100995087022771591994.xlsm

General
Target

100995087022771591994.xlsm

Filesize

48KB

Completed

15-03-2022 00:18

Score
10/10
MD5

1655267f2eef17c7bea81ee6cf65fbf9

SHA1

dd062a715bd8eee2b8b4d30e6786e5b108b63c1a

SHA256

8e586a928eecac9fa5b4dd6980915389f0092c6ec968ffe90dc4ccf3504ae578

Malware Config

Extracted

Language xlm4.0
Source
URLs
xlm40.dropper

http://www.arkpp.com/ARIS-BSU/9K1/

Extracted

Family emotet
Botnet Epoch4
C2

217.182.143.248:8080

185.4.135.27:8080

192.99.251.50:443

146.59.226.45:443

162.214.118.104:8080

195.154.133.20:443

103.75.201.2:443

5.9.116.246:8080

177.87.70.10:8080

31.24.158.56:8080

103.75.201.4:443

158.69.222.101:443

185.157.82.211:8080

185.8.212.130:7080

186.250.48.117:7080

110.232.117.186:8080

46.55.222.11:443

196.218.30.83:443

51.91.7.5:8080

176.56.128.118:443

207.38.84.195:8080

173.212.193.249:8080

45.118.135.203:7080

164.68.99.3:8080

209.126.98.206:8080

212.24.98.99:8080

151.106.112.196:8080

45.176.232.124:443

153.126.146.25:7080

212.237.17.99:8080

45.142.114.231:8080

107.182.225.142:8080

45.118.115.99:8080

79.172.212.216:8080

50.30.40.196:8080

82.165.152.127:8080

50.116.54.215:443

1.234.2.232:8080

58.227.42.236:80

216.158.226.206:443

159.8.59.82:8080

129.232.188.93:443

189.126.111.200:7080

138.185.72.26:8080

159.65.88.10:8080

103.221.221.247:8080

188.44.20.25:443

203.114.109.124:443

197.242.150.244:8080

51.254.140.238:7080

eck1.plain
ecs1.plain
Signatures 11

Filter: none

Discovery
  • Emotet

    Description

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process
    regsvr32.exe

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process16322368regsvr32.exeEXCEL.EXE
  • Downloads MZ/PE file
  • Loads dropped DLL
    regsvr32.exeregsvr32.exe

    Reported IOCs

    pidprocess
    1632regsvr32.exe
    2468regsvr32.exe
  • Drops file in System32 directory
    regsvr32.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SysWOW64\Lpdbyosnk\lfskowkervxk.phoregsvr32.exe
  • Checks processor information in registry
    EXCEL.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringEXCEL.EXE
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0EXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzEXCEL.EXE
  • Enumerates system info in registry
    EXCEL.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUEXCEL.EXE
  • Suspicious behavior: AddClipboardFormatListener
    EXCEL.EXE

    Reported IOCs

    pidprocess
    2368EXCEL.EXE
  • Suspicious behavior: EnumeratesProcesses
    regsvr32.exe

    Reported IOCs

    pidprocess
    2468regsvr32.exe
    2468regsvr32.exe
  • Suspicious use of SetWindowsHookEx
    EXCEL.EXE

    Reported IOCs

    pidprocess
    2368EXCEL.EXE
    2368EXCEL.EXE
    2368EXCEL.EXE
    2368EXCEL.EXE
    2368EXCEL.EXE
    2368EXCEL.EXE
    2368EXCEL.EXE
    2368EXCEL.EXE
    2368EXCEL.EXE
    2368EXCEL.EXE
    2368EXCEL.EXE
    2368EXCEL.EXE
  • Suspicious use of WriteProcessMemory
    EXCEL.EXEregsvr32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2368 wrote to memory of 16322368EXCEL.EXEregsvr32.exe
    PID 2368 wrote to memory of 16322368EXCEL.EXEregsvr32.exe
    PID 2368 wrote to memory of 16322368EXCEL.EXEregsvr32.exe
    PID 1632 wrote to memory of 24681632regsvr32.exeregsvr32.exe
    PID 1632 wrote to memory of 24681632regsvr32.exeregsvr32.exe
    PID 1632 wrote to memory of 24681632regsvr32.exeregsvr32.exe
Processes 3
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\100995087022771591994.xlsm"
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\SysWow64\regsvr32.exe
      C:\Windows\SysWow64\regsvr32.exe -s ..\fbd.dll
      Process spawned unexpected child process
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Windows\SysWOW64\regsvr32.exe
        C:\Windows\SysWOW64\regsvr32.exe /s "C:\Windows\SysWOW64\Lpdbyosnk\lfskowkervxk.pho"
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        PID:2468
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • C:\Users\Admin\fbd.dll

                          MD5

                          4012125d310517ab80092b2e57be9adf

                          SHA1

                          4ce026cff287d6fc837b7d4b91708977b428d2be

                          SHA256

                          b3a8cd8951e1570f5ef1dd064628ae618848ee262ec69d0d1664138a34a8635d

                          SHA512

                          2c58f266aec3bda265abd363e94dd07db192c1bb57c736da499f9b1df2fdd90885c0036694e76469461ffefe478a20dee2c73f987ee5bce32b7a1c3445d7c29a

                        • C:\Users\Admin\fbd.dll

                          MD5

                          4012125d310517ab80092b2e57be9adf

                          SHA1

                          4ce026cff287d6fc837b7d4b91708977b428d2be

                          SHA256

                          b3a8cd8951e1570f5ef1dd064628ae618848ee262ec69d0d1664138a34a8635d

                          SHA512

                          2c58f266aec3bda265abd363e94dd07db192c1bb57c736da499f9b1df2fdd90885c0036694e76469461ffefe478a20dee2c73f987ee5bce32b7a1c3445d7c29a

                        • C:\Windows\SysWOW64\Lpdbyosnk\lfskowkervxk.pho

                          MD5

                          4012125d310517ab80092b2e57be9adf

                          SHA1

                          4ce026cff287d6fc837b7d4b91708977b428d2be

                          SHA256

                          b3a8cd8951e1570f5ef1dd064628ae618848ee262ec69d0d1664138a34a8635d

                          SHA512

                          2c58f266aec3bda265abd363e94dd07db192c1bb57c736da499f9b1df2fdd90885c0036694e76469461ffefe478a20dee2c73f987ee5bce32b7a1c3445d7c29a

                        • memory/1632-151-0x0000000010000000-0x0000000010028000-memory.dmp

                        • memory/2368-142-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-136-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-137-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-138-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-139-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-140-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-141-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-135-0x00007FFBD6210000-0x00007FFBD6220000-memory.dmp

                        • memory/2368-144-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-143-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-145-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-146-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-147-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-148-0x00007FFC16190000-0x00007FFC16385000-memory.dmp

                        • memory/2368-134-0x00007FFBD6210000-0x00007FFBD6220000-memory.dmp

                        • memory/2368-132-0x00007FFBD6210000-0x00007FFBD6220000-memory.dmp

                        • memory/2368-133-0x00007FFBD6210000-0x00007FFBD6220000-memory.dmp

                        • memory/2368-131-0x00007FFBD6210000-0x00007FFBD6220000-memory.dmp