Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
07-07-2022 04:41
Behavioral task
behavioral1
Sample
7d730c7a39294b8d2e18047f0fb77418acd82b0a036495b48991692607456207.xls
Resource
win10-20220414-en
General
-
Target
7d730c7a39294b8d2e18047f0fb77418acd82b0a036495b48991692607456207.xls
-
Size
95KB
-
MD5
7a1a3cf5ccb7c2e15cbfb92a85ecae5f
-
SHA1
b1a17e354a906125632b16724e9d4391dfd64b59
-
SHA256
7d730c7a39294b8d2e18047f0fb77418acd82b0a036495b48991692607456207
-
SHA512
cc7664c9434593b06fcf0b470395b0e05df6ad3f04b26670c578a1ed4478781cfbf372ad9eab4a373e897c2cad3013c4f927ac7c3e2b290031311cb37185951a
Malware Config
Extracted
https://edoraseguros.com.br/cgi-bin/jQNq9wlH1GXU/
http://earthmach.co.za/libraries/tWkZh9YrXbTd6IeX/
http://finvest.rs/wp-admin/Hr9nVNTIHgw59S/
http://efverstedt.se/5jjaV/w7fLEHJ20xn0qD/
Extracted
emotet
Epoch5
103.71.99.57:8080
103.224.241.74:8080
157.245.111.0:8080
37.44.244.177:8080
103.41.204.169:8080
64.227.55.231:8080
103.254.12.236:7080
103.85.95.4:8080
157.230.99.206:8080
165.22.254.236:8080
85.214.67.203:8080
54.37.228.122:443
195.77.239.39:8080
128.199.217.206:443
190.145.8.4:443
165.232.185.110:8080
188.165.79.151:443
178.62.112.199:8080
54.37.106.167:8080
104.244.79.94:443
43.129.209.178:443
87.106.97.83:7080
202.134.4.210:7080
178.238.225.252:8080
198.199.70.22:8080
62.171.178.147:8080
175.126.176.79:8080
128.199.242.164:8080
88.217.172.165:8080
104.248.225.227:8080
85.25.120.45:8080
139.196.72.155:8080
188.225.32.231:4143
202.29.239.162:443
103.126.216.86:443
210.57.209.142:8080
93.104.209.107:8080
196.44.98.190:8080
5.253.30.17:7080
46.101.98.60:8080
103.56.149.105:8080
190.107.19.179:443
139.59.80.108:8080
36.67.23.59:443
78.47.204.80:443
83.229.80.93:8080
174.138.33.49:7080
118.98.72.86:443
37.187.114.15:8080
202.28.34.99:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1328 3456 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2604 3456 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2276 3456 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 760 3456 regsvr32.exe EXCEL.EXE -
suricata: ET MALWARE W32/Emotet CnC Beacon 3
suricata: ET MALWARE W32/Emotet CnC Beacon 3
-
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 2604 regsvr32.exe 2276 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3916 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3456 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 2604 regsvr32.exe 2604 regsvr32.exe 2256 regsvr32.exe 2256 regsvr32.exe 2256 regsvr32.exe 2256 regsvr32.exe 2276 regsvr32.exe 2276 regsvr32.exe 2692 regsvr32.exe 2692 regsvr32.exe 2692 regsvr32.exe 2692 regsvr32.exe 2256 regsvr32.exe 2256 regsvr32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 3456 EXCEL.EXE 3456 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3456 EXCEL.EXE 3456 EXCEL.EXE 3456 EXCEL.EXE 3456 EXCEL.EXE 3456 EXCEL.EXE 3456 EXCEL.EXE 3456 EXCEL.EXE 3456 EXCEL.EXE 3456 EXCEL.EXE 3456 EXCEL.EXE 3456 EXCEL.EXE 3456 EXCEL.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
EXCEL.EXEregsvr32.exeregsvr32.exeregsvr32.exedescription pid process target process PID 3456 wrote to memory of 1328 3456 EXCEL.EXE regsvr32.exe PID 3456 wrote to memory of 1328 3456 EXCEL.EXE regsvr32.exe PID 3456 wrote to memory of 2604 3456 EXCEL.EXE regsvr32.exe PID 3456 wrote to memory of 2604 3456 EXCEL.EXE regsvr32.exe PID 3456 wrote to memory of 2276 3456 EXCEL.EXE regsvr32.exe PID 3456 wrote to memory of 2276 3456 EXCEL.EXE regsvr32.exe PID 2604 wrote to memory of 2256 2604 regsvr32.exe regsvr32.exe PID 2604 wrote to memory of 2256 2604 regsvr32.exe regsvr32.exe PID 2276 wrote to memory of 2692 2276 regsvr32.exe regsvr32.exe PID 2276 wrote to memory of 2692 2276 regsvr32.exe regsvr32.exe PID 3456 wrote to memory of 760 3456 EXCEL.EXE regsvr32.exe PID 3456 wrote to memory of 760 3456 EXCEL.EXE regsvr32.exe PID 2256 wrote to memory of 3792 2256 regsvr32.exe systeminfo.exe PID 2256 wrote to memory of 3792 2256 regsvr32.exe systeminfo.exe PID 2256 wrote to memory of 3916 2256 regsvr32.exe ipconfig.exe PID 2256 wrote to memory of 3916 2256 regsvr32.exe ipconfig.exe PID 2256 wrote to memory of 3468 2256 regsvr32.exe nltest.exe PID 2256 wrote to memory of 3468 2256 regsvr32.exe nltest.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7d730c7a39294b8d2e18047f0fb77418acd82b0a036495b48991692607456207.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci1.ocx2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci2.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\OytWvL\HTubqXlsJk.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
-
C:\Windows\system32\ipconfig.exeipconfig /all4⤵
- Gathers network information
-
C:\Windows\system32\nltest.exenltest /dclist:4⤵
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci3.ocx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\BvKMXXvEdLZU\lkFgVRHHYOKtL.dll"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\soci4.ocx2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\soci2.ocxFilesize
847KB
MD539a5c4e3b58cfc7adb88e1fc316ec5a4
SHA190a0fb85835554854885ce325254b42aa304abcc
SHA2563cbbdb7f3dfb39cda8142c83aa12d307da2b575cb4662d96ca260fdeea47dc26
SHA5126db90259d630206d1164390a00f2b4824041c670b27bdcc3c949d6ee15f1d66cbbb17c2500f8b5300be2a4a4dddd5efd4514106df93eddb61660537b74dc434a
-
C:\Users\Admin\soci3.ocxFilesize
847KB
MD5c965a176ca78692a43458b7f01752148
SHA146fba3b300f3e7fe8a99fef5d63ebefb89ed0baa
SHA25692e3e97e81f3c4929f80a91c239f2f0a79cf1714d7f648f3b3fd93c8c9c6edf7
SHA5120b9a5b83b2c1d0470ac52c0bd8ae496c9aea6aaf25e6267373baea98a6e6451a7908e58218b3a5ea10beba8105b38b3fd352445ab592fad30885373c4b965c41
-
\Users\Admin\soci2.ocxFilesize
847KB
MD539a5c4e3b58cfc7adb88e1fc316ec5a4
SHA190a0fb85835554854885ce325254b42aa304abcc
SHA2563cbbdb7f3dfb39cda8142c83aa12d307da2b575cb4662d96ca260fdeea47dc26
SHA5126db90259d630206d1164390a00f2b4824041c670b27bdcc3c949d6ee15f1d66cbbb17c2500f8b5300be2a4a4dddd5efd4514106df93eddb61660537b74dc434a
-
\Users\Admin\soci3.ocxFilesize
847KB
MD5c965a176ca78692a43458b7f01752148
SHA146fba3b300f3e7fe8a99fef5d63ebefb89ed0baa
SHA25692e3e97e81f3c4929f80a91c239f2f0a79cf1714d7f648f3b3fd93c8c9c6edf7
SHA5120b9a5b83b2c1d0470ac52c0bd8ae496c9aea6aaf25e6267373baea98a6e6451a7908e58218b3a5ea10beba8105b38b3fd352445ab592fad30885373c4b965c41
-
memory/760-307-0x0000000000000000-mapping.dmp
-
memory/1328-278-0x0000000000000000-mapping.dmp
-
memory/2256-331-0x0000000002640000-0x00000000085A4000-memory.dmpFilesize
95.4MB
-
memory/2256-288-0x0000000000000000-mapping.dmp
-
memory/2276-287-0x0000000000000000-mapping.dmp
-
memory/2604-282-0x0000000180000000-0x0000000180030000-memory.dmpFilesize
192KB
-
memory/2604-279-0x0000000000000000-mapping.dmp
-
memory/2692-301-0x0000000000000000-mapping.dmp
-
memory/3456-326-0x00007FF9C3760000-0x00007FF9C3770000-memory.dmpFilesize
64KB
-
memory/3456-128-0x00007FF9C09E0000-0x00007FF9C09F0000-memory.dmpFilesize
64KB
-
memory/3456-119-0x00007FF9C3760000-0x00007FF9C3770000-memory.dmpFilesize
64KB
-
memory/3456-116-0x00007FF9C3760000-0x00007FF9C3770000-memory.dmpFilesize
64KB
-
memory/3456-118-0x00007FF9C3760000-0x00007FF9C3770000-memory.dmpFilesize
64KB
-
memory/3456-129-0x00007FF9C09E0000-0x00007FF9C09F0000-memory.dmpFilesize
64KB
-
memory/3456-327-0x00007FF9C3760000-0x00007FF9C3770000-memory.dmpFilesize
64KB
-
memory/3456-328-0x00007FF9C3760000-0x00007FF9C3770000-memory.dmpFilesize
64KB
-
memory/3456-329-0x00007FF9C3760000-0x00007FF9C3770000-memory.dmpFilesize
64KB
-
memory/3456-117-0x00007FF9C3760000-0x00007FF9C3770000-memory.dmpFilesize
64KB
-
memory/3468-333-0x0000000000000000-mapping.dmp
-
memory/3792-330-0x0000000000000000-mapping.dmp
-
memory/3916-332-0x0000000000000000-mapping.dmp