmp

Filesize
64KB

Download
memory/4252-134-0x00007FFE548F0000-0x00007FFE54900000-memory.dmp

Filesize
64KB

Download
memory/4252-136-0x00007FFE548F0000-0x00007FFE54900000-memory.dmp

Filesize
64KB

Download
memory/4252-137-0x00007FFE548F0000-0x00007FFE54900000-memory.dmp

Filesize
64KB

Download
memory/4252-133-0x00007FFE548F0000-0x00007FFE54900000-memory.dmp

Filesize
64KB

Download
memory/4252-139-0x00007FFE52690000-0x00007FFE526A0000-memory.dmp

Filesize
64KB

Download
memory/4252-138-0x00007FFE52690000-0x00007FFE526A0000-memory.dmp

Filesize
64KB

Download
memory/4252-224-0x00007FFE548F0000-0x00007FFE54900000-memory.dmp

Filesize
64KB

Download
memory/4252-225-0x00007FFE548F0000-0x00007FFE54900000-memory.dmp

Filesize
64KB

Download
memory/4252-226-0x00007FFE548F0000-0x00007FFE54900000-memory.dmp

Filesize
64KB

Download
memory/4252-227-0x00007FFE548F0000-0x00007FFE54900000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads