emotet | f01caf1590ee5a59253cc0021d00349dbdec4fa90c15bbaf3bcccb207df577d1

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17-03-2023 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

click.wsf
Size

61KB
MD5

834c86811868bc5ba68d8c6ee3cb10a9
SHA1

692eabf759ef2faf877c45b168cf78e16000fdfb
SHA256

f01caf1590ee5a59253cc0021d00349dbdec4fa90c15bbaf3bcccb207df577d1
SHA512

92ebf604807287f677f6a520a11fc32164880d964498702b98d1fecaa96e28e2c214a218eb46f612a5081b2fecfc949f1f57daa20427ba1a33e394614539dade
SSDEEP

768:HhKs7p4MAPEQbhh/8avllsFEaN3K19Z5zkzCIil:HL7p4MafVLYEaN3K19ZWzCnl

Score

10^/10

emotet epoch5 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

103.85.95.4:8080

103.224.241.74:8080

178.238.225.252:8080

37.59.103.148:8080

78.47.204.80:443

138.197.14.67:8080

128.199.242.164:8080

54.37.228.122:443

37.44.244.177:8080

139.59.80.108:8080

218.38.121.17:443

82.98.180.154:7080

114.79.130.68:443

159.65.135.222:7080

174.138.33.49:7080

195.77.239.39:8080

193.194.92.175:443

198.199.70.22:8080

85.214.67.203:8080

93.84.115.205:7080

ecs1.plain

eck1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet
Blocklisted process makes network request 1 IoCs

Processes:

WScript.exe

flow pid process

2 1264 WScript.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1804 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

1804 regsvr32.exe
660 regsvr32.exe
660 regsvr32.exe

flow	pid	process
2	1264	WScript.exe

pid	process
1804	regsvr32.exe

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1804	regsvr32.exe
660	regsvr32.exe
660	regsvr32.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

WScript.exeregsvr32.exe

description	pid	process	target process
PID 1264 wrote to memory of 1804	1264	WScript.exe	regsvr32.exe
PID 1264 wrote to memory of 1804	1264	WScript.exe	regsvr32.exe
PID 1264 wrote to memory of 1804	1264	WScript.exe	regsvr32.exe
PID 1264 wrote to memory of 1804	1264	WScript.exe	regsvr32.exe
PID 1264 wrote to memory of 1804	1264	WScript.exe	regsvr32.exe
PID 1804 wrote to memory of 660	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 660	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 660	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 660	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 660	1804	regsvr32.exe	regsvr32.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\click.wsf"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Temp\rad0265A.tmp.dll"
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NlDIAH\PeHyRtTJMeHl.dll"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rad0265A.tmp.dll
Filesize
645KB

MD5
6f262e779fc26d8dd89c942c744eecba

SHA1
7e1221991f652f468b71b0050276f6588f3ab562

SHA256
0b8682fe1ee1d9a8ad485452179e9c8651c682660591077e0fb7077e89af81bd

SHA512
5831b66c566ef87fddd33c22fe1120c451477f298da66bc48813445470f28ab767d19f02127547d2652be11f01650c0f9b2a1b3a13d2d2d523cd58d53208ca20

Download Submit
\Users\Admin\AppData\Local\Temp\rad0265A.tmp.dll
Filesize
645KB

MD5
6f262e779fc26d8dd89c942c744eecba

SHA1
7e1221991f652f468b71b0050276f6588f3ab562

SHA256
0b8682fe1ee1d9a8ad485452179e9c8651c682660591077e0fb7077e89af81bd

SHA512
5831b66c566ef87fddd33c22fe1120c451477f298da66bc48813445470f28ab767d19f02127547d2652be11f01650c0f9b2a1b3a13d2d2d523cd58d53208ca20

Download Submit
memory/1804-58-0x0000000000160000-0x000000000018C000-memory.dmp

Filesize
176KB

Download
memory/1804-61-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download