Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2022, 06:47

General

  • Target

    00216_76.xls

  • Size

    217KB

  • MD5

    c50064ce002fd4d8bd318ac3718ce2e0

  • SHA1

    46c8aaaaeed6a16310dbba8bd0cff9e089b6429d

  • SHA256

    a2c765d555ce8eff36aefe6704e08548d21ca38111cfefc8d3c73b57c68dc7f5

  • SHA512

    c5b9627fe8f0d3bd576181c2ff9f2ce3549948b4e53e053e5b5d5f69bc5ea67187be6bad670760fc863f70dfdf673a34b8f222a351c64323bba6bede03423239

  • SSDEEP

    6144:zKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgXyY+TAQXTHGUMEyP5p6f5jQmm:DbGUMVWlbm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://barkstage.es/wp-content/0E7NdYl7TZuHMJq7/

xlm40.dropper

http://contactworks.nl/images_old/NuEAhfF0PCFhvv/

xlm40.dropper

http://www.iam.ch/wp-content/cache/minify/O1OAjWnfen/

xlm40.dropper

https://www.elaboro.pl/wp-admin/J0hwyIMsk9YFIi/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain
eck1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 6 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\00216_76.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Windows\system32\regsvr32.exe
        /S ..\oxnv1.ooccxx
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1512
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TdEimfGoXuiE\XVcnR.dll"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1944
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\system32\regsvr32.exe
        /S ..\oxnv2.ooccxx
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1912
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JNCOQWcjONt\SOttIkXrPIbOS.dll"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1788
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
      2⤵
      • Process spawned unexpected child process
      PID:1664
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Windows\system32\regsvr32.exe
        /S ..\oxnv4.ooccxx
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1840
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\CUOMciQLO\YlsRLi.dll"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1340

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\oxnv1.ooccxx

    Filesize

    751KB

    MD5

    ccb69ea1645f1a7c7a493ad0be58d08b

    SHA1

    c58a695f989c4ec4e497629c1b8461af282999cd

    SHA256

    9fc74f4157fffa466f3b24b6267fa70c429efc4eda6361091c4ea203eb61b38f

    SHA512

    e9d44f00127766f9f58ab66b6251b59dc591241c599b69f8b4dc7f7959345e1bcecc5c3f09814d2a28d229cfb3e593238c0e7812fd04a11069983fcf07c8272d

  • C:\Users\Admin\oxnv2.ooccxx

    Filesize

    751KB

    MD5

    b74f54ec21b7eee3eefd68b0a162cf2f

    SHA1

    65bebd45e990fee64e96586895cfa10d926695c3

    SHA256

    7d690682eaaa9471e7bd5123ee2501442eac327e5812705d890911a22be22322

    SHA512

    9a7671f54a0c0e33ea1ca3156411d62f81a39e83c2c55093c967cedd0fe63966eb1cabb71fbf75ca891d5dab93d187d5c45b11e57e366f9dec71a0a839576fee

  • C:\Users\Admin\oxnv4.ooccxx

    Filesize

    751KB

    MD5

    c4f32c7b21d0a1abec9cde0b9b32976a

    SHA1

    84ff5f720a9b6f578c9e9c4a79826ebdbfffd20e

    SHA256

    083292403c9960fda3552ab691effc4c73856750e1fd3e13039dfbfa99406cd2

    SHA512

    657183976e3163d44d0bb8b2349a55c4de11b533a46174f4de966895bccc1ad470cd66789681ed4d4dadf3eb6c360bb32cf636c2a5de9c7fc9973954b22683c9

  • \Users\Admin\oxnv1.ooccxx

    Filesize

    751KB

    MD5

    ccb69ea1645f1a7c7a493ad0be58d08b

    SHA1

    c58a695f989c4ec4e497629c1b8461af282999cd

    SHA256

    9fc74f4157fffa466f3b24b6267fa70c429efc4eda6361091c4ea203eb61b38f

    SHA512

    e9d44f00127766f9f58ab66b6251b59dc591241c599b69f8b4dc7f7959345e1bcecc5c3f09814d2a28d229cfb3e593238c0e7812fd04a11069983fcf07c8272d

  • \Users\Admin\oxnv1.ooccxx

    Filesize

    751KB

    MD5

    ccb69ea1645f1a7c7a493ad0be58d08b

    SHA1

    c58a695f989c4ec4e497629c1b8461af282999cd

    SHA256

    9fc74f4157fffa466f3b24b6267fa70c429efc4eda6361091c4ea203eb61b38f

    SHA512

    e9d44f00127766f9f58ab66b6251b59dc591241c599b69f8b4dc7f7959345e1bcecc5c3f09814d2a28d229cfb3e593238c0e7812fd04a11069983fcf07c8272d

  • \Users\Admin\oxnv2.ooccxx

    Filesize

    751KB

    MD5

    b74f54ec21b7eee3eefd68b0a162cf2f

    SHA1

    65bebd45e990fee64e96586895cfa10d926695c3

    SHA256

    7d690682eaaa9471e7bd5123ee2501442eac327e5812705d890911a22be22322

    SHA512

    9a7671f54a0c0e33ea1ca3156411d62f81a39e83c2c55093c967cedd0fe63966eb1cabb71fbf75ca891d5dab93d187d5c45b11e57e366f9dec71a0a839576fee

  • \Users\Admin\oxnv2.ooccxx

    Filesize

    751KB

    MD5

    b74f54ec21b7eee3eefd68b0a162cf2f

    SHA1

    65bebd45e990fee64e96586895cfa10d926695c3

    SHA256

    7d690682eaaa9471e7bd5123ee2501442eac327e5812705d890911a22be22322

    SHA512

    9a7671f54a0c0e33ea1ca3156411d62f81a39e83c2c55093c967cedd0fe63966eb1cabb71fbf75ca891d5dab93d187d5c45b11e57e366f9dec71a0a839576fee

  • \Users\Admin\oxnv4.ooccxx

    Filesize

    751KB

    MD5

    c4f32c7b21d0a1abec9cde0b9b32976a

    SHA1

    84ff5f720a9b6f578c9e9c4a79826ebdbfffd20e

    SHA256

    083292403c9960fda3552ab691effc4c73856750e1fd3e13039dfbfa99406cd2

    SHA512

    657183976e3163d44d0bb8b2349a55c4de11b533a46174f4de966895bccc1ad470cd66789681ed4d4dadf3eb6c360bb32cf636c2a5de9c7fc9973954b22683c9

  • \Users\Admin\oxnv4.ooccxx

    Filesize

    751KB

    MD5

    c4f32c7b21d0a1abec9cde0b9b32976a

    SHA1

    84ff5f720a9b6f578c9e9c4a79826ebdbfffd20e

    SHA256

    083292403c9960fda3552ab691effc4c73856750e1fd3e13039dfbfa99406cd2

    SHA512

    657183976e3163d44d0bb8b2349a55c4de11b533a46174f4de966895bccc1ad470cd66789681ed4d4dadf3eb6c360bb32cf636c2a5de9c7fc9973954b22683c9

  • memory/860-84-0x0000000071F1D000-0x0000000071F28000-memory.dmp

    Filesize

    44KB

  • memory/860-57-0x0000000071F1D000-0x0000000071F28000-memory.dmp

    Filesize

    44KB

  • memory/860-55-0x0000000070F31000-0x0000000070F33000-memory.dmp

    Filesize

    8KB

  • memory/860-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/860-54-0x000000002F031000-0x000000002F034000-memory.dmp

    Filesize

    12KB

  • memory/860-58-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

    Filesize

    8KB

  • memory/1512-64-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

    Filesize

    8KB

  • memory/1512-66-0x0000000180000000-0x0000000180030000-memory.dmp

    Filesize

    192KB