emotet | 7fd015edaf5d50cf29592aff524d145d50a9596900fa57170b19213b49dc041c

General

Target

7fd015edaf5d50cf29592aff524d145d50a9596900fa57170b19213b49dc041c.doc
Size

203KB
MD5

a6a613d020d1be76d60daefec9071489
SHA1

2feea722f1094504036708f591b2faf655717b63
SHA256

7fd015edaf5d50cf29592aff524d145d50a9596900fa57170b19213b49dc041c
SHA512

038cb526d3232cd267de90764519ffca5ee709fa8910a2575f9f1f29ef337930541fe48e5ce6733b6f782f0a3edf71feeba8eae503d1ff41017fe0af3c89d155
SSDEEP

3072:vlZ0xLs6Q5hmkQ+lmaXgx7dfCaA/USJ55N1NvCM+:dZq1Q5hmkQxaQx4znRvQ

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	512	3640	regsvr32.exe	65

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3640	WINWORD.EXE
3640	WINWORD.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3640	WINWORD.EXE
3640	WINWORD.EXE
3640	WINWORD.EXE
3640	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 512	3640	WINWORD.EXE	68
PID 3640 wrote to memory of 512	3640	WINWORD.EXE	68

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7fd015edaf5d50cf29592aff524d145d50a9596900fa57170b19213b49dc041c.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\002935.tmp"
  2⤵
  - Process spawned unexpected child process
  PID:512
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QQlmwCSaQgToPG\reJdUaYK.dll"
    3⤵
    PID:1424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\002935.tmp

Filesize
414.6MB

MD5
f3a294871c75a7938bbf3f9468ebdef6

SHA1
b3cfed31c79bd6356c8332ed35922a562a9e5604

SHA256
08f53b2c2467535917cc781d5a88ca4eba51610842cbb5fa643d6604a994d2fb

SHA512
29f10cd4b0fea811aba37629df73d21aff73d1b34187cac68f985603a2828af5397e4bd0ac70715da5c3716793b05fbb0b068e09499f1ad0633af8302b7a6ba0

Download Submit
C:\Users\Admin\AppData\Local\Temp\002938.zip

Filesize
940KB

MD5
7759e67f90c999b669de99fcf7e43ad1

SHA1
168f9fd913d5d3a683b754d6d580ccd8b2600909

SHA256
b9cbac9190743e27160d2c1a6d0802a3b8977b60e8f4bb7865e62ab52374a37e

SHA512
872f243f1c3f64611c145a2efe1dfacbb156572b50c22e6299cec8f9884bdfd59c35eaca99b7117ea2c23230ef24c8982960d05b5fd997a979e2b16b19d63a77

Download Submit
\Users\Admin\AppData\Local\Temp\002935.tmp

Filesize
410.6MB

MD5
4ca6a5acc4a0fd9a1d7625ae65999fb3

SHA1
bf456031c5ab0590fdde993d6144518bf9b29d71

SHA256
40559c14569c91e3f0a0465648a6dbe161cb76277ab3bd1d8f7e2ea70c7253e2

SHA512
da5a39e2d8a3dbf71338908f9398d1f3591e57c79e6b04ed395d6aa196799f6dfcd77663efd730ff0db925477a76d64e84c04207719e9e9ab1e2887f31fea048

Download Submit
memory/512-340-0x00000000029C0000-0x0000000002A1A000-memory.dmp

Filesize
360KB

Download
memory/512-344-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/3640-123-0x00007FFDFE480000-0x00007FFDFE490000-memory.dmp

Filesize
64KB

Download
memory/3640-126-0x00007FFDFB890000-0x00007FFDFB8A0000-memory.dmp

Filesize
64KB

Download
memory/3640-127-0x00007FFDFB890000-0x00007FFDFB8A0000-memory.dmp

Filesize
64KB

Download
memory/3640-122-0x00007FFDFE480000-0x00007FFDFE490000-memory.dmp

Filesize
64KB

Download
memory/3640-121-0x00007FFDFE480000-0x00007FFDFE490000-memory.dmp

Filesize
64KB

Download
memory/3640-120-0x00007FFDFE480000-0x00007FFDFE490000-memory.dmp

Filesize
64KB

Download
memory/3640-473-0x00007FFDFE480000-0x00007FFDFE490000-memory.dmp

Filesize
64KB

Download
memory/3640-472-0x00007FFDFE480000-0x00007FFDFE490000-memory.dmp

Filesize
64KB

Download
memory/3640-471-0x00007FFDFE480000-0x00007FFDFE490000-memory.dmp

Filesize
64KB

Download
memory/3640-470-0x00007FFDFE480000-0x00007FFDFE490000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads