Analysis
-
max time kernel
162s -
max time network
174s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
20-05-2022 21:28
Behavioral task
behavioral1
Sample
519644773f5026d5fd088c0004f70e248fce65977730d023d7a6a6efe7866df6.xls
Resource
win10-20220414-en
General
-
Target
519644773f5026d5fd088c0004f70e248fce65977730d023d7a6a6efe7866df6.xls
-
Size
67KB
-
MD5
c69b406d4db830abd364866fd17522a3
-
SHA1
f55c99295bba99c83d3e35b639d36c7d46ec80a2
-
SHA256
519644773f5026d5fd088c0004f70e248fce65977730d023d7a6a6efe7866df6
-
SHA512
e298a494a743d141be825953b59da35bb6e6eab3ec6bc99c14d71884284f3b1952d822f3c9af6ce6e73850fd5539bfba0f55892871e945118ee2715b80e4206c
Malware Config
Extracted
http://www.clasite.com/blogs/IEEsyn/
https://oncrete-egy.com/wp-content/V6Igzw8/
http://opencart-destek.com/catalog/OqHwQ8xlWa5Goyo/
http://www.pjesacac.com/components/O93XXhMN3tOtTlV/
Extracted
emotet
Epoch5
194.9.172.107:8080
66.42.57.149:443
165.22.73.229:8080
202.29.239.162:443
76.189.152.228:1645
59.185.164.123:8382
115.19.43.159:30377
104.248.225.227:8080
54.38.242.185:443
103.133.214.242:8080
78.47.204.80:443
210.57.209.142:8080
103.41.204.169:8080
118.98.72.86:443
88.217.172.165:8080
87.106.97.83:7080
85.25.120.45:8080
195.77.239.39:8080
37.44.244.177:8080
36.67.23.59:443
93.41.142.108:30345
42.6.66.255:39545
160.16.143.191:7080
38.217.125.207:49663
54.38.143.246:7080
159.69.237.188:443
68.183.93.250:443
54.37.228.122:443
190.90.233.66:443
37.59.209.141:8080
29.146.139.51:30005
18.37.240.161:6409
178.62.112.199:8080
59.148.253.194:443
196.44.98.190:8080
79.235.8.209:58224
202.28.34.99:8080
78.46.73.125:443
51.68.141.164:8080
207.148.81.119:8080
93.104.209.107:8080
185.148.168.220:8080
100.21.231.107:63582
103.85.95.4:8080
62.171.178.147:8080
175.126.176.79:8080
134.122.119.23:8080
202.134.4.210:7080
116.124.128.206:8080
45.71.195.104:8080
110.235.83.107:7080
103.56.149.105:8080
68.183.91.111:8080
119.44.217.160:39748
5.56.132.177:8080
195.154.146.35:443
217.182.143.207:443
54.37.106.167:8080
85.214.67.203:8080
90.63.125.244:30283
188.225.32.231:4143
103.42.58.120:7080
139.196.72.155:8080
103.8.26.17:8080
70.11.238.157:53347
55.74.152.152:37910
113.59.252.140:36286
97.67.147.111:40652
116.64.52.198:22668
61.87.190.176:45536
203.153.216.46:443
27.55.166.48:19567
32.53.89.86:40407
31.238.181.227:13139
26.19.105.199:26580
73.238.38.64:44958
18.191.122.164:4987
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3928 4700 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3700 4700 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4632 4700 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1556 4700 regsvr32.exe EXCEL.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 3928 regsvr32.exe 3700 regsvr32.exe 4632 regsvr32.exe 1556 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4700 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 4804 regsvr32.exe 4804 regsvr32.exe 4556 regsvr32.exe 4556 regsvr32.exe 2488 regsvr32.exe 2488 regsvr32.exe 908 regsvr32.exe 908 regsvr32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 4700 EXCEL.EXE 4700 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE 4700 EXCEL.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid process target process PID 4700 wrote to memory of 3928 4700 EXCEL.EXE regsvr32.exe PID 4700 wrote to memory of 3928 4700 EXCEL.EXE regsvr32.exe PID 4700 wrote to memory of 3700 4700 EXCEL.EXE regsvr32.exe PID 4700 wrote to memory of 3700 4700 EXCEL.EXE regsvr32.exe PID 4700 wrote to memory of 4632 4700 EXCEL.EXE regsvr32.exe PID 4700 wrote to memory of 4632 4700 EXCEL.EXE regsvr32.exe PID 4632 wrote to memory of 4804 4632 regsvr32.exe regsvr32.exe PID 4632 wrote to memory of 4804 4632 regsvr32.exe regsvr32.exe PID 3700 wrote to memory of 4556 3700 regsvr32.exe regsvr32.exe PID 3700 wrote to memory of 4556 3700 regsvr32.exe regsvr32.exe PID 4700 wrote to memory of 1556 4700 EXCEL.EXE regsvr32.exe PID 4700 wrote to memory of 1556 4700 EXCEL.EXE regsvr32.exe PID 1556 wrote to memory of 2488 1556 regsvr32.exe regsvr32.exe PID 1556 wrote to memory of 2488 1556 regsvr32.exe regsvr32.exe PID 3928 wrote to memory of 908 3928 regsvr32.exe regsvr32.exe PID 3928 wrote to memory of 908 3928 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\519644773f5026d5fd088c0004f70e248fce65977730d023d7a6a6efe7866df6.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZpsexKHjMEwPUa\bOcpOZirYrD.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\AdfhdOTEov\LyoPoXKCS.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\Cetyll\iNZrcmjHEOyw.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\MVkyeHjSF\ZOthPLBS.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\uxevr1.ocxFilesize
373KB
MD50c833f3d3633f1239d5f7d27ec411b35
SHA1f6f5c954a833f3ccc59ae9596f3365a1deff390a
SHA25647efdef5ba81eacc1f97698b52204aeab8e3c2af3505a50a979aa03262dc8cb2
SHA5129b677262e374d3714b6e88c574e155503bc35b9616b5abb1ad1993cf5b1a799d5d3d5a73a1598235370f86fc650e30aecee5c53bb40d48b865c8cb2608a7f050
-
C:\Users\Admin\uxevr2.ocxFilesize
362KB
MD51b79cd5262c8073e33ace2e4e52cccad
SHA1a510b2d5b4f88fea92e81fc93b8d0cbb4c9bd935
SHA2563d9fac6c865eeec98c6d7cf04cd93faf3f13616b83e7ae6291520fcd0413eb3e
SHA512d76806a79883e4177916ebf22158ac00ccbc029ccd42d26f208fd777e13c12c0f05d6f7c034013851a7c6755148d7032afb00c2dfef1547024d5ec78da8f9dc8
-
C:\Users\Admin\uxevr3.ocxFilesize
362KB
MD532c0a08babd7ba6a91df225e1167f748
SHA1df6f033e71935a9ffbc095452b6f5a67ed1d9d30
SHA2562e644ea3556a702ac47593b4ee197ff71bc7cadcb60378101ca4e54cbd8dbc60
SHA512ebbac04703ad19e03acc5c480d25fe37364721975a4784480478121704fdce63c16a82add65cc3ceb629e5d11a0e6401ab66e6b13a4629ef43d6ae48f82b5688
-
C:\Users\Admin\uxevr4.ocxFilesize
362KB
MD575099b74b645474ccb50ca38ced4b35c
SHA14a28ba9aee5fe20b8d254eb3d03ffcefc055fb8a
SHA256d266fbbe011c34c018c6573f548a4915b6cb95ada0fe9325b7341ff89bebc210
SHA512fe9bd7e3848b084f133e6ce5776f986dce65a78ce989f48ca7c7543b52e66bd13a64fde1a1945620da5a6697be1303c40cfbdbcb6ab38df871a62f38968266c8
-
\Users\Admin\uxevr1.ocxFilesize
373KB
MD50c833f3d3633f1239d5f7d27ec411b35
SHA1f6f5c954a833f3ccc59ae9596f3365a1deff390a
SHA25647efdef5ba81eacc1f97698b52204aeab8e3c2af3505a50a979aa03262dc8cb2
SHA5129b677262e374d3714b6e88c574e155503bc35b9616b5abb1ad1993cf5b1a799d5d3d5a73a1598235370f86fc650e30aecee5c53bb40d48b865c8cb2608a7f050
-
\Users\Admin\uxevr2.ocxFilesize
362KB
MD51b79cd5262c8073e33ace2e4e52cccad
SHA1a510b2d5b4f88fea92e81fc93b8d0cbb4c9bd935
SHA2563d9fac6c865eeec98c6d7cf04cd93faf3f13616b83e7ae6291520fcd0413eb3e
SHA512d76806a79883e4177916ebf22158ac00ccbc029ccd42d26f208fd777e13c12c0f05d6f7c034013851a7c6755148d7032afb00c2dfef1547024d5ec78da8f9dc8
-
\Users\Admin\uxevr3.ocxFilesize
362KB
MD532c0a08babd7ba6a91df225e1167f748
SHA1df6f033e71935a9ffbc095452b6f5a67ed1d9d30
SHA2562e644ea3556a702ac47593b4ee197ff71bc7cadcb60378101ca4e54cbd8dbc60
SHA512ebbac04703ad19e03acc5c480d25fe37364721975a4784480478121704fdce63c16a82add65cc3ceb629e5d11a0e6401ab66e6b13a4629ef43d6ae48f82b5688
-
\Users\Admin\uxevr4.ocxFilesize
362KB
MD575099b74b645474ccb50ca38ced4b35c
SHA14a28ba9aee5fe20b8d254eb3d03ffcefc055fb8a
SHA256d266fbbe011c34c018c6573f548a4915b6cb95ada0fe9325b7341ff89bebc210
SHA512fe9bd7e3848b084f133e6ce5776f986dce65a78ce989f48ca7c7543b52e66bd13a64fde1a1945620da5a6697be1303c40cfbdbcb6ab38df871a62f38968266c8
-
memory/908-311-0x0000000000000000-mapping.dmp
-
memory/1556-279-0x0000000000000000-mapping.dmp
-
memory/2488-297-0x0000000000000000-mapping.dmp
-
memory/3700-264-0x0000000180000000-0x0000000180031000-memory.dmpFilesize
196KB
-
memory/3700-261-0x0000000000000000-mapping.dmp
-
memory/3928-251-0x0000000000000000-mapping.dmp
-
memory/3928-306-0x0000000180000000-0x0000000180031000-memory.dmpFilesize
196KB
-
memory/4556-278-0x0000000000000000-mapping.dmp
-
memory/4632-269-0x0000000000000000-mapping.dmp
-
memory/4700-117-0x00007FFD41F90000-0x00007FFD41FA0000-memory.dmpFilesize
64KB
-
memory/4700-130-0x00007FFD3F440000-0x00007FFD3F450000-memory.dmpFilesize
64KB
-
memory/4700-129-0x00007FFD3F440000-0x00007FFD3F450000-memory.dmpFilesize
64KB
-
memory/4700-120-0x00007FFD41F90000-0x00007FFD41FA0000-memory.dmpFilesize
64KB
-
memory/4700-119-0x00007FFD41F90000-0x00007FFD41FA0000-memory.dmpFilesize
64KB
-
memory/4700-118-0x00007FFD41F90000-0x00007FFD41FA0000-memory.dmpFilesize
64KB
-
memory/4804-277-0x0000000000000000-mapping.dmp