Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
09/11/2022, 19:15
Behavioral task
behavioral1
Sample
fb816a1b9ff22c57c03219df6113bbb91ef15734513a0b9722165280a990a3e7.xls
Resource
win10-20220901-en
Behavioral task
behavioral2
Sample
fb816a1b9ff22c57c03219df6113bbb91ef15734513a0b9722165280a990a3e7.xls
Resource
win10-20220812-en
General
-
Target
fb816a1b9ff22c57c03219df6113bbb91ef15734513a0b9722165280a990a3e7.xls
-
Size
91KB
-
MD5
6d388bfa6a9b5860d91065db186f6d55
-
SHA1
7b371e3e070d46ce92d18109e7d6317411497e01
-
SHA256
fb816a1b9ff22c57c03219df6113bbb91ef15734513a0b9722165280a990a3e7
-
SHA512
a6e775d3cca84547f01ad346346ea7144bf846e595d28709d531c915086bc7b3bea4038ee40f1f8740cef5e48704c7952cd6ca3a410e44dbb3181c301859fc4b
-
SSDEEP
1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZMEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgF
Malware Config
Extracted
http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/
http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/
https://wijsneusmedia.nl/cgi-bin/kFB/
http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/
Extracted
emotet
Epoch5
178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4584 1004 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4868 1004 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1480 1004 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 784 1004 regsvr32.exe 65 -
Downloads MZ/PE file
-
Loads dropped DLL 3 IoCs
pid Process 4584 regsvr32.exe 1480 regsvr32.exe 784 regsvr32.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SWLIoJVO.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\DFapEvaJNMW\\SWLIoJVO.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bpSvwasgAiiL.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\FJhxk\\bpSvwasgAiiL.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wwTNONveQl.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\VGXyktTUIjrlTpSni\\wwTNONveQl.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1004 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4584 regsvr32.exe 4584 regsvr32.exe 496 regsvr32.exe 496 regsvr32.exe 496 regsvr32.exe 496 regsvr32.exe 1480 regsvr32.exe 1480 regsvr32.exe 4700 regsvr32.exe 4700 regsvr32.exe 4700 regsvr32.exe 4700 regsvr32.exe 784 regsvr32.exe 784 regsvr32.exe 3096 regsvr32.exe 3096 regsvr32.exe 3096 regsvr32.exe 3096 regsvr32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1004 EXCEL.EXE 1004 EXCEL.EXE 1004 EXCEL.EXE 1004 EXCEL.EXE 1004 EXCEL.EXE 1004 EXCEL.EXE 1004 EXCEL.EXE 1004 EXCEL.EXE 1004 EXCEL.EXE 1004 EXCEL.EXE 1004 EXCEL.EXE 1004 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1004 wrote to memory of 4584 1004 EXCEL.EXE 70 PID 1004 wrote to memory of 4584 1004 EXCEL.EXE 70 PID 4584 wrote to memory of 496 4584 regsvr32.exe 71 PID 4584 wrote to memory of 496 4584 regsvr32.exe 71 PID 1004 wrote to memory of 4868 1004 EXCEL.EXE 72 PID 1004 wrote to memory of 4868 1004 EXCEL.EXE 72 PID 1004 wrote to memory of 1480 1004 EXCEL.EXE 76 PID 1004 wrote to memory of 1480 1004 EXCEL.EXE 76 PID 1004 wrote to memory of 784 1004 EXCEL.EXE 78 PID 1004 wrote to memory of 784 1004 EXCEL.EXE 78 PID 1480 wrote to memory of 4700 1480 regsvr32.exe 77 PID 1480 wrote to memory of 4700 1480 regsvr32.exe 77 PID 784 wrote to memory of 3096 784 regsvr32.exe 80 PID 784 wrote to memory of 3096 784 regsvr32.exe 80
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fb816a1b9ff22c57c03219df6113bbb91ef15734513a0b9722165280a990a3e7.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\FJhxk\bpSvwasgAiiL.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:496
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx2⤵
- Process spawned unexpected child process
PID:4868
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\VGXyktTUIjrlTpSni\wwTNONveQl.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4700
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\DFapEvaJNMW\SWLIoJVO.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3096
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434KB
MD5d12e251df2a5886a8dc018c98db175b2
SHA1018054205fb71632c6b3d20f414c95cf90e73894
SHA256e06298f62b3bede61c45ef2f9c1901fe74f56ce142fda08c03facf2229448ef0
SHA512261d837ec8bce76d9b40158144ff5c9d77987db64af2ad2b431a97142aef8d3f4932edaaee5733af8c5631bed8125c440796d1563f010036526678064bc47881
-
Filesize
434KB
MD51a48307a6fe1eedfc00909c4dba628e2
SHA1177721c2854b0eda92e11eddb5c19ac8d2f4bf4a
SHA25662e9764e9f3687f0afcd295c171241f1c0f133592a5e5184d95e9365029a36c8
SHA51224f8c6429290b8503b5402579a563be968f009b2e2ff0a4a5a8dda37567e68075d5aaeda3c3da3b382dd02f14d6cd93f8305a148bb8b7849e7f3fa79238b63ea
-
Filesize
434KB
MD5414ff0a2e4731e3dd9427df098233819
SHA1850f35574fdafe22df9a02fe04ad69ee2a286e1e
SHA256163187b153de523c3f3786a350d4f53e34c36808a81bcad3d84cefd944226130
SHA5124b351891a7f507904318abf171a3b788cd542881af94738b7983956a43212290e36ec7087072e78d96cb95b86a1d727f7c939557dacc74fe926b21909f5e9b10
-
Filesize
434KB
MD5d12e251df2a5886a8dc018c98db175b2
SHA1018054205fb71632c6b3d20f414c95cf90e73894
SHA256e06298f62b3bede61c45ef2f9c1901fe74f56ce142fda08c03facf2229448ef0
SHA512261d837ec8bce76d9b40158144ff5c9d77987db64af2ad2b431a97142aef8d3f4932edaaee5733af8c5631bed8125c440796d1563f010036526678064bc47881
-
Filesize
434KB
MD51a48307a6fe1eedfc00909c4dba628e2
SHA1177721c2854b0eda92e11eddb5c19ac8d2f4bf4a
SHA25662e9764e9f3687f0afcd295c171241f1c0f133592a5e5184d95e9365029a36c8
SHA51224f8c6429290b8503b5402579a563be968f009b2e2ff0a4a5a8dda37567e68075d5aaeda3c3da3b382dd02f14d6cd93f8305a148bb8b7849e7f3fa79238b63ea
-
Filesize
434KB
MD5414ff0a2e4731e3dd9427df098233819
SHA1850f35574fdafe22df9a02fe04ad69ee2a286e1e
SHA256163187b153de523c3f3786a350d4f53e34c36808a81bcad3d84cefd944226130
SHA5124b351891a7f507904318abf171a3b788cd542881af94738b7983956a43212290e36ec7087072e78d96cb95b86a1d727f7c939557dacc74fe926b21909f5e9b10