Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
20-05-2022 21:05
Behavioral task
behavioral1
Sample
42588f7afd19d6860fd55d76e9939f8f24d7b17dd79d8ddd793a26ac1fd43f0d.xls
Resource
win10-20220414-en
General
-
Target
42588f7afd19d6860fd55d76e9939f8f24d7b17dd79d8ddd793a26ac1fd43f0d.xls
-
Size
67KB
-
MD5
ee1ac51529368a0229dde39966ef1783
-
SHA1
5016460ed87bb0e303f81b99be6577ae60cb9f96
-
SHA256
42588f7afd19d6860fd55d76e9939f8f24d7b17dd79d8ddd793a26ac1fd43f0d
-
SHA512
eca4c88b028997fbb0e68efb6561eedda319e3842256f1c579b96dfe6b66908061fe2b1c75bf84d316c230331d20dfebbd1636b411c0100f7442a5ea89cd57c1
Malware Config
Extracted
http://www.clasite.com/blogs/IEEsyn/
https://oncrete-egy.com/wp-content/V6Igzw8/
http://opencart-destek.com/catalog/OqHwQ8xlWa5Goyo/
http://www.pjesacac.com/components/O93XXhMN3tOtTlV/
Extracted
emotet
Epoch5
194.9.172.107:8080
66.42.57.149:443
165.22.73.229:8080
202.29.239.162:443
76.189.152.228:1645
59.185.164.123:8382
115.19.43.159:30377
104.248.225.227:8080
54.38.242.185:443
103.133.214.242:8080
78.47.204.80:443
210.57.209.142:8080
103.41.204.169:8080
118.98.72.86:443
88.217.172.165:8080
87.106.97.83:7080
85.25.120.45:8080
195.77.239.39:8080
37.44.244.177:8080
36.67.23.59:443
93.41.142.108:30345
42.6.66.255:39545
160.16.143.191:7080
38.217.125.207:49663
54.38.143.246:7080
159.69.237.188:443
68.183.93.250:443
54.37.228.122:443
190.90.233.66:443
37.59.209.141:8080
29.146.139.51:30005
18.37.240.161:6409
178.62.112.199:8080
59.148.253.194:443
196.44.98.190:8080
79.235.8.209:58224
202.28.34.99:8080
78.46.73.125:443
51.68.141.164:8080
207.148.81.119:8080
93.104.209.107:8080
185.148.168.220:8080
100.21.231.107:63582
103.85.95.4:8080
62.171.178.147:8080
175.126.176.79:8080
134.122.119.23:8080
202.134.4.210:7080
116.124.128.206:8080
45.71.195.104:8080
110.235.83.107:7080
103.56.149.105:8080
68.183.91.111:8080
119.44.217.160:39748
5.56.132.177:8080
195.154.146.35:443
217.182.143.207:443
54.37.106.167:8080
85.214.67.203:8080
90.63.125.244:30283
188.225.32.231:4143
103.42.58.120:7080
139.196.72.155:8080
103.8.26.17:8080
70.11.238.157:53347
55.74.152.152:37910
113.59.252.140:36286
97.67.147.111:40652
116.64.52.198:22668
61.87.190.176:45536
203.153.216.46:443
27.55.166.48:19567
32.53.89.86:40407
31.238.181.227:13139
26.19.105.199:26580
73.238.38.64:44958
18.191.122.164:4987
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1396 4028 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1568 4028 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4044 4028 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3264 4028 regsvr32.exe EXCEL.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 1396 regsvr32.exe 1568 regsvr32.exe 4044 regsvr32.exe 3264 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4028 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exepid process 1420 regsvr32.exe 1420 regsvr32.exe 2260 regsvr32.exe 2260 regsvr32.exe 2072 regsvr32.exe 2072 regsvr32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4028 EXCEL.EXE 4028 EXCEL.EXE 4028 EXCEL.EXE 4028 EXCEL.EXE 4028 EXCEL.EXE 4028 EXCEL.EXE 4028 EXCEL.EXE 4028 EXCEL.EXE 4028 EXCEL.EXE 4028 EXCEL.EXE 4028 EXCEL.EXE 4028 EXCEL.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid process target process PID 4028 wrote to memory of 1396 4028 EXCEL.EXE regsvr32.exe PID 4028 wrote to memory of 1396 4028 EXCEL.EXE regsvr32.exe PID 4028 wrote to memory of 1568 4028 EXCEL.EXE regsvr32.exe PID 4028 wrote to memory of 1568 4028 EXCEL.EXE regsvr32.exe PID 4028 wrote to memory of 4044 4028 EXCEL.EXE regsvr32.exe PID 4028 wrote to memory of 4044 4028 EXCEL.EXE regsvr32.exe PID 1568 wrote to memory of 1420 1568 regsvr32.exe regsvr32.exe PID 1568 wrote to memory of 1420 1568 regsvr32.exe regsvr32.exe PID 4044 wrote to memory of 2260 4044 regsvr32.exe regsvr32.exe PID 4044 wrote to memory of 2260 4044 regsvr32.exe regsvr32.exe PID 4028 wrote to memory of 3264 4028 EXCEL.EXE regsvr32.exe PID 4028 wrote to memory of 3264 4028 EXCEL.EXE regsvr32.exe PID 3264 wrote to memory of 2072 3264 regsvr32.exe regsvr32.exe PID 3264 wrote to memory of 2072 3264 regsvr32.exe regsvr32.exe PID 1396 wrote to memory of 2620 1396 regsvr32.exe regsvr32.exe PID 1396 wrote to memory of 2620 1396 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\42588f7afd19d6860fd55d76e9939f8f24d7b17dd79d8ddd793a26ac1fd43f0d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\VZlJb\RCavLvnQOn.dll"3⤵
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\VMgrbEkdEVQEnB\iVDPT.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\BzMEhqwaFl\RoqZw.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\FamKRyCBzQdbSLn\FnpVDsWsRJjwjVn.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\uxevr1.ocxFilesize
373KB
MD50c833f3d3633f1239d5f7d27ec411b35
SHA1f6f5c954a833f3ccc59ae9596f3365a1deff390a
SHA25647efdef5ba81eacc1f97698b52204aeab8e3c2af3505a50a979aa03262dc8cb2
SHA5129b677262e374d3714b6e88c574e155503bc35b9616b5abb1ad1993cf5b1a799d5d3d5a73a1598235370f86fc650e30aecee5c53bb40d48b865c8cb2608a7f050
-
C:\Users\Admin\uxevr2.ocxFilesize
362KB
MD5c5e2f47f6cf858cdab46a803f53227ce
SHA1192a85842286bc501463fb36a92208c177922ad6
SHA25682cd30eb3d45f3dda78bb225fff2ab40caae1cdf88c80e67349bc9854d38cf32
SHA512a7f46adfa21bb4a2b44cd959f1b5608207d28811dcac49e1ecaef60d84962ab114a5bc7843f2276b3de6c760670452c7d9e990466af38e969007539e6b10e3db
-
C:\Users\Admin\uxevr3.ocxFilesize
362KB
MD5d1bb6a9aa0255cbf252b4fec84c4048f
SHA1faf92589ad6289f478c7888f7f38b30aeffc7478
SHA256a0beb0fecaead6350b4430c8c6857c472b3039360a4adb8615a8f6a6f6644543
SHA5124529890eae6eed6774ec5f5aa3274a42bdffe181353e94b46f0924aa123b7de65db6bdc00f0915b8fbb890cd9880d7a80b522d55612a785b3d03125d0eaa282c
-
C:\Users\Admin\uxevr4.ocxFilesize
362KB
MD500195e7ba55305e039134b8655ad3fc5
SHA106b0f2e64404134f411235f5b9b04f6f61ef16ab
SHA256c111bea2f0463fa5d8c25f75fecbc1e92c128fc5bbc277f076e6776db00c167b
SHA51266a76f42b93f75234e66507f728c6ee88dd7766848179a9daca15393b9efc26b5903427c1708301e3e891b90e68d7b125723197d8329412436f35ced55888643
-
\Users\Admin\uxevr1.ocxFilesize
373KB
MD50c833f3d3633f1239d5f7d27ec411b35
SHA1f6f5c954a833f3ccc59ae9596f3365a1deff390a
SHA25647efdef5ba81eacc1f97698b52204aeab8e3c2af3505a50a979aa03262dc8cb2
SHA5129b677262e374d3714b6e88c574e155503bc35b9616b5abb1ad1993cf5b1a799d5d3d5a73a1598235370f86fc650e30aecee5c53bb40d48b865c8cb2608a7f050
-
\Users\Admin\uxevr2.ocxFilesize
362KB
MD5c5e2f47f6cf858cdab46a803f53227ce
SHA1192a85842286bc501463fb36a92208c177922ad6
SHA25682cd30eb3d45f3dda78bb225fff2ab40caae1cdf88c80e67349bc9854d38cf32
SHA512a7f46adfa21bb4a2b44cd959f1b5608207d28811dcac49e1ecaef60d84962ab114a5bc7843f2276b3de6c760670452c7d9e990466af38e969007539e6b10e3db
-
\Users\Admin\uxevr3.ocxFilesize
362KB
MD5d1bb6a9aa0255cbf252b4fec84c4048f
SHA1faf92589ad6289f478c7888f7f38b30aeffc7478
SHA256a0beb0fecaead6350b4430c8c6857c472b3039360a4adb8615a8f6a6f6644543
SHA5124529890eae6eed6774ec5f5aa3274a42bdffe181353e94b46f0924aa123b7de65db6bdc00f0915b8fbb890cd9880d7a80b522d55612a785b3d03125d0eaa282c
-
\Users\Admin\uxevr4.ocxFilesize
362KB
MD500195e7ba55305e039134b8655ad3fc5
SHA106b0f2e64404134f411235f5b9b04f6f61ef16ab
SHA256c111bea2f0463fa5d8c25f75fecbc1e92c128fc5bbc277f076e6776db00c167b
SHA51266a76f42b93f75234e66507f728c6ee88dd7766848179a9daca15393b9efc26b5903427c1708301e3e891b90e68d7b125723197d8329412436f35ced55888643
-
memory/1396-328-0x0000000180000000-0x0000000180031000-memory.dmpFilesize
196KB
-
memory/1396-278-0x0000000000000000-mapping.dmp
-
memory/1420-295-0x0000000000000000-mapping.dmp
-
memory/1568-289-0x0000000180000000-0x0000000180031000-memory.dmpFilesize
196KB
-
memory/1568-286-0x0000000000000000-mapping.dmp
-
memory/2072-322-0x0000000000000000-mapping.dmp
-
memory/2260-308-0x0000000000000000-mapping.dmp
-
memory/2620-333-0x0000000000000000-mapping.dmp
-
memory/3264-309-0x0000000000000000-mapping.dmp
-
memory/4028-118-0x00007FF94C210000-0x00007FF94C220000-memory.dmpFilesize
64KB
-
memory/4028-131-0x00007FF9486A0000-0x00007FF9486B0000-memory.dmpFilesize
64KB
-
memory/4028-130-0x00007FF9486A0000-0x00007FF9486B0000-memory.dmpFilesize
64KB
-
memory/4028-121-0x00007FF94C210000-0x00007FF94C220000-memory.dmpFilesize
64KB
-
memory/4028-120-0x00007FF94C210000-0x00007FF94C220000-memory.dmpFilesize
64KB
-
memory/4028-119-0x00007FF94C210000-0x00007FF94C220000-memory.dmpFilesize
64KB
-
memory/4044-294-0x0000000000000000-mapping.dmp