MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7bacbacfa7ccb362e16ea7fe7560d1576a91b089d4dfc719de08405cd526ad0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Emotet (aka Heodo)

Vendor detections: 9

Maldoc score: 14

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	e7bacbacfa7ccb362e16ea7fe7560d1576a91b089d4dfc719de08405cd526ad0
SHA3-384 hash:	d7839c0e4439c184ac5b3e7ebe0362fcb57cb786465fd40889ffcd6d707eede3a116b078ab53f6577732d900b4162c53
SHA1 hash:	d0acac39718d6d6fc8af23bc30cf5f9459ddfd91
MD5 hash:	0402ffc4b6cc026113f715ba999f2342
humanhash:	failed-alpha-monkey-tango
File name:	tmpy442qum5
Download:	download sample
Signature	Heodo Create hunting rule
File size:	141'312 bytes
First seen:	2022-02-09 17:55:37 UTC
Last seen:	2022-02-13 23:49:12 UTC
File type:	xlsx
MIME type:	application/vnd.ms-excel
ssdeep	3072:XKehv7q2Pjx45uoDGTj+5xtekEvi8/dg0a3Wm47CdX5gVvhoxzYAasdJXIchtL:aehv7q2Pjx45uoDGTj+5xtFEvi8/dg0k
TLSH	T19DD37B6AB688DC0BCE4953318EAAC7F63237BC414E66D3977184F72E2D77580DA12704
Reporter	Cryptolaemus1
Tags:	Emotet epoch5 Heodo xlsx

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 14

OLE dump

MalwareBazaar was able to identify 23 sections in this file using oledump:

Section ID	Section size	Section name
1	109 bytes	CompObj
2	240 bytes	DocumentSummaryInformation
3	204 bytes	SummaryInformation
4	88037 bytes	Workbook
5	683 bytes	_VBA_PROJECT_CUR/PROJECT
6	158 bytes	_VBA_PROJECT_CUR/PROJECTwm
7	8764 bytes	_VBA_PROJECT_CUR/VBA/GsreG4hts9id8
8	7462 bytes	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
9	1681 bytes	_VBA_PROJECT_CUR/VBA/__SRP_0
10	166 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1
11	400 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2
12	241 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3
13	919 bytes	_VBA_PROJECT_CUR/VBA/dir
14	4639 bytes	_VBA_PROJECT_CUR/VBA/hDStysh4oeed
15	990 bytes	_VBA_PROJECT_CUR/VBA/rs5udfdreh
16	16946 bytes	_VBA_PROJECT_CUR/VBA/serh3wdrttTS4
17	97 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/CompObj
18	292 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/VBFrame
19	263 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/f
20	112 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/i04/CompObj
21	93 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/i04/f
22	0 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/i04/o
23	184 bytes	_VBA_PROJECT_CUR/serh3wdrttTS4/o

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Workbook_Open	Runs when the Excel Workbook is opened
AutoExec	tbsdFAWEhs57_Change	Runs when the file is opened and ActiveX objects trigger events
Suspicious	Open	May open a file
Suspicious	Output	May write to a file (if combined with Open)
Suspicious	CreateObject	May create an OLE object
Suspicious	exec	May run an executable file or a system
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all) code and P-code are different, this may have been used to hide malicious code

Intelligence

File Origin

# of uploads :

# of downloads :

155

Origin country :

n/a

Vendor Threat Intelligence

Verdict:

Malicious

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

False

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/239790/

Detection(s):

TwinWave.EvilDoc.DOCXSTRGOOD..JSE.200618.UNOFFICIAL

TwinWave.EvilDoc.CROStringBuilderHidingPlacesPapaDontTakeNoMess.20200916.UNOFFICIAL

TwinWave.EvilDoc.CROKissFromARose.M4.20201215.UNOFFICIAL

TwinWave.EvilDoc.DetonatorFRMActionAndAction.20210308.UNOFFICIAL

TwinWave.EvilDoc.CORedLightSyndrome.20210907.UNOFFICIAL

SecuriteInfo.com.PUA.PowerShell.Agent-19.UNOFFICIAL

MiscreantPunch.EvilMacro.PSHELLB64INVOKEDASHWINVOKEDASHW.3.UNOFFICIAL

TwinWave.EvilDoc.PDATARootDown.20220203.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.4.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTP_.210304B64.8.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTPS_.210304B64.1.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTPS_.210304B64.4.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD.HTTPS_.210304B64.8.UNOFFICIAL

TwinWave.EvilDoc.DOCXRSTRGOOD._OUTFILE.220203B64.2.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

DNS request

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Running batch commands

Creating a process with a hidden window

Launching a process

Creating a process from a recently created file

Result

Verdict:

Malicious

File Type:

Legacy Excel File with Macro

Link:

https://app.docguard.net/e7bacbacfa7ccb362e16ea7fe7560d1576a91b089d4dfc719de08405cd526ad0/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive macros macros-on-open vbastomped

Link:

https://www.filescan.io/uploads/6204003c36f99219183220ed/reports/f75700aa-ee64-412d-9f0e-c080a34433ca/overview

Label:

Malicious

Suspicious Score:

7.7/10

Score Malicious:

78%

Score Benign:

22%

Link:

https://www.malware.ai/gui/files/?id=cc7ad3a5-b987-4cd7-ba30-211583b48ee3

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/e7bacbacfa7ccb362e16ea7fe7560d1576a91b089d4dfc719de08405cd526ad0

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro with File System Write

Detected macro logic that can write data to the file system.

Macro Execution Coercion

Detected a document that appears to social engineer the user into activating embedded logic.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e7bacbacfa7ccb362e16ea7fe7560d1576a91b089d4dfc719de08405cd526ad0/

Threat name:

Document-Excel.Trojan.Emotet

Status:

Malicious

First seen:

2022-02-09 17:56:10 UTC

File Type:

Document

Extracted files:

AV detection:

16 of 27 (59.26%)

Threat level:

5/5

Result

Malware family:

emotet

Score:

10/10

Tags:

family:emotet botnet:epoch5 banker macro macro_on_action suricata trojan

Link:

https://tria.ge/reports/220209-wh1yvsbcgn/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Enumerates physical storage devices

Drops file in Windows directory

Drops file in System32 directory

Checks computer location settings

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Emotet

Process spawned unexpected child process

suricata: ET MALWARE W32/Emotet CnC Beacon 3

Malware Config

C2 Extraction:

198.199.126.144:443
103.42.57.17:8080
195.154.146.35:443
104.131.62.48:8080
116.124.128.206:8080
54.38.242.185:443
217.182.143.207:443
66.42.57.149:443
185.148.168.220:8080
37.44.244.177:8080
78.47.204.80:443
173.203.78.138:443
190.90.233.66:443
203.153.216.46:443
54.37.106.167:8080
194.9.172.107:8080
168.197.250.14:80
185.184.25.78:8080
191.252.103.16:80
159.69.237.188:443
85.214.67.203:8080
78.46.73.125:443
59.148.253.194:443
118.98.72.86:443
62.171.178.147:8080
195.77.239.39:8080
185.148.168.15:8080
139.196.72.155:8080
54.37.228.122:443
37.59.209.141:8080
198.199.98.78:8080
93.104.208.37:8080
103.41.204.169:8080
128.199.192.135:8080
210.57.209.142:8080
207.148.81.119:8080

Dropper Extraction:

http://midnightsilvercrafters.com/store/wBjNOUw/
http://tempral.com/NATE_05_22_2009/BI710N4cQ6R3/
https://redington.karmatechmediaworks.com/wp-content/3JVuVx7QUM/
https://uhc.karmatechmediaworks.com/wp-content/0EqfdeznntlOpaIP2Qv/
https://servilogic.net/b/14hqrdyP0Z3WsbQib8/
https://comezmuhendislik.com/ljfrmm/VTpHRFWoORAHnRQ3aQL/
http://webmail.glemedical.com/wp-content/J1M2xxodH/
http://toto.karmatechmediaworks.com/wp-content/i826vbcVgRJ/
https://golfpia.karmatechmediaworks.com/wp-content/oEicpDnEkk/
https://fortiuspharma.com/y6krss/EGm347cqj5/
https://garyjharris.com/cgi-bin/0hH/
https://vietnam.karmatechmediaworks.com/wp-content/PfSVQagusZy7AaMw/
https://vinculinc.karmatechmediaworks.com/wp-content/VlcOPPwgidWlXDJNs6/

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/239790/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample