Analysis
-
max time kernel
147s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2022, 20:23
Behavioral task
behavioral1
Sample
Documentos-13536.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Documentos-13536.xls
Resource
win10v2004-20220901-en
General
-
Target
Documentos-13536.xls
-
Size
91KB
-
MD5
018c40d93a562f7287ed93aebe7c1e69
-
SHA1
e5874b1b6b7b1c02d12a80cba885c8040896bef0
-
SHA256
48b9843bcbb25f7a71fce3de304c770ebbc732e230e22bd8e5f96e9d733d00ee
-
SHA512
365531e8bcd031d7ab6949fabdf5a692c1d96eb04b2476ece4132abb044b88f91828221876427974eb75dc17c727e400dd3c57115ee58530025378eb0c12b9cc
-
SSDEEP
1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2bCXuZH4gb4CEn9J4ZWcvp:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg+
Malware Config
Extracted
http://bundlefilm.com/headers/lkfBH3Czw9CjEW07P2/
http://camsanparke.net/wp-content/h2Ja5bwB03hnyfCb/
http://royreid.co.uk/wp-content/dCwG/
https://cs.com.sg/admin/a1lR5wu/
Extracted
emotet
Epoch5
178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4256 5076 regsvr32.exe 80 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3432 5076 regsvr32.exe 80 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1444 5076 regsvr32.exe 80 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 448 5076 regsvr32.exe 80 -
Downloads MZ/PE file
-
Loads dropped DLL 6 IoCs
pid Process 4256 regsvr32.exe 1124 regsvr32.exe 3432 regsvr32.exe 4780 regsvr32.exe 1444 regsvr32.exe 3600 regsvr32.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cVuXiVSzMWaYIJ.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\FjOMjsFgGGq\\cVuXiVSzMWaYIJ.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hNbqK.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\BRFeFIUJ\\hNbqK.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HHZluIkag.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\UFHIhsgxZFfIpW\\HHZluIkag.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5076 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4256 regsvr32.exe 4256 regsvr32.exe 1124 regsvr32.exe 1124 regsvr32.exe 3432 regsvr32.exe 3432 regsvr32.exe 1124 regsvr32.exe 1124 regsvr32.exe 4780 regsvr32.exe 4780 regsvr32.exe 1444 regsvr32.exe 1444 regsvr32.exe 4780 regsvr32.exe 4780 regsvr32.exe 3600 regsvr32.exe 3600 regsvr32.exe 3600 regsvr32.exe 3600 regsvr32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 5076 EXCEL.EXE 5076 EXCEL.EXE 5076 EXCEL.EXE 5076 EXCEL.EXE 5076 EXCEL.EXE 5076 EXCEL.EXE 5076 EXCEL.EXE 5076 EXCEL.EXE 5076 EXCEL.EXE 5076 EXCEL.EXE 5076 EXCEL.EXE 5076 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 5076 wrote to memory of 4256 5076 EXCEL.EXE 85 PID 5076 wrote to memory of 4256 5076 EXCEL.EXE 85 PID 4256 wrote to memory of 1124 4256 regsvr32.exe 87 PID 4256 wrote to memory of 1124 4256 regsvr32.exe 87 PID 5076 wrote to memory of 3432 5076 EXCEL.EXE 88 PID 5076 wrote to memory of 3432 5076 EXCEL.EXE 88 PID 3432 wrote to memory of 4780 3432 regsvr32.exe 91 PID 3432 wrote to memory of 4780 3432 regsvr32.exe 91 PID 5076 wrote to memory of 1444 5076 EXCEL.EXE 92 PID 5076 wrote to memory of 1444 5076 EXCEL.EXE 92 PID 1444 wrote to memory of 3600 1444 regsvr32.exe 93 PID 1444 wrote to memory of 3600 1444 regsvr32.exe 93 PID 5076 wrote to memory of 448 5076 EXCEL.EXE 94 PID 5076 wrote to memory of 448 5076 EXCEL.EXE 94
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Documentos-13536.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\UFHIhsgxZFfIpW\HHZluIkag.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1124
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\FjOMjsFgGGq\cVuXiVSzMWaYIJ.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\BRFeFIUJ\hNbqK.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3600
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx2⤵
- Process spawned unexpected child process
PID:448
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434KB
MD5fa53a4050dad7b0d8e0dcf64aabe53ab
SHA14ca215cf558d6c3c7bdbe2235bae570a1ee93c34
SHA25683925232b3a7481d9dfea9dff016ae50071593d7b74bde391eafbc519b7f87b8
SHA512df3ebe6050e5402194ddfaf4559c7acb2c0ee5c644234231c261439b781832100013b04ecccf6c193c1731a19a995863572c5078f6529004180b78ff475c981e
-
Filesize
434KB
MD5fa53a4050dad7b0d8e0dcf64aabe53ab
SHA14ca215cf558d6c3c7bdbe2235bae570a1ee93c34
SHA25683925232b3a7481d9dfea9dff016ae50071593d7b74bde391eafbc519b7f87b8
SHA512df3ebe6050e5402194ddfaf4559c7acb2c0ee5c644234231c261439b781832100013b04ecccf6c193c1731a19a995863572c5078f6529004180b78ff475c981e
-
Filesize
434KB
MD5dbddfa9d95fbdbe57de3263da2ca0628
SHA1f334ddeb7056899162720ea3d3a74c765fb3d04f
SHA25615d50319ab9a9423fdc4acb07f66d67e16bf3dc25005b43927476aa6160c6318
SHA512a5bc5b45bc7078287524a9df91b8fb9eb43079dbbea217044fcfe57f65874dd9afbfa7b7d86b8e46627c22d4a5733687233f9c27c42d09a28fc9bcd1d1410240
-
Filesize
434KB
MD5dbddfa9d95fbdbe57de3263da2ca0628
SHA1f334ddeb7056899162720ea3d3a74c765fb3d04f
SHA25615d50319ab9a9423fdc4acb07f66d67e16bf3dc25005b43927476aa6160c6318
SHA512a5bc5b45bc7078287524a9df91b8fb9eb43079dbbea217044fcfe57f65874dd9afbfa7b7d86b8e46627c22d4a5733687233f9c27c42d09a28fc9bcd1d1410240
-
Filesize
434KB
MD54238b18d847fd21a1eacae8a7e57a43c
SHA1b6f66aabc4eec070af867f51aecb9bb6c5d5dbb8
SHA256c8a33677be039df4a999ab932321a102e08915a1db65e870f0d5210b950c688e
SHA51294ca95419848692ae52f211055f31fda729cc65b55ffadaeb4494134dd2cb2bc02fa7e66126ef6e5f1fca83a36094cb121eab8d5921c481b043095b6ee361f7c
-
Filesize
434KB
MD54238b18d847fd21a1eacae8a7e57a43c
SHA1b6f66aabc4eec070af867f51aecb9bb6c5d5dbb8
SHA256c8a33677be039df4a999ab932321a102e08915a1db65e870f0d5210b950c688e
SHA51294ca95419848692ae52f211055f31fda729cc65b55ffadaeb4494134dd2cb2bc02fa7e66126ef6e5f1fca83a36094cb121eab8d5921c481b043095b6ee361f7c
-
Filesize
434KB
MD54238b18d847fd21a1eacae8a7e57a43c
SHA1b6f66aabc4eec070af867f51aecb9bb6c5d5dbb8
SHA256c8a33677be039df4a999ab932321a102e08915a1db65e870f0d5210b950c688e
SHA51294ca95419848692ae52f211055f31fda729cc65b55ffadaeb4494134dd2cb2bc02fa7e66126ef6e5f1fca83a36094cb121eab8d5921c481b043095b6ee361f7c
-
Filesize
434KB
MD5dbddfa9d95fbdbe57de3263da2ca0628
SHA1f334ddeb7056899162720ea3d3a74c765fb3d04f
SHA25615d50319ab9a9423fdc4acb07f66d67e16bf3dc25005b43927476aa6160c6318
SHA512a5bc5b45bc7078287524a9df91b8fb9eb43079dbbea217044fcfe57f65874dd9afbfa7b7d86b8e46627c22d4a5733687233f9c27c42d09a28fc9bcd1d1410240
-
Filesize
434KB
MD5fa53a4050dad7b0d8e0dcf64aabe53ab
SHA14ca215cf558d6c3c7bdbe2235bae570a1ee93c34
SHA25683925232b3a7481d9dfea9dff016ae50071593d7b74bde391eafbc519b7f87b8
SHA512df3ebe6050e5402194ddfaf4559c7acb2c0ee5c644234231c261439b781832100013b04ecccf6c193c1731a19a995863572c5078f6529004180b78ff475c981e