Analysis
-
max time kernel
48s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 03:15
Behavioral task
behavioral1
Sample
MAIL_06072022.xls
Resource
win7-20220414-en
General
-
Target
MAIL_06072022.xls
-
Size
95KB
-
MD5
7972a1bdad0a36a1f0c22bef9b4bb14a
-
SHA1
b9b1e26bd106de667a143c680ca5add7c4d818b0
-
SHA256
8d1ac63a1ba57a2dbd07a31585669eea9eb1edddee008bd577822b37a987b04e
-
SHA512
8a0a1811410534c84e3f6a66a05c4811265c675e89cc04fd8e4d17df12489c925e87399c3b00280a2eb13461069b316072ef07d6a856780e0feffba0d514de8e
Malware Config
Extracted
http://francite.net/images/XI7zS0X1nY/
https://cointrade.world/receipts/Sa6fYJpecEVqiRf05/
http://gedebey-tvradio.info/wp-includes/nOmdPyUpDB/
http://haircutbar.com/cgi-bin/SpJT9OKPmUpJfkGqv/
Extracted
emotet
Epoch5
103.71.99.57:8080
103.224.241.74:8080
157.245.111.0:8080
37.44.244.177:8080
103.41.204.169:8080
64.227.55.231:8080
103.254.12.236:7080
103.85.95.4:8080
157.230.99.206:8080
165.22.254.236:8080
85.214.67.203:8080
54.37.228.122:443
195.77.239.39:8080
128.199.217.206:443
190.145.8.4:443
165.232.185.110:8080
188.165.79.151:443
178.62.112.199:8080
54.37.106.167:8080
104.244.79.94:443
43.129.209.178:443
87.106.97.83:7080
202.134.4.210:7080
178.238.225.252:8080
198.199.70.22:8080
62.171.178.147:8080
175.126.176.79:8080
128.199.242.164:8080
88.217.172.165:8080
104.248.225.227:8080
85.25.120.45:8080
139.196.72.155:8080
188.225.32.231:4143
202.29.239.162:443
103.126.216.86:443
210.57.209.142:8080
93.104.209.107:8080
196.44.98.190:8080
5.253.30.17:7080
46.101.98.60:8080
103.56.149.105:8080
190.107.19.179:443
139.59.80.108:8080
36.67.23.59:443
78.47.204.80:443
83.229.80.93:8080
174.138.33.49:7080
118.98.72.86:443
37.187.114.15:8080
202.28.34.99:8080
Extracted
emotet
198.27.67.35:8080
190.107.19.180:8080
58.96.74.42:443
116.125.120.88:443
180.250.21.2:443
165.227.153.100:8080
62.141.45.103:443
134.209.164.181:8080
212.98.224.97:8080
159.65.163.220:443
128.199.93.156:7080
198.211.118.165:443
203.217.140.239:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1076 1992 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1828 1992 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1156 1992 regsvr32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2028 1992 regsvr32.exe EXCEL.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 1156 regsvr32.exe 1260 regsvr32.exe 2028 regsvr32.exe 2036 regsvr32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1124 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1992 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 1260 regsvr32.exe 1532 regsvr32.exe 1532 regsvr32.exe 2036 regsvr32.exe 1588 regsvr32.exe 1588 regsvr32.exe 1532 regsvr32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1992 EXCEL.EXE 1992 EXCEL.EXE 1992 EXCEL.EXE -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid process target process PID 1992 wrote to memory of 1076 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1076 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1076 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1076 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1076 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1076 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1076 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1828 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1828 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1828 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1828 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1828 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1828 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1828 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1156 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1156 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1156 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1156 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1156 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1156 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 1156 1992 EXCEL.EXE regsvr32.exe PID 1156 wrote to memory of 1260 1156 regsvr32.exe regsvr32.exe PID 1156 wrote to memory of 1260 1156 regsvr32.exe regsvr32.exe PID 1156 wrote to memory of 1260 1156 regsvr32.exe regsvr32.exe PID 1156 wrote to memory of 1260 1156 regsvr32.exe regsvr32.exe PID 1156 wrote to memory of 1260 1156 regsvr32.exe regsvr32.exe PID 1156 wrote to memory of 1260 1156 regsvr32.exe regsvr32.exe PID 1156 wrote to memory of 1260 1156 regsvr32.exe regsvr32.exe PID 1260 wrote to memory of 1532 1260 regsvr32.exe regsvr32.exe PID 1260 wrote to memory of 1532 1260 regsvr32.exe regsvr32.exe PID 1260 wrote to memory of 1532 1260 regsvr32.exe regsvr32.exe PID 1260 wrote to memory of 1532 1260 regsvr32.exe regsvr32.exe PID 1260 wrote to memory of 1532 1260 regsvr32.exe regsvr32.exe PID 1992 wrote to memory of 2028 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 2028 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 2028 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 2028 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 2028 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 2028 1992 EXCEL.EXE regsvr32.exe PID 1992 wrote to memory of 2028 1992 EXCEL.EXE regsvr32.exe PID 2028 wrote to memory of 2036 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 regsvr32.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 1588 2036 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 1588 2036 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 1588 2036 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 1588 2036 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 1588 2036 regsvr32.exe regsvr32.exe PID 1532 wrote to memory of 1884 1532 regsvr32.exe systeminfo.exe PID 1532 wrote to memory of 1884 1532 regsvr32.exe systeminfo.exe PID 1532 wrote to memory of 1884 1532 regsvr32.exe systeminfo.exe PID 1532 wrote to memory of 1124 1532 regsvr32.exe ipconfig.exe PID 1532 wrote to memory of 1124 1532 regsvr32.exe ipconfig.exe PID 1532 wrote to memory of 1124 1532 regsvr32.exe ipconfig.exe PID 1532 wrote to memory of 1784 1532 regsvr32.exe nltest.exe PID 1532 wrote to memory of 1784 1532 regsvr32.exe nltest.exe PID 1532 wrote to memory of 1784 1532 regsvr32.exe nltest.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\MAIL_06072022.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci1.ocx2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci2.ocx2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci3.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/S ..\soci3.ocx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZvnCfLfL\BhdXrgfwyKhpDBL.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\systeminfo.exesysteminfo5⤵
- Gathers system information
-
C:\Windows\system32\ipconfig.exeipconfig /all5⤵
- Gathers network information
-
C:\Windows\system32\nltest.exenltest /dclist:5⤵
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci4.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/S ..\soci4.ocx3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\IhvPEJZmLjSloql\DwpYDj.dll"4⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
60KB
MD5589c442fc7a0c70dca927115a700d41e
SHA166a07dace3afbfd1aa07a47e6875beab62c4bb31
SHA2562e5cb72e9eb43baafb6c6bfcc573aac92f49a8064c483f9d378a9e8e781a526a
SHA5121b5fa79e52be495c42cf49618441fb7012e28c02e7a08a91da9213db3ab810f0e83485bc1dd5f625a47d0ba7cfcdd5ea50acc9a8dcebb39f048c40f01e94155b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD593f4a9e33dbca0face02c9804739c95d
SHA146b846f527239695d1fe00b496725bf93f957879
SHA25630351cffa97ab69b95a1506185e974d7f5d12e56cf739840b8c8cbfbd1bbe11b
SHA512663fb2ae991cb32157971a84597a4be30cc952962ba4bd0981f70574a88a841f73c7955d20ec6cd58734bd2195868c6ebe12cee6d8bde49680853955fdba6f27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD569fc6a724b80a4a2ec06c9999a14a627
SHA1350563274b629f7272902a6ceed69fe69c45e104
SHA25649f981ecdf65cc0da04710d7063c699685a8c9fdabba79aaee171f7953086d63
SHA512aca44694b8528a0678c659325533389ea146cdca65c91a653e618acd02fef44feef084ac596f637069e28f0bfd963c46966aef8a97a3251bbbb2a1c929e2bc22
-
C:\Users\Admin\soci3.ocxFilesize
847KB
MD578bcd900acb9a0c582c412edfc3703a3
SHA1f33ceaeb55abc9ceab3a60873fd265ce1c7acaef
SHA2567364386d7edd4961b1ac4b03c3aa10808223052849cb008deb3c9e378ff09161
SHA512a89848e8e06dd20ce583d56ded097bf9b5a542e10ae27ac174dde89394ddd34e1ae25d34ba12cd0396422edff58ceda3c3a0d0f417bf958fee5d983c5410afe9
-
C:\Users\Admin\soci4.ocxFilesize
847KB
MD5939239f35d2787d7beabee60833964e9
SHA1a7bf30340340c6a7b19d4aae47b6062e2e3c6248
SHA256aa90dec9d5d06e8c29ac02fc5886b39b9ca07c7607858e772e22c6d2f7706a20
SHA5129d0f336c1d76ebb9ee448f70546bf0465d0563fa5dcb0a0f8f29fd99fa7b35902ac42329ef3df8402e4644377d5876d364e140fb5f58a5627e329ae580b53330
-
\Users\Admin\soci3.ocxFilesize
847KB
MD578bcd900acb9a0c582c412edfc3703a3
SHA1f33ceaeb55abc9ceab3a60873fd265ce1c7acaef
SHA2567364386d7edd4961b1ac4b03c3aa10808223052849cb008deb3c9e378ff09161
SHA512a89848e8e06dd20ce583d56ded097bf9b5a542e10ae27ac174dde89394ddd34e1ae25d34ba12cd0396422edff58ceda3c3a0d0f417bf958fee5d983c5410afe9
-
\Users\Admin\soci3.ocxFilesize
847KB
MD578bcd900acb9a0c582c412edfc3703a3
SHA1f33ceaeb55abc9ceab3a60873fd265ce1c7acaef
SHA2567364386d7edd4961b1ac4b03c3aa10808223052849cb008deb3c9e378ff09161
SHA512a89848e8e06dd20ce583d56ded097bf9b5a542e10ae27ac174dde89394ddd34e1ae25d34ba12cd0396422edff58ceda3c3a0d0f417bf958fee5d983c5410afe9
-
\Users\Admin\soci4.ocxFilesize
847KB
MD5939239f35d2787d7beabee60833964e9
SHA1a7bf30340340c6a7b19d4aae47b6062e2e3c6248
SHA256aa90dec9d5d06e8c29ac02fc5886b39b9ca07c7607858e772e22c6d2f7706a20
SHA5129d0f336c1d76ebb9ee448f70546bf0465d0563fa5dcb0a0f8f29fd99fa7b35902ac42329ef3df8402e4644377d5876d364e140fb5f58a5627e329ae580b53330
-
\Users\Admin\soci4.ocxFilesize
847KB
MD5939239f35d2787d7beabee60833964e9
SHA1a7bf30340340c6a7b19d4aae47b6062e2e3c6248
SHA256aa90dec9d5d06e8c29ac02fc5886b39b9ca07c7607858e772e22c6d2f7706a20
SHA5129d0f336c1d76ebb9ee448f70546bf0465d0563fa5dcb0a0f8f29fd99fa7b35902ac42329ef3df8402e4644377d5876d364e140fb5f58a5627e329ae580b53330
-
memory/1076-59-0x0000000000000000-mapping.dmp
-
memory/1124-99-0x0000000000000000-mapping.dmp
-
memory/1156-63-0x0000000000000000-mapping.dmp
-
memory/1260-67-0x0000000000000000-mapping.dmp
-
memory/1260-68-0x000007FEFC331000-0x000007FEFC333000-memory.dmpFilesize
8KB
-
memory/1260-70-0x0000000180000000-0x0000000180030000-memory.dmpFilesize
192KB
-
memory/1532-73-0x0000000000000000-mapping.dmp
-
memory/1532-98-0x0000000001CE0000-0x0000000001D03000-memory.dmpFilesize
140KB
-
memory/1588-88-0x0000000000000000-mapping.dmp
-
memory/1784-100-0x0000000000000000-mapping.dmp
-
memory/1828-61-0x0000000000000000-mapping.dmp
-
memory/1884-97-0x0000000000000000-mapping.dmp
-
memory/1992-93-0x000000007296D000-0x0000000072978000-memory.dmpFilesize
44KB
-
memory/1992-58-0x000000007296D000-0x0000000072978000-memory.dmpFilesize
44KB
-
memory/1992-57-0x0000000075DB1000-0x0000000075DB3000-memory.dmpFilesize
8KB
-
memory/1992-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1992-55-0x0000000071981000-0x0000000071983000-memory.dmpFilesize
8KB
-
memory/1992-54-0x000000002F421000-0x000000002F424000-memory.dmpFilesize
12KB
-
memory/2028-78-0x0000000000000000-mapping.dmp
-
memory/2036-82-0x0000000000000000-mapping.dmp