emotet | cc07fed46eade5c078289dc6d65a690c73e5ad63bbaaca2e065378c81e911cd7

Analysis

max time kernel
32s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07606294727309352949559368.one
Size

262KB
MD5

2fd868b9c32d31d93c01b3826268b7d0
SHA1

5439511a90915787298574ad99fc8d2c841044f5
SHA256

cc07fed46eade5c078289dc6d65a690c73e5ad63bbaaca2e065378c81e911cd7
SHA512

3cb17ef8aa5a78ed7bb398fdb7baf9cb8fb60201476bd68411205217cca43c0cf7f57ea3847b57861ac547c91b40629b4108490c85a10dee9e7046cd53ddeb42
SSDEEP

3072:kNjcvQx377FjDDRX4UzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaU:kmvQp1DRXKXm5ZGa3vRXm5ZGa3vuVD

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

WScript.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE is not expected to spawn this process	4760	3728	WScript.exe	ONENOTE.EXE

Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

39 1100 wscript.exe

flow	pid	process
39	1100	wscript.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exewscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	wscript.exe

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

4688 regsvr32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
4688	regsvr32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ONENOTE.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

ONENOTE.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	ONENOTE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ONENOTE.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	ONENOTE.EXE

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 39 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

ONENOTE.EXE

pid process

3728 ONENOTE.EXE
3728 ONENOTE.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ONENOTE.EXEregsvr32.exe

pid process

3728 ONENOTE.EXE
3728 ONENOTE.EXE
4688 regsvr32.exe
4688 regsvr32.exe

description	flow	ioc
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

ONENOTE.EXE

pid	process
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE
3728	ONENOTE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ONENOTE.EXEWScript.exewscript.exe

description	pid	process	target process
PID 3728 wrote to memory of 4760	3728	ONENOTE.EXE	WScript.exe
PID 3728 wrote to memory of 4760	3728	ONENOTE.EXE	WScript.exe
PID 4760 wrote to memory of 1100	4760	WScript.exe	wscript.exe
PID 4760 wrote to memory of 1100	4760	WScript.exe	wscript.exe
PID 1100 wrote to memory of 4688	1100	wscript.exe	regsvr32.exe
PID 1100 wrote to memory of 4688	1100	wscript.exe	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\07606294727309352949559368.one"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{D12EBDAE-1B4B-4A45-852A-7D7BD8DD126A}\NT\0\press to unblock document.vbs"
2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4760

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //E:vbscript C:\Users\Admin\AppData\Local\Temp\rad2C01F6AD5darradD4B1B1CC2dar.txt
3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1100

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Temp\radCFD41A831dar\8bxP6PxgBe.dll"
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4688

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\WYHovyLdDatFSl\ZCefCsLmKQQlYuBV.dll"
5⤵
PID:4868

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BL.bin
Filesize
88KB

MD5
9eae6f49a02d6eb9f75af7bbf4349808

SHA1
2caf7ddeb9fc1d6076558661ef69b9638cfd2e7b

SHA256
31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98

SHA512
37b45c58efd8c2bee66c30bca4a3777d5b6ba39e97d34baa8e7bc27fb083397d818a2708cbcf7d4704398fdfff4cbc17abff68b33294292413527702c1ad7eef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BM.bin
Filesize
75KB

MD5
f776dd0f1ae059fcf295ade6c5495080

SHA1
ed270bfe2edb7e571ba4acf4b4088aa2a111e57e

SHA256
2130a3bc8050310a7474be0b17a4ea8584e2105cb17316cb463d732665745749

SHA512
2558ab6465af8a782ad02295744cd2d554d03c1ee7aa1689f13e3507a0cec4e73b9f86d1ec9aef346b831ab58758285a8ceda63dc0f834e1378dfa0504490f65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BN.bin
Filesize
567B

MD5
d055ce625528e448c61315eaaef5bb71

SHA1
029df4c872b1c154f32e7fe94f434547c3ba6192

SHA256
85bf1e672b4e86e9af0c7874681ec9620dfdc78e0335b83eef38c17d813b6705

SHA512
705b6b729e967fa946469571109aa892f5cb55a01c74d40ae02140d10cbf9b65dd5e511c06ebfe494e407742f8c6f4fbbe88664b78b37abfb2f19db1f66f4247

Download Submit
C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{D12EBDAE-1B4B-4A45-852A-7D7BD8DD126A}\NT\0\press to unblock document.vbs
Filesize
88KB

MD5
9eae6f49a02d6eb9f75af7bbf4349808

SHA1
2caf7ddeb9fc1d6076558661ef69b9638cfd2e7b

SHA256
31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98

SHA512
37b45c58efd8c2bee66c30bca4a3777d5b6ba39e97d34baa8e7bc27fb083397d818a2708cbcf7d4704398fdfff4cbc17abff68b33294292413527702c1ad7eef

Download Submit
C:\Users\Admin\AppData\Local\Temp\rad2C01F6AD5darradD4B1B1CC2dar.txt
Filesize
61KB

MD5
1aa67b0b904cd763bc3818467b021b3c

SHA1
687946e6661f96d332b8e57cab5ab2e84ca17071

SHA256
0fc30c263b4e947d2b4f7ca5e1ee57e2aa4a4e885796f15cd3e16fb03f255716

SHA512
9f8d53567998c8beb7977c470e09d4ad1a41da2555d6b7ca0b7525f70f6bba5f818aaf9a5dcbb57c7b9842e937eb5a7a64f45394f42afb2a78b09dee1493a7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\rad9D559.tmp.zip
Filesize
983KB

MD5
490a33e55790328b5febe84316195192

SHA1
441c05e4abb1c8ad4bbfad720d99986c2b7dd2f1

SHA256
2bbee605c1510e0f08149dd322490d13f7011ac1cf769cb0ffbbb97c4bc32da3

SHA512
c1b0138e3da6d463ac7fe04aa62bf7a97046912d10b64229eb19a44fc319a1d9d6f4b0b4496261004a46afe9c662acf88602a46b0c86e9b1e8017c97c6257347

Download Submit
C:\Users\Admin\AppData\Local\Temp\radCFD41A831dar\8bxP6PxgBe.dll
Filesize
286.6MB

MD5
1752a2e70ee1373a793f10237813ec68

SHA1
dc7922d3ddfcd9bf3a86b2fe4c28dac7865269dd

SHA256
39bde094ccc58e65f2e822946b73a9dc53c14b94a3a346f7c92009e52be25889

SHA512
a271f2fbcd88f57e43385de575a5bb9c1ae3c23e36bd0d785800d729cd2c9a51aa89410047d3cbe2337d0fd994b802cba8aff431549201977ca5a0b3a3248d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\radCFD41A831dar\8bxP6PxgBe.dll
Filesize
248.3MB

MD5
6ea34c4a4dbc1eecb3f48e5831b72997

SHA1
966ff93dccf68d12b0706d46cc96c6516a3cecc4

SHA256
beff611568e6dc6f26c4e2b2bcbf4b3e5d431dcef4d1a5691983f78c6b333fcd

SHA512
68e6c4de2f603518bfde9463b593d8ad0796b236075d498cd29dd7bd4afc2dddabe510c250798d914d1f78ff7985ec1e5429992751288a5b2ba1ee2cc7b56f2f

Download Submit
C:\Windows\System32\WYHovyLdDatFSl\ZCefCsLmKQQlYuBV.dll
Filesize
136.8MB

MD5
c2f16db1922af7cf02a2f8e7a001ad82

SHA1
3e2ff46948cf41a04a14ad5ca92cad0d15027a08

SHA256
0ed186d430a9a4612f88f2fc01760542d4e74b56220b338d73c6a8b922aa0ca6

SHA512
501ef63b4175b0b5e89a33b05d16e270fbe12e91f89bea518142b372e364115e4e823b4edb394eb196f82078fccb2fb3d2279eec23628dd6eb6ce56411a594a8

Download Submit
memory/3728-139-0x00007FFF879F0000-0x00007FFF87A00000-memory.dmp

Filesize
64KB

Download
memory/3728-138-0x00007FFF879F0000-0x00007FFF87A00000-memory.dmp

Filesize
64KB

Download
memory/3728-137-0x00007FFF89A50000-0x00007FFF89A60000-memory.dmp

Filesize
64KB

Download
memory/3728-136-0x00007FFF89A50000-0x00007FFF89A60000-memory.dmp

Filesize
64KB

Download
memory/3728-135-0x00007FFF89A50000-0x00007FFF89A60000-memory.dmp

Filesize
64KB

Download
memory/3728-134-0x00007FFF89A50000-0x00007FFF89A60000-memory.dmp

Filesize
64KB

Download
memory/3728-133-0x00007FFF89A50000-0x00007FFF89A60000-memory.dmp

Filesize
64KB

Download
memory/4688-221-0x0000000002170000-0x00000000021CA000-memory.dmp

Filesize
360KB

Download
memory/4688-225-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download