emotet | 4adeca1bae060bc64f11af0d6a2bc6fdb43430f1f8ec62a4d1f9d8ae4fae1fe9

General

Target

INVOICE N IJ952634 March 2023.doc
Size

514.2MB
MD5

569dd57886777d0e9aa72151ae32cf7d
SHA1

8be53083637a60ee102d8e5fbb8fb0d7df33bab7
SHA256

b63617eda3505c9ab6deb672f33ca196f508b6cd5eb1cc00ec5c2500a35c18a6
SHA512

13c5f79efa16d93c4b0a8c5f7ff31aae5f4087d10254167e1b1359b7b8ed4f32e116e00fc97d31124345bbb5726371079b9216fd95c5768722daf0a8299ccbc6
SSDEEP

3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup

Score

10^/10

emotet epoch4 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

164.68.99.3:8080

164.90.222.65:443

186.194.240.217:443

1.234.2.232:8080

103.75.201.2:443

187.63.160.88:80

147.139.166.154:8080

91.207.28.33:8080

5.135.159.50:443

153.92.5.27:8080

213.239.212.5:443

103.43.75.120:443

159.65.88.10:8080

167.172.253.162:8080

153.126.146.25:7080

119.59.103.152:8080

107.170.39.149:8080

183.111.227.137:8080

159.89.202.34:443

110.232.117.186:8080

eck1.plain

ecs1.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3008	1104	regsvr32.exe	WINWORD.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	44	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	45	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	54	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	57	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	61	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	40	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

1104 WINWORD.EXE
1104 WINWORD.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

WINWORD.EXE

pid process

1104 WINWORD.EXE
1104 WINWORD.EXE
1104 WINWORD.EXE
1104 WINWORD.EXE

pid	process
1104	WINWORD.EXE
1104	WINWORD.EXE

pid	process
1104	WINWORD.EXE
1104	WINWORD.EXE
1104	WINWORD.EXE
1104	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 1104 wrote to memory of 3008	1104	WINWORD.EXE	regsvr32.exe
PID 1104 wrote to memory of 3008	1104	WINWORD.EXE	regsvr32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\INVOICE N IJ952634 March 2023.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\140542.tmp"
2⤵
- Process spawned unexpected child process
PID:3008

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OHhKYaMB\dWnjUIHSF.dll"
3⤵
PID:4624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\140542.tmp
Filesize
87.1MB

MD5
c8f331826d46b2cc90ccbd71db5e88a4

SHA1
d412a873bcf0754a2f3848c4eefb10de64e0941a

SHA256
54c10e64590b9d9eacc1ef9d13fc7ffdcd207cc3c2c4eda8c766b03ee5f1fad4

SHA512
97de36d4549d0b20f4df61f77cb440bacf682d21d5286f3237b8dfaa333d9aed9a4d15cf9dca5900b6ffb155ca8f40c6f89bdd45e66d9e3cd8e33cf3521f040f

Download Submit
C:\Users\Admin\AppData\Local\Temp\140542.tmp
Filesize
86.7MB

MD5
d6db6e217b60a845a532a6b606b27f28

SHA1
dc2426b56baf929fefbb0ef4fb1c21b330b0adef

SHA256
62846c4fe49cbd92c816aeab2d705515affc05f12dcd9a5e067833c152f13ad1

SHA512
ed1a0a0a82de437fb2a0a6cd0e8b9e3fc8ecfe473858ac56501979b10e10552879714d3bd3ad8ba8f86c9b15fc999c9ec021bac0b1e9e106c4bee82dca8cbb9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\140553.zip
Filesize
815KB

MD5
ed4fcdbf38c45e8b61f0364b90416651

SHA1
02640c01c30f89e3dc1ece2c001c0121cd648057

SHA256
1f78d5f7eb645523205b4a42b84060253f2c3c19e7f4ef5b776391fff23b87d4

SHA512
505767be56fa466804657cf659bace3868af56b121c7feaa542a8ae5b0f243bde179b5828a28d775d3d5fef06935b3edbfea752bc1c330252f7e2215ef17e31c

Download Submit
C:\Windows\System32\OHhKYaMB\dWnjUIHSF.dll
Filesize
73.9MB

MD5
7a82f30c301ed843179dd5a0a0c3d3cc

SHA1
872876a531aac9fb96bd9ab46b30b1e69decf414

SHA256
30a814fbbea7c1992fb390accaf37b2eeed99434aeee85a0e79c51d5f87bd207

SHA512
954f4debfd6a3902b1e9c89d9fa8fc82b00e0ebbfd1d008a64bce82d908fe06e0c09f1efb3718c8855a8f32535e3cf3e111774432ca979454769263148079997

Download Submit
memory/1104-137-0x00007FFC2CE10000-0x00007FFC2CE20000-memory.dmp

Filesize
64KB

Download
memory/1104-138-0x00007FFC2A730000-0x00007FFC2A740000-memory.dmp

Filesize
64KB

Download
memory/1104-139-0x00007FFC2A730000-0x00007FFC2A740000-memory.dmp

Filesize
64KB

Download
memory/1104-136-0x00007FFC2CE10000-0x00007FFC2CE20000-memory.dmp

Filesize
64KB

Download
memory/1104-135-0x00007FFC2CE10000-0x00007FFC2CE20000-memory.dmp

Filesize
64KB

Download
memory/1104-134-0x00007FFC2CE10000-0x00007FFC2CE20000-memory.dmp

Filesize
64KB

Download
memory/1104-133-0x00007FFC2CE10000-0x00007FFC2CE20000-memory.dmp

Filesize
64KB

Download
memory/1104-201-0x00007FFC2CE10000-0x00007FFC2CE20000-memory.dmp

Filesize
64KB

Download
memory/1104-202-0x00007FFC2CE10000-0x00007FFC2CE20000-memory.dmp

Filesize
64KB

Download
memory/1104-203-0x00007FFC2CE10000-0x00007FFC2CE20000-memory.dmp

Filesize
64KB

Download
memory/3008-178-0x0000000180000000-0x000000018002D000-memory.dmp

Filesize
180KB

Download
memory/3008-181-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads