Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
09/11/2022, 19:04
Behavioral task
behavioral1
Sample
fe996f7a16c72bb3a849d07f6bd36bdecf5f09a46c3be6c04f858c02c062aa92.xls
Resource
win10-20220901-en
Behavioral task
behavioral2
Sample
fe996f7a16c72bb3a849d07f6bd36bdecf5f09a46c3be6c04f858c02c062aa92.xls
Resource
win10-20220812-en
General
-
Target
fe996f7a16c72bb3a849d07f6bd36bdecf5f09a46c3be6c04f858c02c062aa92.xls
-
Size
91KB
-
MD5
5d96abd7680cdbc4ae1f09c3c2381518
-
SHA1
7c14dac8099c202b216cd7c201bd2471c6c2ad81
-
SHA256
fe996f7a16c72bb3a849d07f6bd36bdecf5f09a46c3be6c04f858c02c062aa92
-
SHA512
c949d98536a2395dbdbbc01142ef7b90a65a3b6af0935a6cc255d0515f0eb74a52780812c7ebd3f64fa79e4b2230f150dd7de4eb19cc8f10840dfbc05099e319
-
SSDEEP
1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2bCXuZH4gb4CEn9J4Zacvp:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgy
Malware Config
Extracted
http://bundlefilm.com/headers/lkfBH3Czw9CjEW07P2/
http://camsanparke.net/wp-content/h2Ja5bwB03hnyfCb/
http://royreid.co.uk/wp-content/dCwG/
https://cs.com.sg/admin/a1lR5wu/
Extracted
emotet
Epoch5
178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4624 1756 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 500 1756 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1468 1756 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3316 1756 regsvr32.exe 65 -
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
pid Process 4624 regsvr32.exe 500 regsvr32.exe 1468 regsvr32.exe 3316 regsvr32.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gFXdwqPKIWTf.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\LqgAXRFRvnIQmYLI\\gFXdwqPKIWTf.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mlRPmESO.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\FyLtxzh\\mlRPmESO.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HGEAcfEuhxagxiAN.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\YlExtWS\\HGEAcfEuhxagxiAN.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sEAFtcEFimF.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\VDTsOw\\sEAFtcEFimF.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1756 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4624 regsvr32.exe 4624 regsvr32.exe 840 regsvr32.exe 840 regsvr32.exe 840 regsvr32.exe 840 regsvr32.exe 500 regsvr32.exe 500 regsvr32.exe 1596 regsvr32.exe 1596 regsvr32.exe 1596 regsvr32.exe 1596 regsvr32.exe 1468 regsvr32.exe 1468 regsvr32.exe 3368 regsvr32.exe 3368 regsvr32.exe 3368 regsvr32.exe 3368 regsvr32.exe 3316 regsvr32.exe 3316 regsvr32.exe 2356 regsvr32.exe 2356 regsvr32.exe 2356 regsvr32.exe 2356 regsvr32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1756 EXCEL.EXE 1756 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1756 EXCEL.EXE 1756 EXCEL.EXE 1756 EXCEL.EXE 1756 EXCEL.EXE 1756 EXCEL.EXE 1756 EXCEL.EXE 1756 EXCEL.EXE 1756 EXCEL.EXE 1756 EXCEL.EXE 1756 EXCEL.EXE 1756 EXCEL.EXE 1756 EXCEL.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1756 wrote to memory of 4624 1756 EXCEL.EXE 72 PID 1756 wrote to memory of 4624 1756 EXCEL.EXE 72 PID 4624 wrote to memory of 840 4624 regsvr32.exe 74 PID 4624 wrote to memory of 840 4624 regsvr32.exe 74 PID 1756 wrote to memory of 500 1756 EXCEL.EXE 75 PID 1756 wrote to memory of 500 1756 EXCEL.EXE 75 PID 500 wrote to memory of 1596 500 regsvr32.exe 77 PID 500 wrote to memory of 1596 500 regsvr32.exe 77 PID 1756 wrote to memory of 1468 1756 EXCEL.EXE 78 PID 1756 wrote to memory of 1468 1756 EXCEL.EXE 78 PID 1468 wrote to memory of 3368 1468 regsvr32.exe 79 PID 1468 wrote to memory of 3368 1468 regsvr32.exe 79 PID 1756 wrote to memory of 3316 1756 EXCEL.EXE 80 PID 1756 wrote to memory of 3316 1756 EXCEL.EXE 80 PID 3316 wrote to memory of 2356 3316 regsvr32.exe 81 PID 3316 wrote to memory of 2356 3316 regsvr32.exe 81
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fe996f7a16c72bb3a849d07f6bd36bdecf5f09a46c3be6c04f858c02c062aa92.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\FyLtxzh\mlRPmESO.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:840
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\YlExtWS\HGEAcfEuhxagxiAN.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1596
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\VDTsOw\sEAFtcEFimF.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3368
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\LqgAXRFRvnIQmYLI\gFXdwqPKIWTf.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2356
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434KB
MD55f04d2e6eeb8df0d76016bd209d59be2
SHA12b4ef824d17286c46accb996af968a5c7e1e5823
SHA2562bdbae1e248ed343948edd156ccdbecd642e968311b44d47eac9a772713f9c94
SHA51251f069cfdb469c184262a19da5165b2fd776d708243ba4cfb53dfe373e1098fd508c6dca622fee6a825e520bbbf245012198c5cbefa24849a94bec08c00e6a70
-
Filesize
434KB
MD59c8f00e14b4b52b38bb5fbe52794c4dd
SHA1a2c4c431b6a90bf6c2563d3f50268f3df2081919
SHA25654dd1c745a964f11e4203a2ef907c7b25d48668eb72fc0a1a675f646eeeba308
SHA5125614eda5787be6c4dfde40ead0b2fa9944ed25c7a1cff82a2b1d7ce176fb69d8adcf9043a8a70047efa6a4ad18bb2f1f6ff73bafd1ec40421bdbdd70ae2d56da
-
Filesize
434KB
MD5243d7271cdb5d8f5d7d76fa6c733e51e
SHA16a422907d1ff8a0ebc78c04a30175f0d8b3c761c
SHA256399d4ef7fdd503db0c5e558c02beb73ca230e141b169b5784f2ee74ae784c883
SHA512e34211a45fcd7351d8b3f5c440ad1e8cb0e8ce292aade586fe9e4d84f01fe309e47ee832195f2820151b5a00123d349784ecd7d14d7950a37bc78c88f98b9b32
-
Filesize
434KB
MD5691ecff2e5acc42434712b64a8f01a90
SHA1f7a06fb5a495bbbdd70ddf9757fac7e76e395df7
SHA256ddd01651b9db906d977b53e95c2ee4637489c53189563d0b300c1aa2a95f5449
SHA5120ae0f18142d5bc035777e5668325fa78a5f2d7edcba275bc9919d65faf868e9fbb495381fb4e09f06f4ba7a6e42655160e8e184c5b504457c5fbfce5277676f4
-
Filesize
434KB
MD55f04d2e6eeb8df0d76016bd209d59be2
SHA12b4ef824d17286c46accb996af968a5c7e1e5823
SHA2562bdbae1e248ed343948edd156ccdbecd642e968311b44d47eac9a772713f9c94
SHA51251f069cfdb469c184262a19da5165b2fd776d708243ba4cfb53dfe373e1098fd508c6dca622fee6a825e520bbbf245012198c5cbefa24849a94bec08c00e6a70
-
Filesize
434KB
MD59c8f00e14b4b52b38bb5fbe52794c4dd
SHA1a2c4c431b6a90bf6c2563d3f50268f3df2081919
SHA25654dd1c745a964f11e4203a2ef907c7b25d48668eb72fc0a1a675f646eeeba308
SHA5125614eda5787be6c4dfde40ead0b2fa9944ed25c7a1cff82a2b1d7ce176fb69d8adcf9043a8a70047efa6a4ad18bb2f1f6ff73bafd1ec40421bdbdd70ae2d56da
-
Filesize
434KB
MD5243d7271cdb5d8f5d7d76fa6c733e51e
SHA16a422907d1ff8a0ebc78c04a30175f0d8b3c761c
SHA256399d4ef7fdd503db0c5e558c02beb73ca230e141b169b5784f2ee74ae784c883
SHA512e34211a45fcd7351d8b3f5c440ad1e8cb0e8ce292aade586fe9e4d84f01fe309e47ee832195f2820151b5a00123d349784ecd7d14d7950a37bc78c88f98b9b32
-
Filesize
434KB
MD5691ecff2e5acc42434712b64a8f01a90
SHA1f7a06fb5a495bbbdd70ddf9757fac7e76e395df7
SHA256ddd01651b9db906d977b53e95c2ee4637489c53189563d0b300c1aa2a95f5449
SHA5120ae0f18142d5bc035777e5668325fa78a5f2d7edcba275bc9919d65faf868e9fbb495381fb4e09f06f4ba7a6e42655160e8e184c5b504457c5fbfce5277676f4