MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c36c03c55a5b549fb8829e858062bf1939d0f25f458cb54e2776ccde71d15946. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 9

Maldoc score: 14

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	c36c03c55a5b549fb8829e858062bf1939d0f25f458cb54e2776ccde71d15946
SHA3-384 hash:	b00e76ffb293366a344fcc6470042e0a60267accc0d16570dd27f8d1852743e924f42328a00bbec6bdc0253d5361ba0b
SHA1 hash:	8b4081eec46c77b753422895bd47e37f27d84147
MD5 hash:	08581a8a3d5325047ee5b622d325eda5
humanhash:	oklahoma-ink-lamp-yankee
File name:	tmppmnhyse4
Download:	download sample
Signature	Heodo Create hunting rule
File size:	141'312 bytes
First seen:	2022-02-09 16:58:16 UTC
Last seen:	Never
File type:	xlsx
MIME type:	application/vnd.ms-excel
ssdeep	3072:zKehv7q2Pjx45uoDGTj+5xtekEvi8/dg0a3Wm47CdX5gVvhoxzYoasdJXIchlL:Wehv7q2Pjx45uoDGTj+5xtFEvi8/dg0k
TLSH	T1F2D36B6AB688CD0BCE4953318EAAC7F63237BC414E66D3977285F72E2D77580DA12704
Reporter	Cryptolaemus1
Tags:	Emotet epoch5 Heodo xlsx

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 14

OLE dump

MalwareBazaar was able to identify 23 sections in this file using oledump:

Section ID	Section size	Section name
1	109 bytes	CompObj
2	240 bytes	DocumentSummaryInformation
3	204 bytes	SummaryInformation
4	88037 bytes	Workbook
5	683 bytes	_VBA_PROJECT_CUR/PROJECT
6	158 bytes	_VBA_PROJECT_CUR/PROJECTwm
7	8764 bytes	_VBA_PROJECT_CUR/VBA/GsreG4hts9id8
8	7462 bytes	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
9	1681 bytes	_VBA_PROJECT_CUR/VBA/__SRP_0
10	166 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1
11	400 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2
12	241 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3
13	919 bytes	_VBA_PROJECT_CUR/VBA/dir
14	4639 bytes	_VBA_PROJECT_CUR/VBA/hDStysh4oeed
15	990 bytes	_VBA_PROJECT_CUR/VBA/rs5udfdreh
16	16946 bytes	_VBA_PROJECT_CUR/VBA/serh3wdrttTS4
17	97 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/CompObj
18	292 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/VBFrame
19	263 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/f
20	112 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/i04/CompObj
21	93 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/i04/f
22	0 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/i04/o
23	184 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/o

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Workbook_Open	Runs when the Excel Workbook is opened
AutoExec	tbsdFAWEhs57_Change	Runs when the file is opened and ActiveX objects trigger events
Suspicious	Open	May open a file
Suspicious	Output	May write to a file (if combined with Open)
Suspicious	CreateObject	May create an OLE object
Suspicious	exec	May run an executable file or a system
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all) code and P-code are different, this may have been used to hide malicious code

Intelligence

File Origin

# of uploads :

# of downloads :

164

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Malicious

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

True

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/239757/

Detection(s):

TwinWave.EvilDoc.DOCXSTRGOOD..JSE.200618.UNOFFICIAL

TwinWave.EvilDoc.CROStringBuilderHidingPlacesPapaDontTakeNoMess.20200916.UNOFFICIAL

TwinWave.EvilDoc.CROKissFromARose.M4.20201215.UNOFFICIAL

TwinWave.EvilDoc.DetonatorFRMActionAndAction.20210308.UNOFFICIAL

TwinWave.EvilDoc.CORedLightSyndrome.20210907.UNOFFICIAL

SecuriteInfo.com.PUA.PowerShell.Agent-19.UNOFFICIAL

MiscreantPunch.EvilMacro.PSHELLB64INVOKEDASHWINVOKEDASHW.3.UNOFFICIAL

TwinWave.EvilDoc.PDATARootDown.20220203.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.4.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.8.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTPS_.210304B64.1.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTPS_.210304B64.4.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTPS_.210304B64.8.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD._OUTFILE.220203B64.2.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Running batch commands

Creating a process with a hidden window

Launching a process

Sending an HTTP GET request

Moving a recently created file

Creating a process from a recently created file

Result

Verdict:

Malicious

File Type:

Legacy Excel File with Macro

Link:

https://app.docguard.net/c36c03c55a5b549fb8829e858062bf1939d0f25f458cb54e2776ccde71d15946/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive macros macros-on-open vbastomped

Link:

https://www.filescan.io/uploads/6203f2e1942573cad44c0177/reports/be12e5c9-9765-4091-855d-cf396545ef47/overview

Label:

Malicious

Suspicious Score:

7.6/10

Score Malicious:

76%

Score Benign:

24%

Link:

https://www.malware.ai/gui/files/?id=487d96c7-4321-40fe-a283-ba98518c9f90

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/c36c03c55a5b549fb8829e858062bf1939d0f25f458cb54e2776ccde71d15946

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro with File System Write

Detected macro logic that can write data to the file system.

Macro Execution Coercion

Detected a document that appears to social engineer the user into activating embedded logic.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c36c03c55a5b549fb8829e858062bf1939d0f25f458cb54e2776ccde71d15946/

Threat name:

Document-Excel.Trojan.Emotet

Status:

Malicious

First seen:

2022-02-09 16:59:08 UTC

File Type:

Document

Extracted files:

AV detection:

17 of 28 (60.71%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ynwahrk2lnkj7oect2cyayv7de45b4s7iwglktrho3gn44orlfda._file

Result

Malware family:

n/a

Score:

10/10

Tags:

macro macro_on_action

Link:

https://tria.ge/reports/220209-vhevysbbgk/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Enumerates physical storage devices

Program crash

Drops file in Windows directory

Process spawned unexpected child process

Suspicious use of NtCreateProcessExOtherParentProcess

Malware Config

Dropper Extraction:

http://midnightsilvercrafters.com/store/wBjNOUw/
http://tempral.com/NATE_05_22_2009/BI710N4cQ6R3/
https://redington.karmatechmediaworks.com/wp-content/3JVuVx7QUM/
https://uhc.karmatechmediaworks.com/wp-content/0EqfdeznntlOpaIP2Qv/
https://servilogic.net/b/14hqrdyP0Z3WsbQib8/
https://comezmuhendislik.com/ljfrmm/VTpHRFWoORAHnRQ3aQL/
http://webmail.glemedical.com/wp-content/J1M2xxodH/
http://toto.karmatechmediaworks.com/wp-content/i826vbcVgRJ/
https://golfpia.karmatechmediaworks.com/wp-content/oEicpDnEkk/
https://fortiuspharma.com/y6krss/EGm347cqj5/
https://garyjharris.com/cgi-bin/0hH/
https://vietnam.karmatechmediaworks.com/wp-content/PfSVQagusZy7AaMw/
https://vinculinc.karmatechmediaworks.com/wp-content/VlcOPPwgidWlXDJNs6/

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/239757/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample