Analysis
-
max time kernel
108s -
max time network
157s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
09/11/2022, 19:04
Behavioral task
behavioral1
Sample
Receipt attached.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Receipt attached.xls
Resource
win10-20220812-en
General
-
Target
Receipt attached.xls
-
Size
255KB
-
MD5
97443a20d7b0dc4a3407cd7015fa63a0
-
SHA1
9774e1e4f1de3ce1873dc67ddb650bc3abd0fc73
-
SHA256
48b2c5bcc179258578a14fa8047f0e7813eaec00e2ef5cb8e29500c64bd0ba47
-
SHA512
b867dad61478168dbd803f7dd918c34a63c0bc9c175c8e0beba3f08d8e5f78b2e0520882691e5e4ad989272150402a574a1665ec2ce08283d56fd328160706fb
-
SSDEEP
6144:NKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgoNiwrfx9rNFMMrttRzV5Dz3UxqC8LUcSH:fNbDjP9XH5XIqZLnSH
Malware Config
Extracted
https://caimari.com/wp-includes/E3/
http://www.detertecnica.com/var/yROsVkd/
http://borntobefree.org.za/d3hEMgx7B/gKjYZXet98DzbCPzMsQ/
http://bigm.ir/wp-admin/jzIV5U90h9qbK7WK8RTZ/
Extracted
emotet
Epoch4
45.235.8.30:8080
94.23.45.86:4143
119.59.103.152:8080
169.60.181.70:8080
164.68.99.3:8080
172.105.226.75:8080
107.170.39.149:8080
206.189.28.199:8080
1.234.2.232:8080
188.44.20.25:443
186.194.240.217:443
103.43.75.120:443
149.28.143.92:443
159.89.202.34:443
209.97.163.214:443
183.111.227.137:8080
129.232.188.93:443
139.59.126.41:443
110.232.117.186:8080
139.59.56.73:8080
103.75.201.2:443
91.207.28.33:8080
164.90.222.65:443
197.242.150.244:8080
212.24.98.99:8080
51.161.73.194:443
115.68.227.76:8080
159.65.88.10:8080
201.94.166.162:443
95.217.221.146:8080
173.212.193.249:8080
82.223.21.224:8080
103.132.242.26:8080
213.239.212.5:443
153.126.146.25:7080
45.176.232.124:443
182.162.143.56:443
169.57.156.166:8080
159.65.140.115:443
163.44.196.120:8080
172.104.251.154:8080
167.172.253.162:8080
91.187.140.35:8080
45.118.115.99:8080
147.139.166.154:8080
72.15.201.15:8080
149.56.131.28:8080
167.172.199.165:8080
101.50.0.91:8080
160.16.142.56:8080
185.4.135.165:8080
104.168.155.143:8080
79.137.35.198:8080
5.135.159.50:443
187.63.160.88:80
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4496 2424 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4920 2424 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2244 2424 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4540 2424 regsvr32.exe 65 -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
pid Process 2244 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PEKSZZKyt.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\NMxIuWrPv\\PEKSZZKyt.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2424 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2244 regsvr32.exe 2244 regsvr32.exe 3784 regsvr32.exe 3784 regsvr32.exe 3784 regsvr32.exe 3784 regsvr32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2424 EXCEL.EXE 2424 EXCEL.EXE 2424 EXCEL.EXE 2424 EXCEL.EXE 2424 EXCEL.EXE 2424 EXCEL.EXE 2424 EXCEL.EXE 2424 EXCEL.EXE 2424 EXCEL.EXE 2424 EXCEL.EXE 2424 EXCEL.EXE 2424 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2424 wrote to memory of 4496 2424 EXCEL.EXE 70 PID 2424 wrote to memory of 4496 2424 EXCEL.EXE 70 PID 2424 wrote to memory of 4920 2424 EXCEL.EXE 72 PID 2424 wrote to memory of 4920 2424 EXCEL.EXE 72 PID 2424 wrote to memory of 2244 2424 EXCEL.EXE 74 PID 2424 wrote to memory of 2244 2424 EXCEL.EXE 74 PID 2244 wrote to memory of 3784 2244 regsvr32.exe 76 PID 2244 wrote to memory of 3784 2244 regsvr32.exe 76 PID 2424 wrote to memory of 4540 2424 EXCEL.EXE 78 PID 2424 wrote to memory of 4540 2424 EXCEL.EXE 78
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Receipt attached.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
PID:4496
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
PID:4920
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\NMxIuWrPv\PEKSZZKyt.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3784
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx2⤵
- Process spawned unexpected child process
PID:4540
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
575KB
MD5bdaeb8b6b0e786eb314b9c1e54277e08
SHA10e832f9c3b89bb5a1abc676830438b5badc7f7a9
SHA2569a33550659d3b05c4fbb80fd66eb939f93300edd15881b0baddbf663873c888e
SHA512b1b12ed62f10863cdb61827df94eb3922a0f07441fff356e0e51f82302c712801aea8a6429dcaee44efe7eaf732dbb751d7eff2a92a71c657f0ceb983ef89b6d
-
Filesize
575KB
MD5bdaeb8b6b0e786eb314b9c1e54277e08
SHA10e832f9c3b89bb5a1abc676830438b5badc7f7a9
SHA2569a33550659d3b05c4fbb80fd66eb939f93300edd15881b0baddbf663873c888e
SHA512b1b12ed62f10863cdb61827df94eb3922a0f07441fff356e0e51f82302c712801aea8a6429dcaee44efe7eaf732dbb751d7eff2a92a71c657f0ceb983ef89b6d