Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
03/11/2022, 22:45
Behavioral task
behavioral1
Sample
cc60666cf8baf4f357ba7313ca35879ad7799371ca03117953a1248b2af1ce7d.xls
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
cc60666cf8baf4f357ba7313ca35879ad7799371ca03117953a1248b2af1ce7d.xls
Resource
win10-20220812-en
General
-
Target
cc60666cf8baf4f357ba7313ca35879ad7799371ca03117953a1248b2af1ce7d.xls
-
Size
217KB
-
MD5
c7911de4f663065623db94da9ecdad27
-
SHA1
99da7b8cdd23c8cf51b0c0b7273a0e942634119a
-
SHA256
cc60666cf8baf4f357ba7313ca35879ad7799371ca03117953a1248b2af1ce7d
-
SHA512
6ebb0b61faccb7700b8410f439636d7b15026a236157b22465586c479ac77f7d7b62c268f38884806c193e2a434e4e7a7979d191eb4fba349f99dbf2515e3b50
-
SSDEEP
6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dglyY+TAQXTHGUMEyP5p6f5jQm75nT:1bGUMVWlbp
Malware Config
Extracted
http://app.clubdedocentes.com/storage/DCcq9ekgH99sI/
http://linhkiendoc.com/app/payments/qoy5JqpLqrbsKl/
http://sourcecool.com/throng/iOD/
Extracted
emotet
Epoch4
45.235.8.30:8080
94.23.45.86:4143
119.59.103.152:8080
169.60.181.70:8080
164.68.99.3:8080
172.105.226.75:8080
107.170.39.149:8080
206.189.28.199:8080
1.234.2.232:8080
188.44.20.25:443
186.194.240.217:443
103.43.75.120:443
149.28.143.92:443
159.89.202.34:443
209.97.163.214:443
183.111.227.137:8080
129.232.188.93:443
139.59.126.41:443
110.232.117.186:8080
139.59.56.73:8080
103.75.201.2:443
91.207.28.33:8080
164.90.222.65:443
197.242.150.244:8080
212.24.98.99:8080
51.161.73.194:443
115.68.227.76:8080
159.65.88.10:8080
201.94.166.162:443
95.217.221.146:8080
173.212.193.249:8080
82.223.21.224:8080
103.132.242.26:8080
213.239.212.5:443
153.126.146.25:7080
45.176.232.124:443
182.162.143.56:443
169.57.156.166:8080
159.65.140.115:443
163.44.196.120:8080
172.104.251.154:8080
167.172.253.162:8080
91.187.140.35:8080
45.118.115.99:8080
147.139.166.154:8080
72.15.201.15:8080
149.56.131.28:8080
167.172.199.165:8080
101.50.0.91:8080
160.16.142.56:8080
185.4.135.165:8080
104.168.155.143:8080
79.137.35.198:8080
5.135.159.50:443
187.63.160.88:80
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3060 3540 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 920 3540 regsvr32.exe 65 -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
pid Process 3060 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kFCHLEuVqnzhIS.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\NzFydzDeMZbgT\\kFCHLEuVqnzhIS.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3540 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3060 regsvr32.exe 3060 regsvr32.exe 4920 regsvr32.exe 4920 regsvr32.exe 4920 regsvr32.exe 4920 regsvr32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3540 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3540 EXCEL.EXE 3540 EXCEL.EXE 3540 EXCEL.EXE 3540 EXCEL.EXE 3540 EXCEL.EXE 3540 EXCEL.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3540 wrote to memory of 3060 3540 EXCEL.EXE 70 PID 3540 wrote to memory of 3060 3540 EXCEL.EXE 70 PID 3060 wrote to memory of 4920 3060 regsvr32.exe 73 PID 3060 wrote to memory of 4920 3060 regsvr32.exe 73 PID 3540 wrote to memory of 920 3540 EXCEL.EXE 76 PID 3540 wrote to memory of 920 3540 EXCEL.EXE 76
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\cc60666cf8baf4f357ba7313ca35879ad7799371ca03117953a1248b2af1ce7d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\NzFydzDeMZbgT\kFCHLEuVqnzhIS.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4920
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
PID:920
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
745KB
MD53280aa443d42f20b4cf141374783dec9
SHA1e7e73d64fe9420b9f924a6d78470b58c1a0bc3fb
SHA256e47e3566e13e21c452848f0be74ef6ef26112f7974d6036eadf53711edc38398
SHA512418e905d51bbb9fbd34b4f698fc59245d80711f57d56a2a59a390005dbe37dd3bb65c40148f21e67ab15858b2bec01f2ba13ef072fd50beb05733cdb7c593503
-
Filesize
745KB
MD53280aa443d42f20b4cf141374783dec9
SHA1e7e73d64fe9420b9f924a6d78470b58c1a0bc3fb
SHA256e47e3566e13e21c452848f0be74ef6ef26112f7974d6036eadf53711edc38398
SHA512418e905d51bbb9fbd34b4f698fc59245d80711f57d56a2a59a390005dbe37dd3bb65c40148f21e67ab15858b2bec01f2ba13ef072fd50beb05733cdb7c593503