Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    07-07-2022 04:08

General

  • Target

    10fa6005847123358153b457bbb0544fdb9336d3ede2f2c122d14199d2413346.xls

  • Size

    95KB

  • MD5

    3bd53b9274e0465ae5f15efbf34cd96c

  • SHA1

    03198f860e12a66454036b4c0719ad1b3e928f55

  • SHA256

    10fa6005847123358153b457bbb0544fdb9336d3ede2f2c122d14199d2413346

  • SHA512

    9d94a21230f32e04ad672a19f4adefbba7bebc03e9d66d11c1841409dcf9afe9045044844e1de67f1e007e13494ef4d32c31657cafedb42aa3d6fd2754bd38b2

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://edoraseguros.com.br/cgi-bin/jQNq9wlH1GXU/

xlm40.dropper

http://earthmach.co.za/libraries/tWkZh9YrXbTd6IeX/

xlm40.dropper

http://finvest.rs/wp-admin/Hr9nVNTIHgw59S/

xlm40.dropper

http://efverstedt.se/5jjaV/w7fLEHJ20xn0qD/

Extracted

Family

emotet

Botnet

Epoch5

C2

103.71.99.57:8080

103.224.241.74:8080

157.245.111.0:8080

37.44.244.177:8080

103.41.204.169:8080

64.227.55.231:8080

103.254.12.236:7080

103.85.95.4:8080

157.230.99.206:8080

165.22.254.236:8080

85.214.67.203:8080

54.37.228.122:443

195.77.239.39:8080

128.199.217.206:443

190.145.8.4:443

165.232.185.110:8080

188.165.79.151:443

178.62.112.199:8080

54.37.106.167:8080

104.244.79.94:443

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • suricata: ET MALWARE W32/Emotet CnC Beacon 3

    suricata: ET MALWARE W32/Emotet CnC Beacon 3

  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\10fa6005847123358153b457bbb0544fdb9336d3ede2f2c122d14199d2413346.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci1.ocx
      2⤵
      • Process spawned unexpected child process
      PID:3620
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\soci2.ocx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZBXAdndU\KKYKVPkqQGFAV.dll"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2460
        • C:\Windows\system32\systeminfo.exe
          systeminfo
          4⤵
          • Gathers system information
          PID:96
        • C:\Windows\system32\ipconfig.exe
          ipconfig /all
          4⤵
          • Gathers network information
          PID:2908
        • C:\Windows\system32\nltest.exe
          nltest /dclist:
          4⤵
            PID:3624
      • C:\Windows\System32\regsvr32.exe
        C:\Windows\System32\regsvr32.exe /S ..\soci3.ocx
        2⤵
        • Process spawned unexpected child process
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FFXKExDBs\voILyRFPbQpa.dll"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2236
      • C:\Windows\System32\regsvr32.exe
        C:\Windows\System32\regsvr32.exe /S ..\soci4.ocx
        2⤵
        • Process spawned unexpected child process
        PID:1064

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Command-Line Interface

    1
    T1059

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    4
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\soci2.ocx
      Filesize

      847KB

      MD5

      15a4143b665933e6ad0b3f2e05f560f4

      SHA1

      c5ee3295dc4680fe2cf7813eca9a9fd576571b7e

      SHA256

      86ce3564f613d87be0b6c26f8fd8f7bba98989f5ca0b9d255d054e8fab41c59e

      SHA512

      91b75cf64768f6494a19a7f0b6ba140e090a6cab9abc3506e9133ff8bac46a3124a90187c9d9158e2d3f016862e27fda325174a0ed2dd1d83e58f93d55ebf72c

    • C:\Users\Admin\soci3.ocx
      Filesize

      847KB

      MD5

      5e07d8a8c5f9efed5a8b204b5e850c72

      SHA1

      5ff8e145c8a0166afc26bcb0449e3a24a50bdf97

      SHA256

      b5b049223e6f90dbda01c6f4f8d39758b33f2c08c46b0261dac504d871e63251

      SHA512

      bb9d932dada3a3353e1c3d76bca110ef247e36bbf2aea0be17ad3351998ec647eefa1104ad65580314500e5e896ed23884c62055e9b9348a8af1145d17665a6e

    • \Users\Admin\soci2.ocx
      Filesize

      847KB

      MD5

      15a4143b665933e6ad0b3f2e05f560f4

      SHA1

      c5ee3295dc4680fe2cf7813eca9a9fd576571b7e

      SHA256

      86ce3564f613d87be0b6c26f8fd8f7bba98989f5ca0b9d255d054e8fab41c59e

      SHA512

      91b75cf64768f6494a19a7f0b6ba140e090a6cab9abc3506e9133ff8bac46a3124a90187c9d9158e2d3f016862e27fda325174a0ed2dd1d83e58f93d55ebf72c

    • \Users\Admin\soci3.ocx
      Filesize

      847KB

      MD5

      5e07d8a8c5f9efed5a8b204b5e850c72

      SHA1

      5ff8e145c8a0166afc26bcb0449e3a24a50bdf97

      SHA256

      b5b049223e6f90dbda01c6f4f8d39758b33f2c08c46b0261dac504d871e63251

      SHA512

      bb9d932dada3a3353e1c3d76bca110ef247e36bbf2aea0be17ad3351998ec647eefa1104ad65580314500e5e896ed23884c62055e9b9348a8af1145d17665a6e

    • memory/96-297-0x0000000000000000-mapping.dmp
    • memory/1064-291-0x0000000000000000-mapping.dmp
    • memory/1640-276-0x0000000000000000-mapping.dmp
    • memory/2236-290-0x0000000000000000-mapping.dmp
    • memory/2460-301-0x0000000002280000-0x00000000081EB000-memory.dmp
      Filesize

      95MB

    • memory/2460-298-0x0000000002280000-0x00000000081EB000-memory.dmp
      Filesize

      95MB

    • memory/2460-277-0x0000000000000000-mapping.dmp
    • memory/2688-131-0x00007FFB5FE40000-0x00007FFB5FE50000-memory.dmp
      Filesize

      64KB

    • memory/2688-118-0x00007FFB63430000-0x00007FFB63440000-memory.dmp
      Filesize

      64KB

    • memory/2688-130-0x00007FFB5FE40000-0x00007FFB5FE50000-memory.dmp
      Filesize

      64KB

    • memory/2688-121-0x00007FFB63430000-0x00007FFB63440000-memory.dmp
      Filesize

      64KB

    • memory/2688-120-0x00007FFB63430000-0x00007FFB63440000-memory.dmp
      Filesize

      64KB

    • memory/2688-119-0x00007FFB63430000-0x00007FFB63440000-memory.dmp
      Filesize

      64KB

    • memory/2908-299-0x0000000000000000-mapping.dmp
    • memory/2964-271-0x0000000180000000-0x0000000180030000-memory.dmp
      Filesize

      192KB

    • memory/2964-268-0x0000000000000000-mapping.dmp
    • memory/3620-267-0x0000000000000000-mapping.dmp
    • memory/3624-300-0x0000000000000000-mapping.dmp