Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
07/06/2022, 11:39
General
- Target 19-0706.xls
- Size 71KB
- Sample220607-nsa67aaber
- SHA256 6bbce57af634b5a56f4e412c52d987d3c2515089fc82be156c3de564564b25ba
Malware Config
Extracted
-
xlm4.0
-
xlm40.dropper
https://chobemaster.com/components/GxCs/
-
xlm40.dropper
https://bencevendeghaz.hu/wp-includes/S1mIEUnClr5s8krOm/
-
xlm40.dropper
http://vibesapparels.com/dQa/Qzuqq5TZO/
Extracted
-
emotet
-
Epoch5
-
78.47.204.80:443
-
212.83.184.188:8080
-
36.67.23.59:443
-
128.199.217.206:443
-
103.56.149.105:8080
-
202.29.239.162:443
-
68.183.91.111:8080
-
104.244.79.94:443
-
64.227.55.231:8080
-
157.230.99.206:8080
-
165.232.185.110:8080
-
103.71.99.57:8080
-
103.126.216.86:443
-
88.217.172.165:8080
-
103.41.204.169:8080
-
87.106.97.83:7080
-
85.25.120.45:8080
-
188.225.32.231:4143
-
118.98.72.86:443
-
178.62.112.199:8080
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
- Downloads MZ/PE file
- Loads dropped DLL 5 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\19-0706.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\haics1.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\LOkInND\ghwysVQOth.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\haics2.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\TTswRif\OxaahAAERcrIdlp.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\haics3.ocx2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
haics1.ocx
haics1.ocx
haics2.ocx
haics2.ocx
ghwysVQOth.dll
OxaahAAERcrIdlp.dll
OxaahAAERcrIdlp.dll
memory/2776-135-0x00007FFE2FE50000-0x00007FFE2FE60000-memory.dmp
memory/2776-136-0x00007FFE2FE50000-0x00007FFE2FE60000-memory.dmp
memory/2776-130-0x00007FFE32050000-0x00007FFE32060000-memory.dmp
memory/2776-134-0x00007FFE32050000-0x00007FFE32060000-memory.dmp
memory/2776-133-0x00007FFE32050000-0x00007FFE32060000-memory.dmp
memory/2776-131-0x00007FFE32050000-0x00007FFE32060000-memory.dmp
memory/2776-132-0x00007FFE32050000-0x00007FFE32060000-memory.dmp
memory/3568-140-0x0000000180000000-0x000000018002B000-memory.dmp
memory/4208-155-0x0000000001F50000-0x0000000001FFA000-memory.dmp