Analysis
-
max time kernel
144s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
09/11/2022, 19:17
Behavioral task
behavioral1
Sample
22db011b48af2ab3ea49fe8e3f2afe83cc1239edf66afc89bcd7760c7c977d4e.xls
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
22db011b48af2ab3ea49fe8e3f2afe83cc1239edf66afc89bcd7760c7c977d4e.xls
Resource
win10-20220901-en
General
-
Target
22db011b48af2ab3ea49fe8e3f2afe83cc1239edf66afc89bcd7760c7c977d4e.xls
-
Size
91KB
-
MD5
47d2dc7d0429faf9fe2b54ca6d0bf164
-
SHA1
2833365cc25811dbcf042dfb5c81930913f9259d
-
SHA256
22db011b48af2ab3ea49fe8e3f2afe83cc1239edf66afc89bcd7760c7c977d4e
-
SHA512
dbeb6f54b5e7558c260d8544a87fee7c6f9a4246c2de7535beca6e00a4bba54212bd436532a97c2fa4ab7cb5d71c87868e880fe791834164e57e0a83f259a81e
-
SSDEEP
1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2bCXuZH4gb4CEn9J4Zqcvp:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgi
Malware Config
Extracted
http://bundlefilm.com/headers/lkfBH3Czw9CjEW07P2/
http://camsanparke.net/wp-content/h2Ja5bwB03hnyfCb/
http://royreid.co.uk/wp-content/dCwG/
https://cs.com.sg/admin/a1lR5wu/
Extracted
emotet
Epoch5
178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3376 2848 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 5040 2848 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3192 2848 regsvr32.exe 65 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1260 2848 regsvr32.exe 65 -
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
pid Process 3376 regsvr32.exe 5040 regsvr32.exe 3192 regsvr32.exe 1260 regsvr32.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aXjxLEQgYP.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\QwHnRnuiLwVqa\\aXjxLEQgYP.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OanTT.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\YRwNgxIffxGcJe\\OanTT.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yiREZhauW.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\HlRnO\\yiREZhauW.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fIVhEDnyUfYdqaZ.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\IIhZpCUyWd\\fIVhEDnyUfYdqaZ.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2848 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3376 regsvr32.exe 3376 regsvr32.exe 4984 regsvr32.exe 4984 regsvr32.exe 5040 regsvr32.exe 5040 regsvr32.exe 4984 regsvr32.exe 4984 regsvr32.exe 4904 regsvr32.exe 4904 regsvr32.exe 3192 regsvr32.exe 3192 regsvr32.exe 4904 regsvr32.exe 4904 regsvr32.exe 3220 regsvr32.exe 3220 regsvr32.exe 3220 regsvr32.exe 3220 regsvr32.exe 1260 regsvr32.exe 1260 regsvr32.exe 1284 regsvr32.exe 1284 regsvr32.exe 1284 regsvr32.exe 1284 regsvr32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2848 EXCEL.EXE 2848 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE 2848 EXCEL.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2848 wrote to memory of 3376 2848 EXCEL.EXE 68 PID 2848 wrote to memory of 3376 2848 EXCEL.EXE 68 PID 3376 wrote to memory of 4984 3376 regsvr32.exe 70 PID 3376 wrote to memory of 4984 3376 regsvr32.exe 70 PID 2848 wrote to memory of 5040 2848 EXCEL.EXE 71 PID 2848 wrote to memory of 5040 2848 EXCEL.EXE 71 PID 5040 wrote to memory of 4904 5040 regsvr32.exe 72 PID 5040 wrote to memory of 4904 5040 regsvr32.exe 72 PID 2848 wrote to memory of 3192 2848 EXCEL.EXE 73 PID 2848 wrote to memory of 3192 2848 EXCEL.EXE 73 PID 3192 wrote to memory of 3220 3192 regsvr32.exe 74 PID 3192 wrote to memory of 3220 3192 regsvr32.exe 74 PID 2848 wrote to memory of 1260 2848 EXCEL.EXE 75 PID 2848 wrote to memory of 1260 2848 EXCEL.EXE 75 PID 1260 wrote to memory of 1284 1260 regsvr32.exe 76 PID 1260 wrote to memory of 1284 1260 regsvr32.exe 76
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\22db011b48af2ab3ea49fe8e3f2afe83cc1239edf66afc89bcd7760c7c977d4e.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\HlRnO\yiREZhauW.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4984
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\IIhZpCUyWd\fIVhEDnyUfYdqaZ.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\QwHnRnuiLwVqa\aXjxLEQgYP.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\YRwNgxIffxGcJe\OanTT.dll"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1284
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434KB
MD57a89b7f5de94fa2aaace9a935ef1eb3e
SHA1cc487fc865651d08006741cd6e96553ce11f1203
SHA256d390ede4dc13af94b97d68c1ad2576035e0ae798550a4e5ca0132bc0ad499919
SHA5123e017d0ab4e97826962e5b4089382e0050c7c92ffa6518ebc937a903c3fd54ad2cbaec550bd62ae86223a90cbfb61699e6baa6dc9fc38db8e75dd9a80314cbd3
-
Filesize
434KB
MD524331d01d16956330a64a0da12adf2ea
SHA163c098027f96fedbd8a4f5ed0ec8d981aa3c78c1
SHA25670db66e2ab38fde9b3935b95e0e8534e72c959c66cae5490cb40d427bc09cf55
SHA512390ad7d4c06b5c6f94cfd27cae1b1432fbac0d6d8ebfbca29691b916af1b7470a5fc3d04514c2b86f569a963431a7aad6f724a5d33888e85985bb0545618a191
-
Filesize
434KB
MD576f1f6e48efcdebe14e0c45b30f3b935
SHA17561eb1b663f296e5594541ae0087f601efaa818
SHA256a2e4d5ab1b9b364d1db0df6a9ef5cb6f196dfce32a57781ab838d4537472d7ef
SHA51250cf84efb6fe961c914a15b0ec4efd0023f6a2ec4d8f24c22baad23f8dadb711e64a1951b825e90559746189dd2cd10e74bef842b0ee21b90d83b56bea2c8550
-
Filesize
434KB
MD5691ecff2e5acc42434712b64a8f01a90
SHA1f7a06fb5a495bbbdd70ddf9757fac7e76e395df7
SHA256ddd01651b9db906d977b53e95c2ee4637489c53189563d0b300c1aa2a95f5449
SHA5120ae0f18142d5bc035777e5668325fa78a5f2d7edcba275bc9919d65faf868e9fbb495381fb4e09f06f4ba7a6e42655160e8e184c5b504457c5fbfce5277676f4
-
Filesize
434KB
MD57a89b7f5de94fa2aaace9a935ef1eb3e
SHA1cc487fc865651d08006741cd6e96553ce11f1203
SHA256d390ede4dc13af94b97d68c1ad2576035e0ae798550a4e5ca0132bc0ad499919
SHA5123e017d0ab4e97826962e5b4089382e0050c7c92ffa6518ebc937a903c3fd54ad2cbaec550bd62ae86223a90cbfb61699e6baa6dc9fc38db8e75dd9a80314cbd3
-
Filesize
434KB
MD524331d01d16956330a64a0da12adf2ea
SHA163c098027f96fedbd8a4f5ed0ec8d981aa3c78c1
SHA25670db66e2ab38fde9b3935b95e0e8534e72c959c66cae5490cb40d427bc09cf55
SHA512390ad7d4c06b5c6f94cfd27cae1b1432fbac0d6d8ebfbca29691b916af1b7470a5fc3d04514c2b86f569a963431a7aad6f724a5d33888e85985bb0545618a191
-
Filesize
434KB
MD576f1f6e48efcdebe14e0c45b30f3b935
SHA17561eb1b663f296e5594541ae0087f601efaa818
SHA256a2e4d5ab1b9b364d1db0df6a9ef5cb6f196dfce32a57781ab838d4537472d7ef
SHA51250cf84efb6fe961c914a15b0ec4efd0023f6a2ec4d8f24c22baad23f8dadb711e64a1951b825e90559746189dd2cd10e74bef842b0ee21b90d83b56bea2c8550
-
Filesize
434KB
MD5691ecff2e5acc42434712b64a8f01a90
SHA1f7a06fb5a495bbbdd70ddf9757fac7e76e395df7
SHA256ddd01651b9db906d977b53e95c2ee4637489c53189563d0b300c1aa2a95f5449
SHA5120ae0f18142d5bc035777e5668325fa78a5f2d7edcba275bc9919d65faf868e9fbb495381fb4e09f06f4ba7a6e42655160e8e184c5b504457c5fbfce5277676f4