Analysis
-
max time kernel
60s -
max time network
54s -
platform
windows10_x64 -
resource
win10-de-20211104 -
submitted
25-11-2021 16:58
Static task
static1
General
-
Target
4175c8f81f42c6b32391e1785e3c32d740819b5cb529357bd07082aa6e6e2e77.dll
-
Size
653KB
-
MD5
b7d142e4b6972e8092d0a3844f0f07a5
-
SHA1
6fe12707b4ee748270be6f8651c18232aa49f8e8
-
SHA256
4175c8f81f42c6b32391e1785e3c32d740819b5cb529357bd07082aa6e6e2e77
-
SHA512
5b1b2cb8d15c63894b6defe7f345767f760de556e84e2ed63c9a07d714aff3a816f9d442ede735a1b06d0f3c7b28f8a7e9b78386c4f2b588e6124067aead9404
Malware Config
Extracted
emotet
Epoch5
51.178.61.60:443
168.197.250.14:80
45.79.33.48:8080
196.44.98.190:8080
177.72.80.14:7080
51.210.242.234:8080
185.148.169.10:8080
142.4.219.173:8080
78.47.204.80:443
78.46.73.125:443
37.44.244.177:8080
37.59.209.141:8080
191.252.103.16:80
54.38.242.185:443
85.214.67.203:8080
54.37.228.122:443
207.148.81.119:8080
195.77.239.39:8080
66.42.57.149:443
195.154.146.35:443
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 19 3112 rundll32.exe 21 3112 rundll32.exe -
Modifies data under HKEY_USERS 22 IoCs
Processes:
OfficeC2RClient.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,17110988,7153487,39965824,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t|1637753087" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,941 10,1329 15,941 15,941 6,1329 100,1329 6" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeC2RClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeC2RClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeC2RClient.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3112 rundll32.exe 3112 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OfficeC2RClient.exepid process 1940 OfficeC2RClient.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1264 wrote to memory of 1112 1264 rundll32.exe rundll32.exe PID 1264 wrote to memory of 1112 1264 rundll32.exe rundll32.exe PID 1264 wrote to memory of 1112 1264 rundll32.exe rundll32.exe PID 1112 wrote to memory of 3112 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 3112 1112 rundll32.exe rundll32.exe PID 1112 wrote to memory of 3112 1112 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4175c8f81f42c6b32391e1785e3c32d740819b5cb529357bd07082aa6e6e2e77.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4175c8f81f42c6b32391e1785e3c32d740819b5cb529357bd07082aa6e6e2e77.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\4175c8f81f42c6b32391e1785e3c32d740819b5cb529357bd07082aa6e6e2e77.dll",Control_RunDLL3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1112-118-0x0000000000000000-mapping.dmp
-
memory/1112-119-0x00000000041D0000-0x00000000041F8000-memory.dmpFilesize
160KB
-
memory/3112-122-0x0000000000000000-mapping.dmp
-
memory/3112-123-0x0000000000270000-0x0000000000298000-memory.dmpFilesize
160KB
-
memory/3112-126-0x0000000004560000-0x0000000004588000-memory.dmpFilesize
160KB
-
memory/3112-129-0x0000000004740000-0x0000000004768000-memory.dmpFilesize
160KB
-
memory/3112-132-0x0000000004820000-0x0000000004848000-memory.dmpFilesize
160KB
-
memory/3112-135-0x0000000004900000-0x0000000004928000-memory.dmpFilesize
160KB
-
memory/3112-138-0x00000000049E0000-0x0000000004A08000-memory.dmpFilesize
160KB
-
memory/3112-141-0x0000000004AC0000-0x0000000004AE8000-memory.dmpFilesize
160KB