emotet | e2d76294e4c59a13b9cf80def7c91994d4b1ea6a610708d73684d71abff972a5

General

Target

payment.doc
Size

548.2MB
MD5

078be6c1c7e37936317cfe515046ff8d
SHA1

6591f514e4470595b660649368d59a50cb70b03c
SHA256

dec0cb56b8fde11f21cab50f55e08e29e89854a6e05a5d3b940c860589c56117
SHA512

d1f30293779b644e43213edf3d854bcda725a10bc1abadad1bed02abb248a5660c902f818276834334cbd9592ec541e4d260b33c1f6a447dafb8591fad3f793d
SSDEEP

3072:brrCtKZF4eqZ627NHRxMvOwvzpl+vk6jZc:5F4eqYwHMvfvzpKk6Nc

Score

10^/10

emotet epoch4 banker persistence trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	1688	3992	regsvr32.exe	83

Loads dropped DLL 2 IoCs

pid	Process
1688	regsvr32.exe
4928	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ckga.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\VTrFVNrQ\\Ckga.dll\""	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	32	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	34	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	35	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	56	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	62	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3992	WINWORD.EXE
3992	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1688	regsvr32.exe
1688	regsvr32.exe
4928	regsvr32.exe
4928	regsvr32.exe
4928	regsvr32.exe
4928	regsvr32.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3992	WINWORD.EXE
3992	WINWORD.EXE
3992	WINWORD.EXE
3992	WINWORD.EXE
3992	WINWORD.EXE
3992	WINWORD.EXE
3992	WINWORD.EXE
3992	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3992 wrote to memory of 1688	3992	WINWORD.EXE	87
PID 3992 wrote to memory of 1688	3992	WINWORD.EXE	87
PID 1688 wrote to memory of 4928	1688	regsvr32.exe	91
PID 1688 wrote to memory of 4928	1688	regsvr32.exe	91

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\payment.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\System32\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\065109.tmp"
  2⤵
  - Process spawned unexpected child process
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\system32\regsvr32.exe
    C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VTrFVNrQ\Ckga.dll"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:4928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\065109.tmp

Filesize
507.9MB

MD5
27f882a2b795abfae8f33440afcd3ad4

SHA1
2940bdb5f4f91fcc52ed20a460c214fd83171339

SHA256
c569ceb7fd1b5d5d860807dc12b8d71621c186bf8668bc5795b8e430db474f47

SHA512
4ead7b5fef3c6edf6d19164bcfddbb475e645ea08b4a2c458457ba8367478683766fbfc1f076b66ab80c1d2096e08dff97ae4b17d10539df02951f83344c0b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\065109.tmp

Filesize
507.9MB

MD5
27f882a2b795abfae8f33440afcd3ad4

SHA1
2940bdb5f4f91fcc52ed20a460c214fd83171339

SHA256
c569ceb7fd1b5d5d860807dc12b8d71621c186bf8668bc5795b8e430db474f47

SHA512
4ead7b5fef3c6edf6d19164bcfddbb475e645ea08b4a2c458457ba8367478683766fbfc1f076b66ab80c1d2096e08dff97ae4b17d10539df02951f83344c0b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\065138.zip

Filesize
947KB

MD5
9b7c0b1c11257c563b2aa292534add2d

SHA1
b0df42305bf54f7653870904b9cb9d9b70ab36d1

SHA256
ca2f523dcc748f244a3a290730d8638710f3fba9a31ca27731ad98314d31d65b

SHA512
fcfe09ba49b3335b302f6b87623ff1648340c23397ccb641d2576e359beb7e45672ec9978ab34264983c6e127a5fbd588149c9d89666923bb7cd2bf409cabf2e

Download Submit
C:\Windows\System32\VTrFVNrQ\Ckga.dll

Filesize
507.9MB

MD5
27f882a2b795abfae8f33440afcd3ad4

SHA1
2940bdb5f4f91fcc52ed20a460c214fd83171339

SHA256
c569ceb7fd1b5d5d860807dc12b8d71621c186bf8668bc5795b8e430db474f47

SHA512
4ead7b5fef3c6edf6d19164bcfddbb475e645ea08b4a2c458457ba8367478683766fbfc1f076b66ab80c1d2096e08dff97ae4b17d10539df02951f83344c0b33

Download Submit
memory/1688-178-0x0000000002DC0000-0x0000000002E1A000-memory.dmp

Filesize
360KB

Download
memory/1688-182-0x00000000014D0000-0x00000000014D1000-memory.dmp

Filesize
4KB

Download
memory/3992-136-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

Filesize
64KB

Download
memory/3992-137-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

Filesize
64KB

Download
memory/3992-135-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

Filesize
64KB

Download
memory/3992-134-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

Filesize
64KB

Download
memory/3992-139-0x00007FF90C150000-0x00007FF90C160000-memory.dmp

Filesize
64KB

Download
memory/3992-138-0x00007FF90C150000-0x00007FF90C160000-memory.dmp

Filesize
64KB

Download
memory/3992-133-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

Filesize
64KB

Download
memory/3992-207-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

Filesize
64KB

Download
memory/3992-208-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

Filesize
64KB

Download
memory/3992-209-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

Filesize
64KB

Download
memory/3992-210-0x00007FF90E8D0000-0x00007FF90E8E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads