emotet | 6fe419396223d5d2bfe81403acf1a6eb21b954c9fad36dc9e22ff43270409ffa

General

Target

6fe419396223d5d2bfe81403acf1a6eb21b954c9fad36dc9e22ff43270409ffa.doc
Size

300KB
MD5

eb138f165e8ed2c17e2655d3e555e485
SHA1

1876b62a1a713a4c5e185486900aacb8049f4c39
SHA256

6fe419396223d5d2bfe81403acf1a6eb21b954c9fad36dc9e22ff43270409ffa
SHA512

c44947c1d48ba72e2577935d9b3be2dd8cec178672bfce8d4e95fc4742c12e9e8c8ebb8dad74d9767712bbc0ef16c14a1a24dec9f84136e6a7a60793a5903c34
SSDEEP

3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

164.68.99.3:8080

164.90.222.65:443

186.194.240.217:443

1.234.2.232:8080

103.75.201.2:443

187.63.160.88:80

147.139.166.154:8080

91.207.28.33:8080

5.135.159.50:443

153.92.5.27:8080

213.239.212.5:443

103.43.75.120:443

159.65.88.10:8080

167.172.253.162:8080

153.126.146.25:7080

119.59.103.152:8080

107.170.39.149:8080

183.111.227.137:8080

159.89.202.34:443

110.232.117.186:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	5032	4108	regsvr32.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	28	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4108 WINWORD.EXE
4108 WINWORD.EXE
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

WINWORD.EXE

pid process

4108 WINWORD.EXE
4108 WINWORD.EXE
4108 WINWORD.EXE
4108 WINWORD.EXE
4108 WINWORD.EXE

pid	process
4108	WINWORD.EXE
4108	WINWORD.EXE

pid	process
4108	WINWORD.EXE
4108	WINWORD.EXE
4108	WINWORD.EXE
4108	WINWORD.EXE
4108	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 4108 wrote to memory of 5032	4108	WINWORD.EXE	regsvr32.exe
PID 4108 wrote to memory of 5032	4108	WINWORD.EXE	regsvr32.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6fe419396223d5d2bfe81403acf1a6eb21b954c9fad36dc9e22ff43270409ffa.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\003636.tmp"
2⤵
- Process spawned unexpected child process
PID:5032

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IvehXtawbydn\fBdpEzH.dll"
3⤵
PID:1632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\003636.tmp
Filesize
345.6MB

MD5
78fe1a41a9c691121d0189c9a6a567a4

SHA1
347e171ac781935da8f55ea8c23079c5bb202e7d

SHA256
4e4334544bd8ba0705686460fe1eaa0427d3f6f9b8f4cfd84846912654881ed7

SHA512
9e05902387e70a7aa144da96eafd010540203ba9a8ac71114aab126867430591b3c2498f7444a8ba189f65742dccbfd28d052782cf5cf203517e67a18cb4d961

Download Submit
C:\Users\Admin\AppData\Local\Temp\003715.zip
Filesize
819KB

MD5
b13338f0035a1eb256605e50eec79fbf

SHA1
8cf000ce289c5e990fb06c28de87b2a69dea6079

SHA256
f1fd0fe8cb3d2f7eaf14460ea25edbad3c70c06bba674088b8cabf7464ac5381

SHA512
846d1029e6e2fbaa21a7ab6114fa4baf852e505908579541644a23b703f7b5506056ac8ee83d7ba505ba236c53103b4e81eaacf2e04678e3171e50828b7a1bf1

Download Submit
\Users\Admin\AppData\Local\Temp\003636.tmp
Filesize
342.8MB

MD5
6a77a883966eaabfe8833053bfbb44ab

SHA1
c9b2fc1ec2d27ee60286a93d357010b03d076632

SHA256
d5e07bd29d6a7ea99d99d1903d6142cd637bc4332f788f9597487ca6b92ca9c8

SHA512
4d416f3236a8059fa812b05d3cde2facd363166eff397045fb6496bec49441883ec3363967a17ea90923f9bdce09b14f5c0c261cdbb712b94b610b690becaded

Download Submit
memory/4108-122-0x00007FF9A20D0000-0x00007FF9A20E0000-memory.dmp

Filesize
64KB

Download
memory/4108-125-0x00007FF99F290000-0x00007FF99F2A0000-memory.dmp

Filesize
64KB

Download
memory/4108-126-0x00007FF99F290000-0x00007FF99F2A0000-memory.dmp

Filesize
64KB

Download
memory/4108-119-0x00007FF9A20D0000-0x00007FF9A20E0000-memory.dmp

Filesize
64KB

Download
memory/4108-121-0x00007FF9A20D0000-0x00007FF9A20E0000-memory.dmp

Filesize
64KB

Download
memory/4108-120-0x00007FF9A20D0000-0x00007FF9A20E0000-memory.dmp

Filesize
64KB

Download
memory/4108-419-0x00007FF9A20D0000-0x00007FF9A20E0000-memory.dmp

Filesize
64KB

Download
memory/4108-420-0x00007FF9A20D0000-0x00007FF9A20E0000-memory.dmp

Filesize
64KB

Download
memory/4108-422-0x00007FF9A20D0000-0x00007FF9A20E0000-memory.dmp

Filesize
64KB

Download
memory/4108-421-0x00007FF9A20D0000-0x00007FF9A20E0000-memory.dmp

Filesize
64KB

Download
memory/5032-324-0x0000000180000000-0x000000018002D000-memory.dmp

Filesize
180KB

Download
memory/5032-336-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads