Analysis
-
max time kernel
136s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2022, 21:11
Behavioral task
behavioral1
Sample
8c3cfdd7e1e162129eedf2c3d9f6f63c133622bfe5d04bccbd823486a85b69ed.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8c3cfdd7e1e162129eedf2c3d9f6f63c133622bfe5d04bccbd823486a85b69ed.xls
Resource
win10v2004-20220901-en
General
-
Target
8c3cfdd7e1e162129eedf2c3d9f6f63c133622bfe5d04bccbd823486a85b69ed.xls
-
Size
255KB
-
MD5
18252d898a785e916760be3e63c29a78
-
SHA1
769301632d80a6c5996e7f9514786e79d044db17
-
SHA256
8c3cfdd7e1e162129eedf2c3d9f6f63c133622bfe5d04bccbd823486a85b69ed
-
SHA512
86507a8d28982194e8cca9e95da98d17fde400393997eeb6df980e1da6549c8cb869ad347a0792423be75c8dcaaeb73df8d6e512bc363140cc06be834d60c775
-
SSDEEP
6144:NKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg9Niwrfx9rNFMMrttRzV5Dz3UxqC8LUcSw:mNbDjP9XH5XIqZLnSw
Malware Config
Extracted
http://www.spinbalence.com/admin3693/Z6WQpmNRNj6041fU2zpt/
http://kabaruntukrakyat.com/wp-content/ES/
https://chobemaster.com/INFECTED/LEdXM4gdwN4mgnlC/
http://cngst.com/data/fXWpDbJ3KwAybE/
Extracted
emotet
Epoch4
45.235.8.30:8080
94.23.45.86:4143
119.59.103.152:8080
169.60.181.70:8080
164.68.99.3:8080
172.105.226.75:8080
107.170.39.149:8080
206.189.28.199:8080
1.234.2.232:8080
188.44.20.25:443
186.194.240.217:443
103.43.75.120:443
149.28.143.92:443
159.89.202.34:443
209.97.163.214:443
183.111.227.137:8080
129.232.188.93:443
139.59.126.41:443
110.232.117.186:8080
139.59.56.73:8080
103.75.201.2:443
91.207.28.33:8080
164.90.222.65:443
197.242.150.244:8080
212.24.98.99:8080
51.161.73.194:443
115.68.227.76:8080
159.65.88.10:8080
201.94.166.162:443
95.217.221.146:8080
173.212.193.249:8080
82.223.21.224:8080
103.132.242.26:8080
213.239.212.5:443
153.126.146.25:7080
45.176.232.124:443
182.162.143.56:443
169.57.156.166:8080
159.65.140.115:443
163.44.196.120:8080
172.104.251.154:8080
167.172.253.162:8080
91.187.140.35:8080
45.118.115.99:8080
147.139.166.154:8080
72.15.201.15:8080
149.56.131.28:8080
167.172.199.165:8080
101.50.0.91:8080
160.16.142.56:8080
185.4.135.165:8080
104.168.155.143:8080
79.137.35.198:8080
5.135.159.50:443
187.63.160.88:80
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4164 2604 regsvr32.exe 75 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3292 2604 regsvr32.exe 75 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4320 2604 regsvr32.exe 75 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1604 2604 regsvr32.exe 75 -
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
pid Process 3292 regsvr32.exe 2128 regsvr32.exe 4320 regsvr32.exe 548 regsvr32.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\anChgjjpqt.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\FvTKpERDRJDGZfORW\\anChgjjpqt.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kUDzZrHQRto.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\YWmAefpE\\kUDzZrHQRto.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2604 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3292 regsvr32.exe 3292 regsvr32.exe 2128 regsvr32.exe 2128 regsvr32.exe 2128 regsvr32.exe 2128 regsvr32.exe 4320 regsvr32.exe 4320 regsvr32.exe 548 regsvr32.exe 548 regsvr32.exe 548 regsvr32.exe 548 regsvr32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2604 EXCEL.EXE 2604 EXCEL.EXE 2604 EXCEL.EXE 2604 EXCEL.EXE 2604 EXCEL.EXE 2604 EXCEL.EXE 2604 EXCEL.EXE 2604 EXCEL.EXE 2604 EXCEL.EXE 2604 EXCEL.EXE 2604 EXCEL.EXE 2604 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2604 wrote to memory of 4164 2604 EXCEL.EXE 81 PID 2604 wrote to memory of 4164 2604 EXCEL.EXE 81 PID 2604 wrote to memory of 3292 2604 EXCEL.EXE 83 PID 2604 wrote to memory of 3292 2604 EXCEL.EXE 83 PID 3292 wrote to memory of 2128 3292 regsvr32.exe 84 PID 3292 wrote to memory of 2128 3292 regsvr32.exe 84 PID 2604 wrote to memory of 4320 2604 EXCEL.EXE 86 PID 2604 wrote to memory of 4320 2604 EXCEL.EXE 86 PID 4320 wrote to memory of 548 4320 regsvr32.exe 89 PID 4320 wrote to memory of 548 4320 regsvr32.exe 89 PID 2604 wrote to memory of 1604 2604 EXCEL.EXE 90 PID 2604 wrote to memory of 1604 2604 EXCEL.EXE 90
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\8c3cfdd7e1e162129eedf2c3d9f6f63c133622bfe5d04bccbd823486a85b69ed.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
PID:4164
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\FvTKpERDRJDGZfORW\anChgjjpqt.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:2128
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\YWmAefpE\kUDzZrHQRto.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:548
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx2⤵
- Process spawned unexpected child process
PID:1604
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
855KB
MD57ac6b0e266cd2d03decde625577137a6
SHA12aa7440da78b51290d3ed95b29ce06fa7c2627ad
SHA25601be3baff5d4760056c3e2ca8ee7c638862bf3e46552f168e5e4576ff6747ed0
SHA5126180e10538b8d6187c6ecde23059cca7ba351c362928504751ae70148b3126d58b6ec18abd1b42b62b303136db0bb2a6e0516c0bb1954dc13e696988fb5763cd
-
Filesize
855KB
MD57ac6b0e266cd2d03decde625577137a6
SHA12aa7440da78b51290d3ed95b29ce06fa7c2627ad
SHA25601be3baff5d4760056c3e2ca8ee7c638862bf3e46552f168e5e4576ff6747ed0
SHA5126180e10538b8d6187c6ecde23059cca7ba351c362928504751ae70148b3126d58b6ec18abd1b42b62b303136db0bb2a6e0516c0bb1954dc13e696988fb5763cd
-
Filesize
575KB
MD541e82dccd7687de38408b2acf54ba3b3
SHA13a2411866f05c8148ebe69fa8ee542bf70d59167
SHA2569efdbe83c874a14282b0105fcec8dc46d9ba1de6496f5d570fa14915b8fd3285
SHA512d20e9eaec301991e3cd125090a5679c19395c8d64fcf7bd710082600b7fee8ce8a8f7af94561f57ece985350bc10f060c18c2aabc37dda5fa413ea687d794e37
-
Filesize
575KB
MD541e82dccd7687de38408b2acf54ba3b3
SHA13a2411866f05c8148ebe69fa8ee542bf70d59167
SHA2569efdbe83c874a14282b0105fcec8dc46d9ba1de6496f5d570fa14915b8fd3285
SHA512d20e9eaec301991e3cd125090a5679c19395c8d64fcf7bd710082600b7fee8ce8a8f7af94561f57ece985350bc10f060c18c2aabc37dda5fa413ea687d794e37
-
Filesize
2KB
MD5d6070bab3f3979868ff300eb3dffc72c
SHA16fa4d73760015589f933674b082281801e73ce0c
SHA2568f89a4c2fccb6aeae7679673c17f1cb797c2867a1304ae7978bd36af31f3a1fa
SHA51251f0dfa5f51c20c75c709c3f3e380187fb09a6b147b38a4785fd08199bc6ec15b68f53a371b6a3d1b57ee7b5752b7c302156cddf15162a0da80ea7d676c494f4
-
Filesize
855KB
MD57ac6b0e266cd2d03decde625577137a6
SHA12aa7440da78b51290d3ed95b29ce06fa7c2627ad
SHA25601be3baff5d4760056c3e2ca8ee7c638862bf3e46552f168e5e4576ff6747ed0
SHA5126180e10538b8d6187c6ecde23059cca7ba351c362928504751ae70148b3126d58b6ec18abd1b42b62b303136db0bb2a6e0516c0bb1954dc13e696988fb5763cd
-
Filesize
575KB
MD541e82dccd7687de38408b2acf54ba3b3
SHA13a2411866f05c8148ebe69fa8ee542bf70d59167
SHA2569efdbe83c874a14282b0105fcec8dc46d9ba1de6496f5d570fa14915b8fd3285
SHA512d20e9eaec301991e3cd125090a5679c19395c8d64fcf7bd710082600b7fee8ce8a8f7af94561f57ece985350bc10f060c18c2aabc37dda5fa413ea687d794e37