Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
12-01-2022 03:59
Behavioral task
behavioral1
Sample
e58cd1fc646d37b9fd8040d9f7f4110bb07cbdadb1f5dd4a55413acacd33807d.xls
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
e58cd1fc646d37b9fd8040d9f7f4110bb07cbdadb1f5dd4a55413acacd33807d.xls
Resource
win10-en-20211208
General
-
Target
e58cd1fc646d37b9fd8040d9f7f4110bb07cbdadb1f5dd4a55413acacd33807d.xls
-
Size
118KB
-
MD5
0f2bd22e41ca408211f2fcfbf4d05645
-
SHA1
e396920d9f3ddaa9c1c25325794dc1cc9d5d860f
-
SHA256
e58cd1fc646d37b9fd8040d9f7f4110bb07cbdadb1f5dd4a55413acacd33807d
-
SHA512
75de138b42573b73253ca721cc2727ffcf0e0ce4336866e8e952380b3749ec7064a65ae6984ecd0f3d00e8784f40a2e00fe00fd18b78a60b4b54e888aacdd3fb
Malware Config
Extracted
http://www.cuneytkocas.com/wp-content/VSnofpES1wO2CcVob/
http://towardsun.net/admin/BYGGkrYAnT/
http://k-antiques.jp/wp-includes/SCYdA6TLohYk2/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2884 2428 rundll32.exe EXCEL.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 50 3660 rundll32.exe 52 3660 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2884 rundll32.exe 3736 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ulbgovcddwzqozil\isosentxedwqs.hog rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2428 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3660 rundll32.exe 3660 rundll32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE 2428 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exerundll32.exedescription pid process target process PID 2428 wrote to memory of 2884 2428 EXCEL.EXE rundll32.exe PID 2428 wrote to memory of 2884 2428 EXCEL.EXE rundll32.exe PID 2428 wrote to memory of 2884 2428 EXCEL.EXE rundll32.exe PID 2884 wrote to memory of 3736 2884 rundll32.exe rundll32.exe PID 2884 wrote to memory of 3736 2884 rundll32.exe rundll32.exe PID 2884 wrote to memory of 3736 2884 rundll32.exe rundll32.exe PID 3736 wrote to memory of 1836 3736 rundll32.exe rundll32.exe PID 3736 wrote to memory of 1836 3736 rundll32.exe rundll32.exe PID 3736 wrote to memory of 1836 3736 rundll32.exe rundll32.exe PID 1836 wrote to memory of 3660 1836 rundll32.exe rundll32.exe PID 1836 wrote to memory of 3660 1836 rundll32.exe rundll32.exe PID 1836 wrote to memory of 3660 1836 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e58cd1fc646d37b9fd8040d9f7f4110bb07cbdadb1f5dd4a55413acacd33807d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe ..\sun.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\sun.ocx",DllRegisterServer3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ulbgovcddwzqozil\isosentxedwqs.hog",wzvBBysg4⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Ulbgovcddwzqozil\isosentxedwqs.hog",DllRegisterServer5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3660
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
ac69c213917817327baf144bf3370734
SHA12fe089e63d27cd35b7d0957a15a1e2b585f2d617
SHA2566a104fdf854ab537ed54edeca3db35a193d156262094e2dc42db511cada7d047
SHA512c9b7c8bdf79fe8cd313b46c75a8617f412367530f78430120c38728a75092aa9683f3666c5688d47133f6a062cce4bad665530be58db3327df1ae98ab8994de5
-
MD5
ac69c213917817327baf144bf3370734
SHA12fe089e63d27cd35b7d0957a15a1e2b585f2d617
SHA2566a104fdf854ab537ed54edeca3db35a193d156262094e2dc42db511cada7d047
SHA512c9b7c8bdf79fe8cd313b46c75a8617f412367530f78430120c38728a75092aa9683f3666c5688d47133f6a062cce4bad665530be58db3327df1ae98ab8994de5
-
MD5
ac69c213917817327baf144bf3370734
SHA12fe089e63d27cd35b7d0957a15a1e2b585f2d617
SHA2566a104fdf854ab537ed54edeca3db35a193d156262094e2dc42db511cada7d047
SHA512c9b7c8bdf79fe8cd313b46c75a8617f412367530f78430120c38728a75092aa9683f3666c5688d47133f6a062cce4bad665530be58db3327df1ae98ab8994de5