Analysis
-
max time kernel
152s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
22-05-2022 05:22
Behavioral task
behavioral1
Sample
dshtofij.xlsm
Resource
win7-20220414-en
General
-
Target
dshtofij.xlsm
-
Size
37KB
-
MD5
00bd27a66d752e35a41cb7ce82524c3c
-
SHA1
3e62b73a46e418b2ac1eb2d37a4ebf7f61c891b1
-
SHA256
33dc0546d60f496508e95293772364bf7e913d52ec3d606b326adff6cbfe7fd7
-
SHA512
c758185ffaeb41115821eea959a96813bed812986fd348743198c9c448d584bd149774622ac7d2ce867d9fdf3992db9485509d143841b187d8f4871a803908a1
Malware Config
Extracted
https://ordereasy.hk/error/8BZswf/
Extracted
emotet
Epoch4
172.104.227.98:443
31.207.89.74:8080
46.55.222.11:443
41.76.108.46:8080
103.8.26.103:8080
185.184.25.237:8080
103.8.26.102:8080
203.114.109.124:443
45.118.115.99:8080
178.79.147.66:8080
58.227.42.236:80
45.118.135.203:7080
103.75.201.2:443
195.154.133.20:443
192.254.71.210:443
45.142.114.231:8080
212.237.5.209:443
207.38.84.195:8080
104.251.214.46:8080
212.237.17.99:8080
212.237.56.116:7080
216.158.226.206:443
110.232.117.186:8080
158.69.222.101:443
107.182.225.142:8080
176.104.106.96:8080
81.0.236.90:443
50.116.54.215:443
138.185.72.26:8080
51.68.175.8:8080
210.57.217.132:8080
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3536 3196 rundll32.exe EXCEL.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Blocklisted process makes network request 4 IoCs
Processes:
rundll32.exeflow pid process 38 3852 rundll32.exe 51 3852 rundll32.exe 52 3852 rundll32.exe 53 3852 rundll32.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exepid process 3536 rundll32.exe 4476 rundll32.exe 3136 rundll32.exe 3852 rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Jgzwvjsctqk\qfrzyyrtrjzn.rwh rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3196 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 3852 rundll32.exe 3852 rundll32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3196 EXCEL.EXE 3196 EXCEL.EXE 3196 EXCEL.EXE 3196 EXCEL.EXE 3196 EXCEL.EXE 3196 EXCEL.EXE 3196 EXCEL.EXE 3196 EXCEL.EXE 3196 EXCEL.EXE 3196 EXCEL.EXE 3196 EXCEL.EXE 3196 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
EXCEL.EXErundll32.exerundll32.exerundll32.exedescription pid process target process PID 3196 wrote to memory of 3536 3196 EXCEL.EXE rundll32.exe PID 3196 wrote to memory of 3536 3196 EXCEL.EXE rundll32.exe PID 3196 wrote to memory of 3536 3196 EXCEL.EXE rundll32.exe PID 3536 wrote to memory of 4476 3536 rundll32.exe rundll32.exe PID 3536 wrote to memory of 4476 3536 rundll32.exe rundll32.exe PID 3536 wrote to memory of 4476 3536 rundll32.exe rundll32.exe PID 4476 wrote to memory of 3136 4476 rundll32.exe rundll32.exe PID 4476 wrote to memory of 3136 4476 rundll32.exe rundll32.exe PID 4476 wrote to memory of 3136 4476 rundll32.exe rundll32.exe PID 3136 wrote to memory of 3852 3136 rundll32.exe rundll32.exe PID 3136 wrote to memory of 3852 3136 rundll32.exe rundll32.exe PID 3136 wrote to memory of 3852 3136 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\dshtofij.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe ..\bestb.ocx,D"&"l"&"l"&"R"&"eg"&"i"&"s"&"t"&"erServer2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\bestb.ocx",DllRegisterServer3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Jgzwvjsctqk\qfrzyyrtrjzn.rwh",equYqSOBqaJSU4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Jgzwvjsctqk\qfrzyyrtrjzn.rwh",DllRegisterServer5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\bestb.ocxFilesize
1.1MB
MD52f93cb3701205b257b8ef5e76545923b
SHA1c53d45e900d52a0a4802f858ac94a10bdbff3d15
SHA25616211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0
SHA5122c095cce1927a872f66457b18d4f8d71cb62af05dbfd8fef930959f9cebeada93557acf11218b5d9798f59f4de565cec7b86c03410d7bf68249ccd5f86625095
-
C:\Users\Admin\bestb.ocxFilesize
1.1MB
MD52f93cb3701205b257b8ef5e76545923b
SHA1c53d45e900d52a0a4802f858ac94a10bdbff3d15
SHA25616211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0
SHA5122c095cce1927a872f66457b18d4f8d71cb62af05dbfd8fef930959f9cebeada93557acf11218b5d9798f59f4de565cec7b86c03410d7bf68249ccd5f86625095
-
C:\Users\Admin\bestb.ocxFilesize
1.1MB
MD52f93cb3701205b257b8ef5e76545923b
SHA1c53d45e900d52a0a4802f858ac94a10bdbff3d15
SHA25616211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0
SHA5122c095cce1927a872f66457b18d4f8d71cb62af05dbfd8fef930959f9cebeada93557acf11218b5d9798f59f4de565cec7b86c03410d7bf68249ccd5f86625095
-
C:\Windows\SysWOW64\Jgzwvjsctqk\qfrzyyrtrjzn.rwhFilesize
1.1MB
MD52f93cb3701205b257b8ef5e76545923b
SHA1c53d45e900d52a0a4802f858ac94a10bdbff3d15
SHA25616211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0
SHA5122c095cce1927a872f66457b18d4f8d71cb62af05dbfd8fef930959f9cebeada93557acf11218b5d9798f59f4de565cec7b86c03410d7bf68249ccd5f86625095
-
C:\Windows\SysWOW64\Jgzwvjsctqk\qfrzyyrtrjzn.rwhFilesize
1.1MB
MD52f93cb3701205b257b8ef5e76545923b
SHA1c53d45e900d52a0a4802f858ac94a10bdbff3d15
SHA25616211b428f9d5da08b3a0d77589bf217f34558388d52d294f7d37dfe5e44b2e0
SHA5122c095cce1927a872f66457b18d4f8d71cb62af05dbfd8fef930959f9cebeada93557acf11218b5d9798f59f4de565cec7b86c03410d7bf68249ccd5f86625095
-
memory/3136-144-0x0000000000000000-mapping.dmp
-
memory/3196-134-0x00007FFBA0F70000-0x00007FFBA0F80000-memory.dmpFilesize
64KB
-
memory/3196-136-0x00007FFB9EB60000-0x00007FFB9EB70000-memory.dmpFilesize
64KB
-
memory/3196-135-0x00007FFB9EB60000-0x00007FFB9EB70000-memory.dmpFilesize
64KB
-
memory/3196-130-0x00007FFBA0F70000-0x00007FFBA0F80000-memory.dmpFilesize
64KB
-
memory/3196-133-0x00007FFBA0F70000-0x00007FFBA0F80000-memory.dmpFilesize
64KB
-
memory/3196-132-0x00007FFBA0F70000-0x00007FFBA0F80000-memory.dmpFilesize
64KB
-
memory/3196-131-0x00007FFBA0F70000-0x00007FFBA0F80000-memory.dmpFilesize
64KB
-
memory/3536-137-0x0000000000000000-mapping.dmp
-
memory/3536-142-0x0000000010000000-0x0000000010027000-memory.dmpFilesize
156KB
-
memory/3852-146-0x0000000000000000-mapping.dmp
-
memory/3852-148-0x0000000010000000-0x0000000010027000-memory.dmpFilesize
156KB
-
memory/4476-140-0x0000000000000000-mapping.dmp
-
memory/4476-143-0x0000000010000000-0x0000000010027000-memory.dmpFilesize
156KB