Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2022, 20:40

General

  • Target

    6793069168.xls

  • Size

    91KB

  • MD5

    ddac0db84411f8fcf87cd2a1c44ed1c5

  • SHA1

    0a81ceb1e0944f31783ac2b896f2b1ed8fc9361c

  • SHA256

    c7c69086d0d6a38719e5e163fb602ddadb4aefb83165254e401c9aaeeb8b3a39

  • SHA512

    4cf15bf49d65a1996fd9d33478de7a219c148702f0d6457873ede20968dcddca06b28fdfdd0d4c6078cb73e3e7bc8bdd69718a0cfecca682f66779c5bc64073c

  • SSDEEP

    1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2bCXuZH4gb4CEn9J4ZWcvp:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg+

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://bundlefilm.com/headers/lkfBH3Czw9CjEW07P2/

xlm40.dropper

http://camsanparke.net/wp-content/h2Ja5bwB03hnyfCb/

xlm40.dropper

http://royreid.co.uk/wp-content/dCwG/

xlm40.dropper

https://cs.com.sg/admin/a1lR5wu/

Extracted

Family

emotet

Botnet

Epoch5

C2

178.238.225.252:8080

139.196.72.155:8080

36.67.23.59:443

103.56.149.105:8080

37.44.244.177:8080

85.25.120.45:8080

202.134.4.210:7080

78.47.204.80:443

83.229.80.93:8080

93.104.209.107:8080

80.211.107.116:8080

165.22.254.236:8080

104.244.79.94:443

185.148.169.10:8080

190.145.8.4:443

175.126.176.79:8080

139.59.80.108:8080

188.165.79.151:443

128.199.217.206:443

64.227.55.231:8080

ecs1.plain
eck1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 4 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\6793069168.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\system32\regsvr32.exe
        /S ..\elv1.ooocccxxx
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1364
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VAfTcuBsIy\VsjLEEVynD.dll"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1616
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\system32\regsvr32.exe
        /S ..\elv2.ooocccxxx
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1512
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\XAFNYAyjfisoALC\mKCczX.dll"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1172
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      PID:1620
    • C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      PID:1176

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\elv1.ooocccxxx

          Filesize

          434KB

          MD5

          1d5c6195d7eca70daf9ad820f617e6aa

          SHA1

          7de468c3d859198f0499887ffff2030bd0b9b373

          SHA256

          557ca74c3692d5ea96b9a6fc1e02f94fdc3436b69cac95d064cff657f28aa492

          SHA512

          b22e58b8671b226fa36c252d4d57274d8ff8291e5f0b720f7c7db9597660e0b75ae53b320dc4e16805d78b74658bad37811a351cfce85c643adc888c1ad5b2ed

        • C:\Users\Admin\elv2.ooocccxxx

          Filesize

          434KB

          MD5

          f5662aab0fda767b05680f36cb5ceb8a

          SHA1

          0b9697773da71cfe1bf120d414095a68164970b6

          SHA256

          e437128ce20e5d2e4589c5639369c095a5f3db8bf8c155309eec549a2b75ea97

          SHA512

          3b2dc24551451483dfa0d24ec9d85db6b7716494e4f84ba96a5dad82be26a283cc3394a9beb7b34e56017e72d805edffbf9b773771abe7014866b4dd887d6192

        • \Users\Admin\elv1.ooocccxxx

          Filesize

          434KB

          MD5

          1d5c6195d7eca70daf9ad820f617e6aa

          SHA1

          7de468c3d859198f0499887ffff2030bd0b9b373

          SHA256

          557ca74c3692d5ea96b9a6fc1e02f94fdc3436b69cac95d064cff657f28aa492

          SHA512

          b22e58b8671b226fa36c252d4d57274d8ff8291e5f0b720f7c7db9597660e0b75ae53b320dc4e16805d78b74658bad37811a351cfce85c643adc888c1ad5b2ed

        • \Users\Admin\elv1.ooocccxxx

          Filesize

          434KB

          MD5

          1d5c6195d7eca70daf9ad820f617e6aa

          SHA1

          7de468c3d859198f0499887ffff2030bd0b9b373

          SHA256

          557ca74c3692d5ea96b9a6fc1e02f94fdc3436b69cac95d064cff657f28aa492

          SHA512

          b22e58b8671b226fa36c252d4d57274d8ff8291e5f0b720f7c7db9597660e0b75ae53b320dc4e16805d78b74658bad37811a351cfce85c643adc888c1ad5b2ed

        • \Users\Admin\elv2.ooocccxxx

          Filesize

          434KB

          MD5

          f5662aab0fda767b05680f36cb5ceb8a

          SHA1

          0b9697773da71cfe1bf120d414095a68164970b6

          SHA256

          e437128ce20e5d2e4589c5639369c095a5f3db8bf8c155309eec549a2b75ea97

          SHA512

          3b2dc24551451483dfa0d24ec9d85db6b7716494e4f84ba96a5dad82be26a283cc3394a9beb7b34e56017e72d805edffbf9b773771abe7014866b4dd887d6192

        • \Users\Admin\elv2.ooocccxxx

          Filesize

          434KB

          MD5

          f5662aab0fda767b05680f36cb5ceb8a

          SHA1

          0b9697773da71cfe1bf120d414095a68164970b6

          SHA256

          e437128ce20e5d2e4589c5639369c095a5f3db8bf8c155309eec549a2b75ea97

          SHA512

          3b2dc24551451483dfa0d24ec9d85db6b7716494e4f84ba96a5dad82be26a283cc3394a9beb7b34e56017e72d805edffbf9b773771abe7014866b4dd887d6192

        • memory/1364-64-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

          Filesize

          8KB

        • memory/1364-66-0x0000000180000000-0x0000000180030000-memory.dmp

          Filesize

          192KB

        • memory/1716-54-0x000000002F501000-0x000000002F504000-memory.dmp

          Filesize

          12KB

        • memory/1716-69-0x00000000726ED000-0x00000000726F8000-memory.dmp

          Filesize

          44KB

        • memory/1716-55-0x0000000071701000-0x0000000071703000-memory.dmp

          Filesize

          8KB

        • memory/1716-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/1716-57-0x00000000726ED000-0x00000000726F8000-memory.dmp

          Filesize

          44KB

        • memory/1716-58-0x00000000765B1000-0x00000000765B3000-memory.dmp

          Filesize

          8KB