Analysis
-
max time kernel
167s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2022, 21:08
Behavioral task
behavioral1
Sample
1011.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1011.xls
Resource
win10v2004-20220812-en
General
-
Target
1011.xls
-
Size
91KB
-
MD5
b48693af83c2d61125983515d08a0fe8
-
SHA1
48d856e08602d0c776f7ba09bcc97e465ccd95b0
-
SHA256
9ccecbe7e6073711ce09ff0208fded0a84c68a5429015bfdbd77c4269830e5e7
-
SHA512
f08577a683d54543585b096643bc487c75470fd5b107b0cf98bb3880d10bc5fb5ac6bcb342aa0f5a6b57c3f451d9bad1ef30b6d06af51884d4fe214b1f076aae
-
SSDEEP
1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgEbCXuZH4gb4CEn9J4ZAEM:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5
Malware Config
Extracted
http://www.muyehuayi.com/cmp/8asA99KPsyA/v6lUsWbLen/
http://concivilpa.com.py/wp-admin/i3CQu9dzDrMW/
https://wijsneusmedia.nl/cgi-bin/kFB/
http://www.angloextrema.com.br/assets/oEt1yYckHKlnNIq/
Extracted
emotet
Epoch5
178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4912 2524 regsvr32.exe 75 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 952 2524 regsvr32.exe 75 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 5044 2524 regsvr32.exe 75 Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2104 2524 regsvr32.exe 75 -
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
pid Process 4912 regsvr32.exe 1576 regsvr32.exe 5044 regsvr32.exe 1908 regsvr32.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CwovR.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\MLVuSZxXCqblsfZtg\\CwovR.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FcZXRJyjZnXAsp.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\GPwRHgxrii\\FcZXRJyjZnXAsp.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2524 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4912 regsvr32.exe 4912 regsvr32.exe 1576 regsvr32.exe 1576 regsvr32.exe 1576 regsvr32.exe 1576 regsvr32.exe 5044 regsvr32.exe 5044 regsvr32.exe 1908 regsvr32.exe 1908 regsvr32.exe 1908 regsvr32.exe 1908 regsvr32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE 2524 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2524 wrote to memory of 4912 2524 EXCEL.EXE 79 PID 2524 wrote to memory of 4912 2524 EXCEL.EXE 79 PID 4912 wrote to memory of 1576 4912 regsvr32.exe 82 PID 4912 wrote to memory of 1576 4912 regsvr32.exe 82 PID 2524 wrote to memory of 952 2524 EXCEL.EXE 83 PID 2524 wrote to memory of 952 2524 EXCEL.EXE 83 PID 2524 wrote to memory of 5044 2524 EXCEL.EXE 85 PID 2524 wrote to memory of 5044 2524 EXCEL.EXE 85 PID 5044 wrote to memory of 1908 5044 regsvr32.exe 87 PID 5044 wrote to memory of 1908 5044 regsvr32.exe 87 PID 2524 wrote to memory of 2104 2524 EXCEL.EXE 91 PID 2524 wrote to memory of 2104 2524 EXCEL.EXE 91
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1011.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\MLVuSZxXCqblsfZtg\CwovR.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1576
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx2⤵
- Process spawned unexpected child process
PID:952
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\GPwRHgxrii\FcZXRJyjZnXAsp.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:1908
-
-
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx2⤵
- Process spawned unexpected child process
PID:2104
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434KB
MD5cd830957a1be40643bf0a74715fe286e
SHA1d5db6bbd3de53d8d6c63ec5af418d803df748565
SHA2566f852b41eaf8690dbe651c12b8b801e5a511bb880641cc8d392dd09139b92fe0
SHA512a6595e7558096046a85b4bd90e0b73a100f9149d9d6c0ba82b0b650b4fd7e110fe257716ccbff7bd3ffab2c9ddd9bfa7aa42776213d147c53609aece084bfe7f
-
Filesize
434KB
MD5cd830957a1be40643bf0a74715fe286e
SHA1d5db6bbd3de53d8d6c63ec5af418d803df748565
SHA2566f852b41eaf8690dbe651c12b8b801e5a511bb880641cc8d392dd09139b92fe0
SHA512a6595e7558096046a85b4bd90e0b73a100f9149d9d6c0ba82b0b650b4fd7e110fe257716ccbff7bd3ffab2c9ddd9bfa7aa42776213d147c53609aece084bfe7f
-
Filesize
434KB
MD5255d978499819af802b0cec0a63fea3c
SHA1e46af8162c290402bc0b4ff8675999cd3353ee83
SHA25626448b5541bb1f7a8a76965381b200bf3f450d36f2b60772de6670ca40f1d3c3
SHA512ec244dfc9a2e20a394ced6769d8bb5ff2136ed627aca31b8f61669e6bcfa5d5cf2b270d2d7eeeb43c2473bb8d2e6ec70dec95fcb20f9d62ff4738e1e0c32fe9c
-
Filesize
434KB
MD5255d978499819af802b0cec0a63fea3c
SHA1e46af8162c290402bc0b4ff8675999cd3353ee83
SHA25626448b5541bb1f7a8a76965381b200bf3f450d36f2b60772de6670ca40f1d3c3
SHA512ec244dfc9a2e20a394ced6769d8bb5ff2136ed627aca31b8f61669e6bcfa5d5cf2b270d2d7eeeb43c2473bb8d2e6ec70dec95fcb20f9d62ff4738e1e0c32fe9c
-
Filesize
434KB
MD5255d978499819af802b0cec0a63fea3c
SHA1e46af8162c290402bc0b4ff8675999cd3353ee83
SHA25626448b5541bb1f7a8a76965381b200bf3f450d36f2b60772de6670ca40f1d3c3
SHA512ec244dfc9a2e20a394ced6769d8bb5ff2136ed627aca31b8f61669e6bcfa5d5cf2b270d2d7eeeb43c2473bb8d2e6ec70dec95fcb20f9d62ff4738e1e0c32fe9c
-
Filesize
434KB
MD5cd830957a1be40643bf0a74715fe286e
SHA1d5db6bbd3de53d8d6c63ec5af418d803df748565
SHA2566f852b41eaf8690dbe651c12b8b801e5a511bb880641cc8d392dd09139b92fe0
SHA512a6595e7558096046a85b4bd90e0b73a100f9149d9d6c0ba82b0b650b4fd7e110fe257716ccbff7bd3ffab2c9ddd9bfa7aa42776213d147c53609aece084bfe7f