MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1b3d9563523dea4c11fc5a0adb317e5c47ecc78aea2ef56fc6fc437df985b8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 10

Maldoc score: 14

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	a1b3d9563523dea4c11fc5a0adb317e5c47ecc78aea2ef56fc6fc437df985b8a
SHA3-384 hash:	2ad99fcf26eca74a519ce50c90843af4eb0a0a5c0806ff2e4aa342ca76b8966687ea094d3ba05063eb6c89be53cb7e8d
SHA1 hash:	6b22f22bd5707c38f767420ede996d6285aa159f
MD5 hash:	539a6f605ee4ae0765ab27b382a5088e
humanhash:	washington-grey-robin-winner
File name:	tmp_h1ok71j
Download:	download sample
Signature	Heodo Create hunting rule
File size:	123'904 bytes
First seen:	2022-02-09 11:30:16 UTC
Last seen:	2022-02-13 23:25:27 UTC
File type:	xlsx
MIME type:	application/vnd.ms-excel
ssdeep	3072:v5cKoSsxzNDZLDZjlbR868O8KlVH37kehvMqAPjxO5xyZUE5V5xtezEVg8/dgCB2:xcKoSsxzNDZLDZjlbR868O8KlVH37kej
TLSH	T13EC35A55F685EA1ADE0822350DDFC7F9733ABC828E9683473289B32F7D76550CA12706
Reporter	Cryptolaemus1
Tags:	Emotet epoch5 Heodo xlsx

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 14

OLE dump

MalwareBazaar was able to identify 23 sections in this file using oledump:

Section ID	Section size	Section name
1	109 bytes	CompObj
2	220 bytes	DocumentSummaryInformation
3	204 bytes	SummaryInformation
4	72505 bytes	Workbook
5	646 bytes	_VBA_PROJECT_CUR/PROJECT
6	122 bytes	_VBA_PROJECT_CUR/PROJECTwm
7	9756 bytes	_VBA_PROJECT_CUR/VBA/Fbhndfghsret3
8	1191 bytes	_VBA_PROJECT_CUR/VBA/GhFdrtdSrt4ufg
9	7302 bytes	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
10	2768 bytes	_VBA_PROJECT_CUR/VBA/__SRP_0
11	764 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1
12	302 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2
13	400 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3
14	228 bytes	_VBA_PROJECT_CUR/VBA/__SRP_4
15	66 bytes	_VBA_PROJECT_CUR/VBA/__SRP_5
16	603 bytes	_VBA_PROJECT_CUR/VBA/__SRP_6
17	1182 bytes	_VBA_PROJECT_CUR/VBA/__SRP_7
18	866 bytes	_VBA_PROJECT_CUR/VBA/dir
19	15531 bytes	_VBA_PROJECT_CUR/VBA/kjDygzs34e
20	97 bytes	_VBA_PROJECT_CUR/kjDygzs34e/CompObj
21	294 bytes	_VBA_PROJECT_CUR/kjDygzs34e/VBFrame
22	270 bytes	_VBA_PROJECT_CUR/kjDygzs34e/f
23	268 bytes	_VBA_PROJECT_CUR/kjDygzs34e/o

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Workbook_Open	Runs when the Excel Workbook is opened
AutoExec	trgsEtgseg_Change	Runs when the file is opened and ActiveX objects trigger events
Suspicious	Open	May open a file
Suspicious	Output	May write to a file (if combined with Open)
Suspicious	CreateObject	May create an OLE object
Suspicious	exec	May run an executable file or a system
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

148

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Malicious

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

True

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/239455/

Detection(s):

TwinWave.EvilDoc.CROStringBuilderHidingPlacesPapaDontTakeNoMess.20200916.UNOFFICIAL

TwinWave.EvilDoc.CROKissFromARose.M4.20201215.UNOFFICIAL

SecuriteInfo.com.PUA.PowerShell.Agent-19.UNOFFICIAL

MiscreantPunch.EvilMacro.PSHELLB64INVOKEDASHWINVOKEDASHW.3.UNOFFICIAL

TwinWave.EvilDoc.PDATARootDown.20220203.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.1.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.4.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.8.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTPS_.210304B64.4.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD._OUTFILE.220203B64.2.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Sending a custom TCP request

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Changing an executable file

Running batch commands

Creating a process with a hidden window

Launching a process

Sending an HTTP GET request

Creating a process from a recently created file

Infecting executable files

Result

Verdict:

Malicious

File Type:

Legacy Excel File with Macro

Link:

https://app.docguard.net/a1b3d9563523dea4c11fc5a0adb317e5c47ecc78aea2ef56fc6fc437df985b8a/results/dashboard

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

control.exe macros macros-on-open

Link:

https://www.filescan.io/uploads/6203a5fdc79b424d720ab871/reports/963b9652-38ad-4a35-b87b-cbb21a9abfcd/overview

Label:

Malicious

Suspicious Score:

7.9/10

Score Malicious:

Score Benign:

Link:

https://www.malware.ai/gui/files/?id=c0d2f733-ea98-41cb-8183-da2bcc9694bc

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/a1b3d9563523dea4c11fc5a0adb317e5c47ecc78aea2ef56fc6fc437df985b8a

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro with File System Write

Detected macro logic that can write data to the file system.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a1b3d9563523dea4c11fc5a0adb317e5c47ecc78aea2ef56fc6fc437df985b8a/

Threat name:

Document-Excel.Trojan.Emotet

Status:

Malicious

First seen:

2022-02-09 11:31:11 UTC

File Type:

Document

Extracted files:

AV detection:

18 of 27 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ugz5svrveppkjqi7ywqk3myx4xch5tdyv2ro6vx4n7cdpx4ylofa._file

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch5 banker macro macro_on_action trojan

Link:

https://tria.ge/reports/220209-nmqppaabc4/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Enumerates physical storage devices

Drops file in Windows directory

Drops file in System32 directory

Checks computer location settings

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Emotet

Process spawned unexpected child process

Malware Config

C2 Extraction:

198.199.126.144:443
103.42.57.17:8080
195.154.146.35:443
104.131.62.48:8080
116.124.128.206:8080
54.38.242.185:443
217.182.143.207:443
66.42.57.149:443
185.148.168.220:8080
37.44.244.177:8080
78.47.204.80:443
173.203.78.138:443
190.90.233.66:443
203.153.216.46:443
54.37.106.167:8080
194.9.172.107:8080
168.197.250.14:80
185.184.25.78:8080
191.252.103.16:80
159.69.237.188:443
85.214.67.203:8080
78.46.73.125:443
59.148.253.194:443
118.98.72.86:443
62.171.178.147:8080
195.77.239.39:8080
185.148.168.15:8080
139.196.72.155:8080
54.37.228.122:443
37.59.209.141:8080
198.199.98.78:8080
93.104.208.37:8080
103.41.204.169:8080
128.199.192.135:8080
210.57.209.142:8080
207.148.81.119:8080

Dropper Extraction:

http://alivesystems.com/eln-images/pm2rSsnVM/
http://don-lee.com/_notes/U6H14DNA/
http://mellow60s.com/Stanley_files/EFIqwZ183rfmd/
http://pro-ficientllc.com/PDF_files/5A9W8/
http://lost-earth.com/Black_and_White/ZW4rHEdD1vZX/
http://creedmoorpartners.com/eln-images/wEYKd5KJZETheBswq/
http://mattersoffact.com/cgi/E0C1vtSqt/
http://pureplatinumband.com/Schedule/EW24AYJCvBpN8Gc/
http://homehandyworks.com/eln-images/xFIDPfs4SS1yw7ghXXk/
http://hi-techaudio.com/dir2021/g3d/
http://roderickpowellentertainment.com/eln-images/OVOyN3y9/
https://consciences.center/wp-includes/SkW2w/
http://mag-designs.com/css/L3QKlr6iTzILVzbnC/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/a1b3d9563523/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.