emotet | 21d6e39fb31e2d0efc37f53fc24bed0283f11426b0de28487913d4041e1b643d

General

Target

21d6e39fb31e2d0efc37f53fc24bed0283f11426b0de28487913d4041e1b643d.doc
Size

195KB
MD5

20579879faa3dd7fa2deff4dbf4188c2
SHA1

d3be5954d5412c6e1e7940e1f965fed8a24da298
SHA256

21d6e39fb31e2d0efc37f53fc24bed0283f11426b0de28487913d4041e1b643d
SHA512

bf24a0b609d3d8df8fc03d7e4e3dbbd8d7d3c824b03eb28c3ef1da43e6de69006b2b4bf6879dd083be353d782fda12a6717fb318ae10c640218496a216ea17bf
SSDEEP

3072:+lmdyGRYHL2mH+pAgZijNQkj6SpVbGEcr:+KaL2KzgZ+2SnGEc

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4916	1596	regsvr32.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1596 WINWORD.EXE
1596 WINWORD.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

WINWORD.EXE

pid process

1596 WINWORD.EXE
1596 WINWORD.EXE
1596 WINWORD.EXE
1596 WINWORD.EXE
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

description	flow	ioc
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
1596	WINWORD.EXE
1596	WINWORD.EXE

pid	process
1596	WINWORD.EXE
1596	WINWORD.EXE
1596	WINWORD.EXE
1596	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\21d6e39fb31e2d0efc37f53fc24bed0283f11426b0de28487913d4041e1b643d.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1596

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\003723.tmp"
2⤵
- Process spawned unexpected child process
PID:4916

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RbJxPTSzeEIbjKpL\HCcDlMXmmf.dll"
3⤵
PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\003723.tmp
Filesize
378.0MB

MD5
5db3c8d45edafd3e3ecf192630553b4a

SHA1
a292fbae2c1d1dd48bd9f9bbe7151ddc973a9e40

SHA256
6b29cd296d4b6cecc5f5e3989a29a96f9e5c8d0d9d815c727e0f5464ff331d49

SHA512
07b6a10fb90155094e7a88b2aafd2d9edccf32f40f97991763927026507fbdc6e4995ab51824af6c65c6205d345be2b5460814086d5d116bcbb117d5fe5db960

Download Submit
C:\Users\Admin\AppData\Local\Temp\003807.zip
Filesize
962KB

MD5
6288ed88b54dec20b529578e4af4a582

SHA1
15c83d619c840ade106c71431b754c6468a573b5

SHA256
764f040c3ee068480a57baa46dcf13537c98ac8a60c7a2f72f6d2dcc25da13fc

SHA512
597ad636d9264db487d59d90762d1e9c01cdc505ed19a6f2f5ef3715159bf847eadcc285eb9767f2fbe207af9048965ddb6121ff6efef0831a1f9e109e070b12

Download Submit
\Users\Admin\AppData\Local\Temp\003723.tmp
Filesize
376.9MB

MD5
959aeda11fb8190b72b9fcb3c89a7691

SHA1
b1d7127f14a77aecd19fba4cb1c1ff68693b43e8

SHA256
b200e0b5b7ed7f02e18b1dc5d7f1b8efa0411995e442d296c8fa9e5cfaf48d1a

SHA512
211fdfae4e39359e545ca3e559d0d7538b477bf338b13b21dfa25cbd4bdc6239215539a8771b525d970bf3f1d858933df01fbff90edc50601b8e4f678449f2f5

Download Submit
memory/1596-119-0x00007FFEF0340000-0x00007FFEF0350000-memory.dmp

Filesize
64KB

Download
memory/1596-120-0x00007FFEF0340000-0x00007FFEF0350000-memory.dmp

Filesize
64KB

Download
memory/1596-121-0x00007FFEF0340000-0x00007FFEF0350000-memory.dmp

Filesize
64KB

Download
memory/1596-122-0x00007FFEF0340000-0x00007FFEF0350000-memory.dmp

Filesize
64KB

Download
memory/1596-125-0x00007FFEEC7D0000-0x00007FFEEC7E0000-memory.dmp

Filesize
64KB

Download
memory/1596-126-0x00007FFEEC7D0000-0x00007FFEEC7E0000-memory.dmp

Filesize
64KB

Download
memory/4916-328-0x00000000021A0000-0x00000000021FA000-memory.dmp

Filesize
360KB

Download
memory/4916-343-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads