emotet | e2ea5af25c4e1942320c3893fadfd80955d059cd9fa0e9e8bb4e5b78f2c2576b

General

Target

e2ea5af25c4e1942320c3893fadfd80955d059cd9fa0e9e8bb4e5b78f2c2576b.doc
Size

274KB
MD5

113a55bb02adefcc77f9d5569dacf6dc
SHA1

60d9d3c06a0dbaf92dcf535556dd0a8fd5ab49d4
SHA256

e2ea5af25c4e1942320c3893fadfd80955d059cd9fa0e9e8bb4e5b78f2c2576b
SHA512

3806674a54a9f0a2dc61bd5e747a727d7de0c55680ef5486a2e8d7fb001bbe12d36dbe455f79e44b40ccdef88586885345c6677cd5718df50424b2aff40897ab
SSDEEP

3072:1zRMiEMzv9v6Pag5j6O3/Zdz+ABtm36eutCQI7siRs4Kfbd1E1s1s:PxdWaI3bm3JutC5giRIZ1Emy

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	5024	4640	regsvr32.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 8 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

4640 WINWORD.EXE
4640 WINWORD.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

WINWORD.EXE

pid process

4640 WINWORD.EXE
4640 WINWORD.EXE
4640 WINWORD.EXE
4640 WINWORD.EXE

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
4640	WINWORD.EXE
4640	WINWORD.EXE

pid	process
4640	WINWORD.EXE
4640	WINWORD.EXE
4640	WINWORD.EXE
4640	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 4640 wrote to memory of 5024	4640	WINWORD.EXE	regsvr32.exe
PID 4640 wrote to memory of 5024	4640	WINWORD.EXE	regsvr32.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e2ea5af25c4e1942320c3893fadfd80955d059cd9fa0e9e8bb4e5b78f2c2576b.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\162422.tmp"
2⤵
- Process spawned unexpected child process
PID:5024

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\DnkOo\QOkK.dll"
3⤵
PID:2524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\162422.tmp
Filesize
466.0MB

MD5
93f24957eb46c258e7801230fe2a9214

SHA1
818ce230a0dc900f4a8c44e4c394f26922c3da16

SHA256
2bbb569abfe9814e48b03f0a66f3be603e602d00255695b312b1d1b908d0e091

SHA512
24fd558a9610697218342db6d4c4b0a05d23edebb2575cd84842184552337b1f46c90372f72c15d901d18bd5b4ca2f488d34b545d5ef4bafdd90e90dc1671dcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\162423.zip
Filesize
940KB

MD5
6badd642023ce03a20492e4208a6eac0

SHA1
55e092ea0296dd7ba8a2430b879b934f2661a546

SHA256
7f9fe2a8a43cf7b4cbc05a470b1aeaf2519a319e048a8e79758867c6c418690b

SHA512
a5a429680c941a722906682fdc36908ca47f4b954ec214bd9297439ee106218c401eda698be2d33789b90d4f5d9dc41334938c53117d060e58f6c7552663d46c

Download Submit
\Users\Admin\AppData\Local\Temp\162422.tmp
Filesize
464.0MB

MD5
502343a453869ffa0c4ef30fc809e94b

SHA1
f28ebddc4a7d658b112eba5c2df246f47dfb3726

SHA256
99a3942f8f0190054971976d82290971bb64d387f3982460557404bae5a68178

SHA512
80abb864a2fc8160d88c257c6418828452c8f5f2809de54e52bc953b5f06ff5111a7e4ea62cf922102c1627d7357f49970aeb3cba2d100cb007330c91ab24b0c

Download Submit
memory/4640-124-0x00007FFEEC900000-0x00007FFEEC910000-memory.dmp

Filesize
64KB

Download
memory/4640-127-0x00007FFEE8E90000-0x00007FFEE8EA0000-memory.dmp

Filesize
64KB

Download
memory/4640-128-0x00007FFEE8E90000-0x00007FFEE8EA0000-memory.dmp

Filesize
64KB

Download
memory/4640-121-0x00007FFEEC900000-0x00007FFEEC910000-memory.dmp

Filesize
64KB

Download
memory/4640-123-0x00007FFEEC900000-0x00007FFEEC910000-memory.dmp

Filesize
64KB

Download
memory/4640-122-0x00007FFEEC900000-0x00007FFEEC910000-memory.dmp

Filesize
64KB

Download
memory/4640-450-0x00007FFEEC900000-0x00007FFEEC910000-memory.dmp

Filesize
64KB

Download
memory/4640-449-0x00007FFEEC900000-0x00007FFEEC910000-memory.dmp

Filesize
64KB

Download
memory/4640-452-0x00007FFEEC900000-0x00007FFEEC910000-memory.dmp

Filesize
64KB

Download
memory/4640-451-0x00007FFEEC900000-0x00007FFEEC910000-memory.dmp

Filesize
64KB

Download
memory/5024-328-0x0000000002B40000-0x0000000002B9A000-memory.dmp

Filesize
360KB

Download
memory/5024-338-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads