Overview

overview

10

Static

static

8

36985560c3...9e.xls

windows10-1703-x64

10

Resubmissions

06-05-2024 11:03

240506-m5q8hada23 10

10-04-2024 09:58

240410-lzxbwsbe66 10

15-05-2023 13:15

230515-qhkc8adh4w 10

12-07-2022 13:01

220712-p88ytsbcbp 10

11-07-2022 09:39

220711-lmw6csace4 10

Analysis

  • max time kernel
    267s
  • max time network
    269s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15-05-2023 13:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    36985560c3a24e6cead3e70fea55dd84cab03d9b88704906893bc70c45389f9e.xls

  • Size

    95KB

  • MD5

    6e332933bb67a0757d783740c29101ce

  • SHA1

    edfa1dfe6a43cf8351b10856a6242e3b4ab49d62

  • SHA256

    36985560c3a24e6cead3e70fea55dd84cab03d9b88704906893bc70c45389f9e

  • SHA512

    45785888b7d13fe33e33d1569c2206acb64782f493d094089123d574da52bb143bf614a002a994c22818ea338b4074b783d0f925e98f226f908218da826b9fe3

  • SSDEEP

    1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4HuS4hcTO97v7UYdEJms:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgK

Score
10/10
emotetepoch5bankertrojan

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://cointrade.world/receipts/0LjXVwpQrhw/
xlm40.dropper

http://www.garantihaliyikama.com/wp-admin/jp64lssPHEe2ii/
xlm40.dropper

http://haircutbar.com/cgi-bin/BC3WAQ8zJY4ALXA4/
xlm40.dropper

http://airhobi.com/system/WLvH1ygkOYQO/

Extracted

Family

emotet

Botnet

Epoch5

C2

103.71.99.57:8080

103.224.241.74:8080

157.245.111.0:8080

37.44.244.177:8080

103.41.204.169:8080

64.227.55.231:8080

103.254.12.236:7080

103.85.95.4:8080

157.230.99.206:8080

165.22.254.236:8080

85.214.67.203:8080

54.37.228.122:443

195.77.239.39:8080

128.199.217.206:443

190.145.8.4:443

165.232.185.110:8080

188.165.79.151:443

178.62.112.199:8080

54.37.106.167:8080

104.244.79.94:443
eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\36985560c3a24e6cead3e70fea55dd84cab03d9b88704906893bc70c45389f9e.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci1.ocx
      2⤵
      • Process spawned unexpected child process
      PID:4860
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci2.ocx
      2⤵
      • Process spawned unexpected child process
      PID:4932
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci3.ocx
      2⤵
      • Process spawned unexpected child process
      PID:3464
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci4.ocx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QgouUvVCuDHgpRB\Adse.dll"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5108
  • C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    1⤵
      PID:5012
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:1436
      • C:\Windows\system32\launchtm.exe
        launchtm.exe /2
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4704
        • C:\Windows\System32\Taskmgr.exe
          "C:\Windows\System32\Taskmgr.exe" /2
          2⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4736

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Privilege Escalation

      Defense Evasion

      Credential Access

      Discovery

      Query Registry

      3
      T1012

      Peripheral Device Discovery

      1
      T1120

      System Information Discovery

      3
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\soci4.ocx
        Filesize

        551KB

        MD5

        615f4fc0eb24ecb044f532a4c1cf20e1

        SHA1

        738f9243e0b115a51826820c0ed92040b64615c5

        SHA256

        b1704fff5112536cfb3a23b7f0ae3922a1418b2e3ca56340ca5537f08b7be7b6

        SHA512

        776153b81aff092bdaff76332f8f0d4d9df175b80df8eaf80dac96fa192898256533ba589354b06c21881f0c45b0cf3b2ef1aeb0a0cc35bc3fc8105a8022c822

        Download Submit
      • \Users\Admin\soci4.ocx
        Filesize

        551KB

        MD5

        615f4fc0eb24ecb044f532a4c1cf20e1

        SHA1

        738f9243e0b115a51826820c0ed92040b64615c5

        SHA256

        b1704fff5112536cfb3a23b7f0ae3922a1418b2e3ca56340ca5537f08b7be7b6

        SHA512

        776153b81aff092bdaff76332f8f0d4d9df175b80df8eaf80dac96fa192898256533ba589354b06c21881f0c45b0cf3b2ef1aeb0a0cc35bc3fc8105a8022c822

        Download Submit
      • memory/2496-133-0x00007FFD39420000-0x00007FFD39430000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2496-340-0x00007FFD3CA80000-0x00007FFD3CA90000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2496-121-0x00007FFD3CA80000-0x00007FFD3CA90000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2496-134-0x00007FFD39420000-0x00007FFD39430000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2496-276-0x000002BD0E290000-0x000002BD0E2BF000-memory.dmp
        Filesize

        188KB

        Download
      • memory/2496-123-0x00007FFD3CA80000-0x00007FFD3CA90000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2496-122-0x00007FFD3CA80000-0x00007FFD3CA90000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2496-344-0x000002BD0E290000-0x000002BD0E2BF000-memory.dmp
        Filesize

        188KB

        Download
      • memory/2496-343-0x00007FFD3CA80000-0x00007FFD3CA90000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2496-310-0x000002BD0E290000-0x000002BD0E2BF000-memory.dmp
        Filesize

        188KB

        Download
      • memory/2496-124-0x00007FFD3CA80000-0x00007FFD3CA90000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2496-341-0x00007FFD3CA80000-0x00007FFD3CA90000-memory.dmp
        Filesize

        64KB

        Download
      • memory/2496-342-0x00007FFD3CA80000-0x00007FFD3CA90000-memory.dmp
        Filesize

        64KB

        Download
      • memory/3488-293-0x0000000000F60000-0x0000000000F61000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3488-286-0x00000000029B0000-0x0000000002A0E000-memory.dmp
        Filesize

        376KB

        Download