Analysis

  • max time kernel
    142s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2022, 19:34

General

  • Target

    256581586.xls

  • Size

    91KB

  • MD5

    b9e3899b2ae75df09dbaf867f05c2fea

  • SHA1

    372aa094aa996e2b52d89c733aa7b07f360baa1a

  • SHA256

    d3e5727470b3be97dec07e5c7ae9bfec89665502b188f462710f9adcc8ce9473

  • SHA512

    616025177c59edadcdb14da60e6e44cb6c037f0ea3d041367dbecc77ae57fc4609fc83c9410fe6ec3f640821d8b2e2cfde8a967569af7399759c45504bcd644f

  • SSDEEP

    1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZwEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgJ

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/

xlm40.dropper

http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/

xlm40.dropper

https://wijsneusmedia.nl/cgi-bin/kFB/

xlm40.dropper

http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain
eck1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\256581586.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NHlDOVzXlJLCj\VHVrZ.dll"
        3⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:3472
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      PID:4496
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      PID:360
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EZJwu\soQzHXK.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:884
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 452 -p 2596 -ip 2596
    1⤵
      PID:4180
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2596 -s 844
      1⤵
      • Program crash
      PID:4224

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\elv1.ooocccxxx

            Filesize

            434KB

            MD5

            8fcbefc5b851ebbe296ab0ca1b0daa67

            SHA1

            08ce9adb6d13889e342a564ae633b521967aa0cb

            SHA256

            295a8d38959e891564030a972db112a9f433d098b0c2cf0e83e8e0f96942dfa4

            SHA512

            9a0d878bea5f9441c6c72d3629b36110185a39c487d516b24aaada36ebe2554cc87c1f90f88b788b1495006390c1dd94247f4d01867a3c6ee1e6884c0b507b08

          • C:\Users\Admin\elv1.ooocccxxx

            Filesize

            434KB

            MD5

            8fcbefc5b851ebbe296ab0ca1b0daa67

            SHA1

            08ce9adb6d13889e342a564ae633b521967aa0cb

            SHA256

            295a8d38959e891564030a972db112a9f433d098b0c2cf0e83e8e0f96942dfa4

            SHA512

            9a0d878bea5f9441c6c72d3629b36110185a39c487d516b24aaada36ebe2554cc87c1f90f88b788b1495006390c1dd94247f4d01867a3c6ee1e6884c0b507b08

          • C:\Users\Admin\elv4.ooocccxxx

            Filesize

            434KB

            MD5

            a95ef8ddf776f91c231f2a270b67f117

            SHA1

            e0585229980fd7ce46cdc93e7dfd516789b0cdfb

            SHA256

            3cce3c3874ad1fa95a2cbbc13edad110b09f5f6733790c7d771668615ceb5acb

            SHA512

            53bea77d728421fe95594f9b58256fd44f535a94a4a3a3ff4a8d26fa45ba26f3ba6f0d642aac3388bdece2fc8b0a9280e36416fb33b8701f50acafb7331c3387

          • C:\Users\Admin\elv4.ooocccxxx

            Filesize

            434KB

            MD5

            a95ef8ddf776f91c231f2a270b67f117

            SHA1

            e0585229980fd7ce46cdc93e7dfd516789b0cdfb

            SHA256

            3cce3c3874ad1fa95a2cbbc13edad110b09f5f6733790c7d771668615ceb5acb

            SHA512

            53bea77d728421fe95594f9b58256fd44f535a94a4a3a3ff4a8d26fa45ba26f3ba6f0d642aac3388bdece2fc8b0a9280e36416fb33b8701f50acafb7331c3387

          • C:\Windows\System32\EZJwu\soQzHXK.dll

            Filesize

            434KB

            MD5

            a95ef8ddf776f91c231f2a270b67f117

            SHA1

            e0585229980fd7ce46cdc93e7dfd516789b0cdfb

            SHA256

            3cce3c3874ad1fa95a2cbbc13edad110b09f5f6733790c7d771668615ceb5acb

            SHA512

            53bea77d728421fe95594f9b58256fd44f535a94a4a3a3ff4a8d26fa45ba26f3ba6f0d642aac3388bdece2fc8b0a9280e36416fb33b8701f50acafb7331c3387

          • C:\Windows\System32\NHlDOVzXlJLCj\VHVrZ.dll

            Filesize

            434KB

            MD5

            8fcbefc5b851ebbe296ab0ca1b0daa67

            SHA1

            08ce9adb6d13889e342a564ae633b521967aa0cb

            SHA256

            295a8d38959e891564030a972db112a9f433d098b0c2cf0e83e8e0f96942dfa4

            SHA512

            9a0d878bea5f9441c6c72d3629b36110185a39c487d516b24aaada36ebe2554cc87c1f90f88b788b1495006390c1dd94247f4d01867a3c6ee1e6884c0b507b08

          • memory/2732-137-0x00007FFA42FA0000-0x00007FFA42FB0000-memory.dmp

            Filesize

            64KB

          • memory/2732-138-0x00007FFA42FA0000-0x00007FFA42FB0000-memory.dmp

            Filesize

            64KB

          • memory/2732-132-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

            Filesize

            64KB

          • memory/2732-135-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

            Filesize

            64KB

          • memory/2732-136-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

            Filesize

            64KB

          • memory/2732-134-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

            Filesize

            64KB

          • memory/2732-133-0x00007FFA45370000-0x00007FFA45380000-memory.dmp

            Filesize

            64KB

          • memory/3916-142-0x0000000180000000-0x0000000180030000-memory.dmp

            Filesize

            192KB