Analysis
-
max time kernel
135s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2022, 21:11
Behavioral task
behavioral1
Sample
e41862e6cf7c3206fe699b624046c6d3f7ecd59fce0ddca1aadcc87b30545949.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e41862e6cf7c3206fe699b624046c6d3f7ecd59fce0ddca1aadcc87b30545949.xls
Resource
win10v2004-20220901-en
General
-
Target
e41862e6cf7c3206fe699b624046c6d3f7ecd59fce0ddca1aadcc87b30545949.xls
-
Size
91KB
-
MD5
30c683519923457efd9422b2eb3f2421
-
SHA1
be84a1176ebff85b4790a8fa10cb68c6c8d9c10b
-
SHA256
e41862e6cf7c3206fe699b624046c6d3f7ecd59fce0ddca1aadcc87b30545949
-
SHA512
542784a3fc79a5444d849b5c906765f79dd670b517db86970e9dcaca2f91893cc07f2ee85d1d702419cfa370b0e7edd9432151c30d36da028a58e01445c04192
-
SSDEEP
1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgzbCXuZH4gb4CEn9J4ZIgT:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5
Malware Config
Extracted
http://wordpress.xinmoshiwang.com/list/1N5ty/
http://ftp.appleshipstores.com/admin/8rsSDMyJv31SRdz/
http://onaltiyadokuz.net/wp-snapshots/9Fvr0E6cY/
http://cepasvirtual.com.ar/moodle/Lb4gSXE/
Extracted
emotet
Epoch4
45.235.8.30:8080
94.23.45.86:4143
119.59.103.152:8080
169.60.181.70:8080
164.68.99.3:8080
172.105.226.75:8080
107.170.39.149:8080
206.189.28.199:8080
1.234.2.232:8080
188.44.20.25:443
186.194.240.217:443
103.43.75.120:443
149.28.143.92:443
159.89.202.34:443
209.97.163.214:443
183.111.227.137:8080
129.232.188.93:443
139.59.126.41:443
110.232.117.186:8080
139.59.56.73:8080
103.75.201.2:443
91.207.28.33:8080
164.90.222.65:443
197.242.150.244:8080
212.24.98.99:8080
51.161.73.194:443
115.68.227.76:8080
159.65.88.10:8080
201.94.166.162:443
95.217.221.146:8080
173.212.193.249:8080
82.223.21.224:8080
103.132.242.26:8080
213.239.212.5:443
153.126.146.25:7080
45.176.232.124:443
182.162.143.56:443
169.57.156.166:8080
159.65.140.115:443
163.44.196.120:8080
172.104.251.154:8080
167.172.253.162:8080
91.187.140.35:8080
45.118.115.99:8080
147.139.166.154:8080
72.15.201.15:8080
149.56.131.28:8080
167.172.199.165:8080
101.50.0.91:8080
160.16.142.56:8080
185.4.135.165:8080
104.168.155.143:8080
79.137.35.198:8080
5.135.159.50:443
187.63.160.88:80
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4948 4992 regsvr32.exe 80 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1112 4992 regsvr32.exe 80 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2164 4992 regsvr32.exe 80 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2296 4992 regsvr32.exe 80 -
Downloads MZ/PE file
-
Loads dropped DLL 6 IoCs
pid Process 4948 regsvr32.exe 3056 regsvr32.exe 1112 regsvr32.exe 1352 regsvr32.exe 2296 regsvr32.exe 1836 regsvr32.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YqXVbFjeArSEl.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\JsaBZAYhUN\\YqXVbFjeArSEl.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yimOpOvR.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\HgGOROVvnZWc\\yimOpOvR.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eneeBp.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\RzYOAs\\eneeBp.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4992 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4948 regsvr32.exe 4948 regsvr32.exe 3056 regsvr32.exe 3056 regsvr32.exe 3056 regsvr32.exe 3056 regsvr32.exe 1112 regsvr32.exe 1112 regsvr32.exe 1352 regsvr32.exe 1352 regsvr32.exe 1352 regsvr32.exe 1352 regsvr32.exe 2296 regsvr32.exe 2296 regsvr32.exe 1836 regsvr32.exe 1836 regsvr32.exe 1836 regsvr32.exe 1836 regsvr32.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE 4992 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4992 wrote to memory of 4948 4992 EXCEL.EXE 92 PID 4992 wrote to memory of 4948 4992 EXCEL.EXE 92 PID 4948 wrote to memory of 3056 4948 regsvr32.exe 93 PID 4948 wrote to memory of 3056 4948 regsvr32.exe 93 PID 4992 wrote to memory of 1112 4992 EXCEL.EXE 94 PID 4992 wrote to memory of 1112 4992 EXCEL.EXE 94 PID 4992 wrote to memory of 2164 4992 EXCEL.EXE 95 PID 4992 wrote to memory of 2164 4992 EXCEL.EXE 95 PID 1112 wrote to memory of 1352 1112 regsvr32.exe 96 PID 1112 wrote to memory of 1352 1112 regsvr32.exe 96 PID 4992 wrote to memory of 2296 4992 EXCEL.EXE 97 PID 4992 wrote to memory of 2296 4992 EXCEL.EXE 97 PID 2296 wrote to memory of 1836 2296 regsvr32.exe 98 PID 2296 wrote to memory of 1836 2296 regsvr32.exe 98
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e41862e6cf7c3206fe699b624046c6d3f7ecd59fce0ddca1aadcc87b30545949.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\JsaBZAYhUN\YqXVbFjeArSEl.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3056
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\HgGOROVvnZWc\yimOpOvR.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1352
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx2⤵
- Process spawned unexpected child process
PID:2164
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\RzYOAs\eneeBp.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1836
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
855KB
MD58acc929bb4c9389acc4065a8ef22a2e5
SHA1aa2eb2163e06ceef6d69deba00cf611a4912323e
SHA256a7922c6092d43c146508c4ed25789ed27e4bf24fdc2eb001ea01517f418b504d
SHA512d63eddf4f06acf350999ffcb83802fd7436154412c0a24e327e4609ff36aa9675a30604b5cb45da5708dabc15dcba90090a7c0e87b3c301b2c35abd720ec792d
-
Filesize
855KB
MD58acc929bb4c9389acc4065a8ef22a2e5
SHA1aa2eb2163e06ceef6d69deba00cf611a4912323e
SHA256a7922c6092d43c146508c4ed25789ed27e4bf24fdc2eb001ea01517f418b504d
SHA512d63eddf4f06acf350999ffcb83802fd7436154412c0a24e327e4609ff36aa9675a30604b5cb45da5708dabc15dcba90090a7c0e87b3c301b2c35abd720ec792d
-
Filesize
855KB
MD5f348358f3177a9bcf4e653ceb5282229
SHA1b209971db44f1f6b0fbb0072c4949eb9d6deef7e
SHA2562692e423504370899c4228216e69a6bdb854ececab6f7f60a38d8ace29a196e4
SHA5122fd28637e2957f740a9c50154265b43f82253bcbac7e32c263f589cfb3791a679046db5312cb1ceedf8f67c22d1dca505154f6223af6c33b6ea47caf4a6dfcef
-
Filesize
855KB
MD5f348358f3177a9bcf4e653ceb5282229
SHA1b209971db44f1f6b0fbb0072c4949eb9d6deef7e
SHA2562692e423504370899c4228216e69a6bdb854ececab6f7f60a38d8ace29a196e4
SHA5122fd28637e2957f740a9c50154265b43f82253bcbac7e32c263f589cfb3791a679046db5312cb1ceedf8f67c22d1dca505154f6223af6c33b6ea47caf4a6dfcef
-
Filesize
855KB
MD5068c9d1d3bf5fb2f15924f1fe2c15464
SHA110cfb6d1188d5fc730059481fd23a3b38679ca89
SHA25604c630720447a87da96dd0a065f8c90f48a499720df18055def66ebda14b4d6e
SHA5124c2527966902559370ae85b79d3a6427a8488d0e29322d2d58633df814a7c4ae95c6237143094646325fa422e644ca2785449e70d2fac1df6a3ecd0a3dc01359
-
Filesize
855KB
MD5068c9d1d3bf5fb2f15924f1fe2c15464
SHA110cfb6d1188d5fc730059481fd23a3b38679ca89
SHA25604c630720447a87da96dd0a065f8c90f48a499720df18055def66ebda14b4d6e
SHA5124c2527966902559370ae85b79d3a6427a8488d0e29322d2d58633df814a7c4ae95c6237143094646325fa422e644ca2785449e70d2fac1df6a3ecd0a3dc01359
-
Filesize
855KB
MD5f348358f3177a9bcf4e653ceb5282229
SHA1b209971db44f1f6b0fbb0072c4949eb9d6deef7e
SHA2562692e423504370899c4228216e69a6bdb854ececab6f7f60a38d8ace29a196e4
SHA5122fd28637e2957f740a9c50154265b43f82253bcbac7e32c263f589cfb3791a679046db5312cb1ceedf8f67c22d1dca505154f6223af6c33b6ea47caf4a6dfcef
-
Filesize
855KB
MD58acc929bb4c9389acc4065a8ef22a2e5
SHA1aa2eb2163e06ceef6d69deba00cf611a4912323e
SHA256a7922c6092d43c146508c4ed25789ed27e4bf24fdc2eb001ea01517f418b504d
SHA512d63eddf4f06acf350999ffcb83802fd7436154412c0a24e327e4609ff36aa9675a30604b5cb45da5708dabc15dcba90090a7c0e87b3c301b2c35abd720ec792d
-
Filesize
855KB
MD5068c9d1d3bf5fb2f15924f1fe2c15464
SHA110cfb6d1188d5fc730059481fd23a3b38679ca89
SHA25604c630720447a87da96dd0a065f8c90f48a499720df18055def66ebda14b4d6e
SHA5124c2527966902559370ae85b79d3a6427a8488d0e29322d2d58633df814a7c4ae95c6237143094646325fa422e644ca2785449e70d2fac1df6a3ecd0a3dc01359