Malware Analysis Report

2025-08-05 21:39

Sample ID 221110-mb8kpaghh5
Target 13f68c4c239feea0c573576927896f3d7dc0372b39155681f47bd9a688c21be0.xls
SHA256 13f68c4c239feea0c573576927896f3d7dc0372b39155681f47bd9a688c21be0
Tags
macro xlm emotet epoch5 banker persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

13f68c4c239feea0c573576927896f3d7dc0372b39155681f47bd9a688c21be0

Threat Level: Known bad

The file 13f68c4c239feea0c573576927896f3d7dc0372b39155681f47bd9a688c21be0.xls was found to be: Known bad.

Malicious Activity Summary

macro xlm emotet epoch5 banker persistence trojan

Process spawned unexpected child process

Emotet

Suspicious Office macro

Downloads MZ/PE file

Loads dropped DLL

Adds Run key to start application

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Checks processor information in registry

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-10 10:18

Signatures

Suspicious Office macro

macro xlm
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-10 10:18

Reported

2022-11-10 10:21

Platform

win10-20220812-en

Max time kernel

128s

Max time network

131s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\13f68c4c239feea0c573576927896f3d7dc0372b39155681f47bd9a688c21be0.xls"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\13f68c4c239feea0c573576927896f3d7dc0372b39155681f47bd9a688c21be0.xls"

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.conceptagency.net udp
N/A 100.106.72.246:443 www.conceptagency.net tcp
US 8.8.8.8:53 bencevendeghaz.hu udp
N/A 100.90.145.196:443 bencevendeghaz.hu tcp
SG 45.32.114.141:80 45.32.114.141 tcp
US 8.8.8.8:53 ruitaiwz.com udp
N/A 100.121.57.194:80 ruitaiwz.com tcp
US 20.42.73.25:443 tcp

Files

memory/3084-118-0x00007FFEC81E0000-0x00007FFEC81F0000-memory.dmp

memory/3084-119-0x00007FFEC81E0000-0x00007FFEC81F0000-memory.dmp

memory/3084-120-0x00007FFEC81E0000-0x00007FFEC81F0000-memory.dmp

memory/3084-121-0x00007FFEC81E0000-0x00007FFEC81F0000-memory.dmp

memory/3084-130-0x00007FFEC4670000-0x00007FFEC4680000-memory.dmp

memory/3084-131-0x00007FFEC4670000-0x00007FFEC4680000-memory.dmp

memory/4592-254-0x0000000000000000-mapping.dmp

memory/4916-257-0x0000000000000000-mapping.dmp

memory/3204-258-0x0000000000000000-mapping.dmp

memory/2924-259-0x0000000000000000-mapping.dmp

memory/3084-296-0x00007FFEC81E0000-0x00007FFEC81F0000-memory.dmp

memory/3084-297-0x00007FFEC81E0000-0x00007FFEC81F0000-memory.dmp

memory/3084-298-0x00007FFEC81E0000-0x00007FFEC81F0000-memory.dmp

memory/3084-299-0x00007FFEC81E0000-0x00007FFEC81F0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-10 10:18

Reported

2022-11-10 10:21

Platform

win10-20220901-en

Max time kernel

149s

Max time network

128s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\13f68c4c239feea0c573576927896f3d7dc0372b39155681f47bd9a688c21be0.xls"

Signatures

Emotet

trojan banker emotet

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\System32\regsvr32.exe N/A
N/A N/A C:\Windows\System32\regsvr32.exe N/A
N/A N/A C:\Windows\System32\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BkCvePPPXn.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\ARIzsIqD\\BkCvePPPXn.dll\"" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LVZiNGR.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\MgBXVTr\\LVZiNGR.dll\"" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vefjCdHkZyWHiBOH.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\KNzCuynK\\vefjCdHkZyWHiBOH.dll\"" C:\Windows\system32\regsvr32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2844 wrote to memory of 4420 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 2844 wrote to memory of 4420 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 4420 wrote to memory of 5040 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 4420 wrote to memory of 5040 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2844 wrote to memory of 5056 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 2844 wrote to memory of 5056 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 5056 wrote to memory of 3192 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 5056 wrote to memory of 3192 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2844 wrote to memory of 3216 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 2844 wrote to memory of 3216 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 2844 wrote to memory of 3188 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 2844 wrote to memory of 3188 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 3188 wrote to memory of 1280 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 3188 wrote to memory of 1280 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\13f68c4c239feea0c573576927896f3d7dc0372b39155681f47bd9a688c21be0.xls"

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ARIzsIqD\BkCvePPPXn.dll"

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MgBXVTr\LVZiNGR.dll"

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KNzCuynK\vefjCdHkZyWHiBOH.dll"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.conceptagency.net udp
DE 149.102.137.213:443 www.conceptagency.net tcp
US 8.8.8.8:53 bencevendeghaz.hu udp
HU 185.6.139.30:443 bencevendeghaz.hu tcp
SG 45.32.114.141:80 tcp
US 8.8.8.8:53 ruitaiwz.com udp
HK 45.207.116.84:80 ruitaiwz.com tcp
ID 115.178.55.22:80 115.178.55.22 tcp
ID 115.178.55.22:80 115.178.55.22 tcp
ID 115.178.55.22:80 115.178.55.22 tcp

Files

memory/2844-120-0x00007FFA36200000-0x00007FFA36210000-memory.dmp

memory/2844-121-0x00007FFA36200000-0x00007FFA36210000-memory.dmp

memory/2844-122-0x00007FFA36200000-0x00007FFA36210000-memory.dmp

memory/2844-123-0x00007FFA36200000-0x00007FFA36210000-memory.dmp

memory/2844-132-0x00007FFA33610000-0x00007FFA33620000-memory.dmp

memory/2844-133-0x00007FFA33610000-0x00007FFA33620000-memory.dmp

memory/4420-264-0x0000000000000000-mapping.dmp

C:\Users\Admin\elv1.ooocccxxx

MD5 891dbf17514702654a1e1490b782b4f5
SHA1 25f461d22c60463fccce3b50ba2f7897b365bd7f
SHA256 8c6e241c2225590830b2185cb9956266cc8ff8726784149239b972ad6d92f889
SHA512 2278574cc9c1400f7a4d333ed3fa25c2a99d66da2e7008c96f83c39a53d7fcff42856bdd3bdff881fc10ea679c9b0126b128905c0c8921b0657760dc9d3eb51d

\Users\Admin\elv1.ooocccxxx

MD5 891dbf17514702654a1e1490b782b4f5
SHA1 25f461d22c60463fccce3b50ba2f7897b365bd7f
SHA256 8c6e241c2225590830b2185cb9956266cc8ff8726784149239b972ad6d92f889
SHA512 2278574cc9c1400f7a4d333ed3fa25c2a99d66da2e7008c96f83c39a53d7fcff42856bdd3bdff881fc10ea679c9b0126b128905c0c8921b0657760dc9d3eb51d

memory/5040-277-0x0000000000000000-mapping.dmp

memory/5040-278-0x0000000002690000-0x00000000026BE000-memory.dmp

memory/5056-283-0x0000000000000000-mapping.dmp

C:\Users\Admin\elv2.ooocccxxx

MD5 e13fecff6dc982531324cdba4f224d1d
SHA1 0de9ca7b8770ce588684237d2739d456bc64dade
SHA256 78b7f834255ee4c7e897393c70172de692415c784bcaeedf1cd304fe1ce401e0
SHA512 0e159d00676d286d104631f80a1989e308037fde82ddae495628866a1ad49059705fb9c47d7f612a108bbbb0d3f540695782dec3c4b389a56c4ac91a28a8653b

\Users\Admin\elv2.ooocccxxx

MD5 e13fecff6dc982531324cdba4f224d1d
SHA1 0de9ca7b8770ce588684237d2739d456bc64dade
SHA256 78b7f834255ee4c7e897393c70172de692415c784bcaeedf1cd304fe1ce401e0
SHA512 0e159d00676d286d104631f80a1989e308037fde82ddae495628866a1ad49059705fb9c47d7f612a108bbbb0d3f540695782dec3c4b389a56c4ac91a28a8653b

memory/3192-294-0x0000000000000000-mapping.dmp

memory/3216-302-0x0000000000000000-mapping.dmp

memory/3188-303-0x0000000000000000-mapping.dmp

C:\Users\Admin\elv4.ooocccxxx

MD5 2a7a2129f4168bd8222c32306fd61ecb
SHA1 a1db1cd6719524903bca3c1e30ab66caf55fd16a
SHA256 66d37963e4becf5ed89f49706e6af402ba2df646f8cd99b11cd045dffb8cd2d3
SHA512 cca2cffbed6971e53b2afb3e547136b53c35232aef5eb45751a80d6fc3ebf8a098e6a154e74ed46ea346e2a59345ff036af8a5488cf9fd80c7f46e11ba39f3c7

\Users\Admin\elv4.ooocccxxx

MD5 2a7a2129f4168bd8222c32306fd61ecb
SHA1 a1db1cd6719524903bca3c1e30ab66caf55fd16a
SHA256 66d37963e4becf5ed89f49706e6af402ba2df646f8cd99b11cd045dffb8cd2d3
SHA512 cca2cffbed6971e53b2afb3e547136b53c35232aef5eb45751a80d6fc3ebf8a098e6a154e74ed46ea346e2a59345ff036af8a5488cf9fd80c7f46e11ba39f3c7

memory/1280-311-0x0000000000000000-mapping.dmp