Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
07-07-2022 03:09
Behavioral task
behavioral1
Sample
8f956c74a4237f9509caed1ed71763c8dd55b45a9ddd3577a5a081f368181d7b.xls
Resource
win10-20220414-en
General
-
Target
8f956c74a4237f9509caed1ed71763c8dd55b45a9ddd3577a5a081f368181d7b.xls
-
Size
95KB
-
MD5
b9d665818a3876d183899a8853182047
-
SHA1
7091faf178b38e1f8ec5bb4d2d67c7bf49281c13
-
SHA256
8f956c74a4237f9509caed1ed71763c8dd55b45a9ddd3577a5a081f368181d7b
-
SHA512
89908d259549320fc3df4ae7a505a94784ea3ee56eff2b80fc12dbb3c30e1bd2c33743952ecddd243f36b25aa044fada01fe7de71ff8d19b7cb9e7abe7897b59
Malware Config
Extracted
https://edoraseguros.com.br/cgi-bin/jQNq9wlH1GXU/
http://earthmach.co.za/libraries/tWkZh9YrXbTd6IeX/
http://finvest.rs/wp-admin/Hr9nVNTIHgw59S/
http://efverstedt.se/5jjaV/w7fLEHJ20xn0qD/
Extracted
emotet
Epoch5
103.71.99.57:8080
103.224.241.74:8080
157.245.111.0:8080
37.44.244.177:8080
103.41.204.169:8080
64.227.55.231:8080
103.254.12.236:7080
103.85.95.4:8080
157.230.99.206:8080
165.22.254.236:8080
85.214.67.203:8080
54.37.228.122:443
195.77.239.39:8080
128.199.217.206:443
190.145.8.4:443
165.232.185.110:8080
188.165.79.151:443
178.62.112.199:8080
54.37.106.167:8080
104.244.79.94:443
43.129.209.178:443
87.106.97.83:7080
202.134.4.210:7080
178.238.225.252:8080
198.199.70.22:8080
62.171.178.147:8080
175.126.176.79:8080
128.199.242.164:8080
88.217.172.165:8080
104.248.225.227:8080
85.25.120.45:8080
139.196.72.155:8080
188.225.32.231:4143
202.29.239.162:443
103.126.216.86:443
210.57.209.142:8080
93.104.209.107:8080
196.44.98.190:8080
5.253.30.17:7080
46.101.98.60:8080
103.56.149.105:8080
190.107.19.179:443
139.59.80.108:8080
36.67.23.59:443
78.47.204.80:443
83.229.80.93:8080
174.138.33.49:7080
118.98.72.86:443
37.187.114.15:8080
202.28.34.99:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4160 2128 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4268 2128 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4436 2128 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 584 2128 regsvr32.exe EXCEL.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 4268 regsvr32.exe 4436 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3480 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2128 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 4268 regsvr32.exe 4268 regsvr32.exe 4452 regsvr32.exe 4452 regsvr32.exe 4452 regsvr32.exe 4452 regsvr32.exe 4436 regsvr32.exe 4436 regsvr32.exe 784 regsvr32.exe 784 regsvr32.exe 784 regsvr32.exe 784 regsvr32.exe 784 regsvr32.exe 784 regsvr32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 2128 EXCEL.EXE 2128 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2128 EXCEL.EXE 2128 EXCEL.EXE 2128 EXCEL.EXE 2128 EXCEL.EXE 2128 EXCEL.EXE 2128 EXCEL.EXE 2128 EXCEL.EXE 2128 EXCEL.EXE 2128 EXCEL.EXE 2128 EXCEL.EXE 2128 EXCEL.EXE 2128 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeregsvr32.exedescription pid process target process PID 2128 wrote to memory of 4160 2128 EXCEL.EXE regsvr32.exe PID 2128 wrote to memory of 4160 2128 EXCEL.EXE regsvr32.exe PID 2128 wrote to memory of 4268 2128 EXCEL.EXE regsvr32.exe PID 2128 wrote to memory of 4268 2128 EXCEL.EXE regsvr32.exe PID 4268 wrote to memory of 4452 4268 regsvr32.exe regsvr32.exe PID 4268 wrote to memory of 4452 4268 regsvr32.exe regsvr32.exe PID 2128 wrote to memory of 4436 2128 EXCEL.EXE regsvr32.exe PID 2128 wrote to memory of 4436 2128 EXCEL.EXE regsvr32.exe PID 4436 wrote to memory of 784 4436 regsvr32.exe regsvr32.exe PID 4436 wrote to memory of 784 4436 regsvr32.exe regsvr32.exe PID 2128 wrote to memory of 584 2128 EXCEL.EXE regsvr32.exe PID 2128 wrote to memory of 584 2128 EXCEL.EXE regsvr32.exe PID 784 wrote to memory of 1104 784 regsvr32.exe systeminfo.exe PID 784 wrote to memory of 1104 784 regsvr32.exe systeminfo.exe PID 784 wrote to memory of 3480 784 regsvr32.exe ipconfig.exe PID 784 wrote to memory of 3480 784 regsvr32.exe ipconfig.exe PID 784 wrote to memory of 2524 784 regsvr32.exe nltest.exe PID 784 wrote to memory of 2524 784 regsvr32.exe nltest.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8f956c74a4237f9509caed1ed71763c8dd55b45a9ddd3577a5a081f368181d7b.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci1.ocx2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci2.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\FCTQlVgFbeyQexk\ymfoV.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci3.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\XFlFQ\HLVlBXKKC.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
-
C:\Windows\system32\ipconfig.exeipconfig /all4⤵
- Gathers network information
-
C:\Windows\system32\nltest.exenltest /dclist:4⤵
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci4.ocx2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\soci2.ocxFilesize
847KB
MD5a3c495207e94f94cce6938230cca4742
SHA13572167af51c239b7545d9d491666c7646f1f357
SHA25680e2a842e24aa2d79b2d1e4305a3c5edc62626b0fd06d405c9041db7b8758834
SHA51202457ff3815d94dec60380adff71b641232575c5eedbb33e9cf9f2257a2fcbdfeb91be0f6af05bc0352cd8010b9a5b074de8ff85f3850b2e19023ae31229c708
-
C:\Users\Admin\soci3.ocxFilesize
847KB
MD58e22049bc8a5b1a69f52a30d1c23407c
SHA19f836287f890023cd25df2bb9f7045a45aff9d6b
SHA256e516a2bdaade33d330a7598efb60df9c3c04cfe0f2e9ab0190015cd43a85f97c
SHA512ad50a446466182dc2a91b5de8412025b5b4c243879c66b970caa6adff4c191a0476b4fe10dd7ceec614362634d25bd8bad38b0677be5d0ad9a5b807ac72f149f
-
\Users\Admin\soci2.ocxFilesize
847KB
MD5a3c495207e94f94cce6938230cca4742
SHA13572167af51c239b7545d9d491666c7646f1f357
SHA25680e2a842e24aa2d79b2d1e4305a3c5edc62626b0fd06d405c9041db7b8758834
SHA51202457ff3815d94dec60380adff71b641232575c5eedbb33e9cf9f2257a2fcbdfeb91be0f6af05bc0352cd8010b9a5b074de8ff85f3850b2e19023ae31229c708
-
\Users\Admin\soci3.ocxFilesize
847KB
MD58e22049bc8a5b1a69f52a30d1c23407c
SHA19f836287f890023cd25df2bb9f7045a45aff9d6b
SHA256e516a2bdaade33d330a7598efb60df9c3c04cfe0f2e9ab0190015cd43a85f97c
SHA512ad50a446466182dc2a91b5de8412025b5b4c243879c66b970caa6adff4c191a0476b4fe10dd7ceec614362634d25bd8bad38b0677be5d0ad9a5b807ac72f149f
-
memory/584-280-0x0000000000000000-mapping.dmp
-
memory/784-297-0x00000000026B0000-0x000000000861A000-memory.dmpFilesize
95.4MB
-
memory/784-294-0x00000000026B0000-0x000000000861A000-memory.dmpFilesize
95.4MB
-
memory/784-279-0x0000000000000000-mapping.dmp
-
memory/1104-293-0x0000000000000000-mapping.dmp
-
memory/2128-127-0x00007FFB2A3B0000-0x00007FFB2A3C0000-memory.dmpFilesize
64KB
-
memory/2128-114-0x00007FFB2DA60000-0x00007FFB2DA70000-memory.dmpFilesize
64KB
-
memory/2128-126-0x00007FFB2A3B0000-0x00007FFB2A3C0000-memory.dmpFilesize
64KB
-
memory/2128-117-0x00007FFB2DA60000-0x00007FFB2DA70000-memory.dmpFilesize
64KB
-
memory/2128-116-0x00007FFB2DA60000-0x00007FFB2DA70000-memory.dmpFilesize
64KB
-
memory/2128-115-0x00007FFB2DA60000-0x00007FFB2DA70000-memory.dmpFilesize
64KB
-
memory/2524-296-0x0000000000000000-mapping.dmp
-
memory/3480-295-0x0000000000000000-mapping.dmp
-
memory/4160-256-0x0000000000000000-mapping.dmp
-
memory/4268-260-0x0000000180000000-0x0000000180030000-memory.dmpFilesize
192KB
-
memory/4268-257-0x0000000000000000-mapping.dmp
-
memory/4436-266-0x0000000000000000-mapping.dmp
-
memory/4452-265-0x0000000000000000-mapping.dmp