Analysis

  • max time kernel
    158s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2022, 17:14

General

  • Target

    Trans-United.xls

  • Size

    217KB

  • MD5

    63a296674b01dcad0bbd102b5d27c948

  • SHA1

    136d70e5f35535b0e596f51b00ffa7552e61a22b

  • SHA256

    182dda55dc3b92cc65baecf6d5b3768768a508eca2f76ff38d5549743da9f581

  • SHA512

    be038b4be111251c1c360c69a05ee0327ff4e7d4e2391b46f055a5e8e019a86a3c7e87e46a4ca3766163f46310aba7be2304fe902536b1b7631632b124a080e7

  • SSDEEP

    6144:OKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgByY+TAQXTHGUMEyP5p6f5jQmo:wbGUMVWlbo

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://ftp.agir-santeinternationale.com/doctors/KAacngW97n4ApzVBDdGy/

xlm40.dropper

http://www.vinyz.com/admin3693/BDFFgAZ6zBRumcUSG/

xlm40.dropper

http://ly.yjlianyi.top/wp-admin/NRAdJ/

xlm40.dropper

http://www.muyehuayi.com/cmp/Vtm2m7z88g/

Extracted

Family

emotet

Botnet

Epoch4

C2

45.235.8.30:8080

94.23.45.86:4143

119.59.103.152:8080

169.60.181.70:8080

164.68.99.3:8080

172.105.226.75:8080

107.170.39.149:8080

206.189.28.199:8080

1.234.2.232:8080

188.44.20.25:443

186.194.240.217:443

103.43.75.120:443

149.28.143.92:443

159.89.202.34:443

209.97.163.214:443

183.111.227.137:8080

129.232.188.93:443

139.59.126.41:443

110.232.117.186:8080

139.59.56.73:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Trans-United.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JOANZzNVDISvvD\SIRBc.dll"
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:3692
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx
      2⤵
      • Process spawned unexpected child process
      PID:4720
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4692
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GRMzjpbJM\yqCowzER.dll"
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:4632
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx
      2⤵
      • Process spawned unexpected child process
      PID:3004

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\oxnv1.ooccxx

    Filesize

    882KB

    MD5

    1259121c5a8b97aa10fd8503f6f0317f

    SHA1

    cd0c40e1d5f1ee0e7f01e9bfdfec690cd1ca6484

    SHA256

    b7ce2d875e3714c7d4ade22c4c5b053b4f1e14aaa8d040552b38e1f53308e0ca

    SHA512

    a0881a4292ea3b0d183a3b9ca4cc314ed79c3b6bad5a87de43827a482a9d3483059b4fed8bbf3b4373aa30bbc760f7c3f37d1bcd21769ddc9369d63d0c5304aa

  • C:\Users\Admin\oxnv1.ooccxx

    Filesize

    882KB

    MD5

    1259121c5a8b97aa10fd8503f6f0317f

    SHA1

    cd0c40e1d5f1ee0e7f01e9bfdfec690cd1ca6484

    SHA256

    b7ce2d875e3714c7d4ade22c4c5b053b4f1e14aaa8d040552b38e1f53308e0ca

    SHA512

    a0881a4292ea3b0d183a3b9ca4cc314ed79c3b6bad5a87de43827a482a9d3483059b4fed8bbf3b4373aa30bbc760f7c3f37d1bcd21769ddc9369d63d0c5304aa

  • C:\Users\Admin\oxnv3.ooccxx

    Filesize

    882KB

    MD5

    824cf427687517b85b65f51e1ea22d2d

    SHA1

    a351cb4cffd244673108d56cd6b19c8a06b615d2

    SHA256

    e4bf3a69815c3b1b8850e0588ffa4d6e5351e7e39c51fb2c2bcd45472a7e7409

    SHA512

    7993fd0d828caa1a738b240d0aebe6a1cfd0a728055e1a095e16a0edd58258ee0e159a183afcbe0f16f68660a9bb95d7958e460d6b7200a31e4a21ceac6a1a69

  • C:\Users\Admin\oxnv3.ooccxx

    Filesize

    882KB

    MD5

    824cf427687517b85b65f51e1ea22d2d

    SHA1

    a351cb4cffd244673108d56cd6b19c8a06b615d2

    SHA256

    e4bf3a69815c3b1b8850e0588ffa4d6e5351e7e39c51fb2c2bcd45472a7e7409

    SHA512

    7993fd0d828caa1a738b240d0aebe6a1cfd0a728055e1a095e16a0edd58258ee0e159a183afcbe0f16f68660a9bb95d7958e460d6b7200a31e4a21ceac6a1a69

  • C:\Windows\System32\GRMzjpbJM\yqCowzER.dll

    Filesize

    882KB

    MD5

    824cf427687517b85b65f51e1ea22d2d

    SHA1

    a351cb4cffd244673108d56cd6b19c8a06b615d2

    SHA256

    e4bf3a69815c3b1b8850e0588ffa4d6e5351e7e39c51fb2c2bcd45472a7e7409

    SHA512

    7993fd0d828caa1a738b240d0aebe6a1cfd0a728055e1a095e16a0edd58258ee0e159a183afcbe0f16f68660a9bb95d7958e460d6b7200a31e4a21ceac6a1a69

  • C:\Windows\System32\JOANZzNVDISvvD\SIRBc.dll

    Filesize

    882KB

    MD5

    1259121c5a8b97aa10fd8503f6f0317f

    SHA1

    cd0c40e1d5f1ee0e7f01e9bfdfec690cd1ca6484

    SHA256

    b7ce2d875e3714c7d4ade22c4c5b053b4f1e14aaa8d040552b38e1f53308e0ca

    SHA512

    a0881a4292ea3b0d183a3b9ca4cc314ed79c3b6bad5a87de43827a482a9d3483059b4fed8bbf3b4373aa30bbc760f7c3f37d1bcd21769ddc9369d63d0c5304aa

  • memory/1720-142-0x00000000025C0000-0x00000000025EF000-memory.dmp

    Filesize

    188KB

  • memory/2268-133-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2268-137-0x00007FFE81370000-0x00007FFE81380000-memory.dmp

    Filesize

    64KB

  • memory/2268-132-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2268-136-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2268-135-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2268-138-0x00007FFE81370000-0x00007FFE81380000-memory.dmp

    Filesize

    64KB

  • memory/2268-134-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB