Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10/11/2022, 10:33

General

  • Target

    0a8ddb6313292d0c7ce3f8c6336d8b960f855bb50b5a1a34619682e0bccc2497.xls

  • Size

    91KB

  • MD5

    b834d1385caf6e1927cceaf2bde310ae

  • SHA1

    7f9e374f51f36f528f9536cf677d4785923c01bb

  • SHA256

    0a8ddb6313292d0c7ce3f8c6336d8b960f855bb50b5a1a34619682e0bccc2497

  • SHA512

    bdbd1c504860d14fcb05cb892338cf015aebe4e07a2f4ea61a0923353a322cc32ade97abe12f13cf102704f71f03e3fdf9b6ee5c2562bc21bb1c575f88c1b42f

  • SSDEEP

    1536:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgqbCXuZH4gb4CEn9J4ZXz3:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgu

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.conceptagency.net/css/b8eaKN/

xlm40.dropper

https://bencevendeghaz.hu/2zjoi/cwfKJOzA/

xlm40.dropper

http://45.32.114.141/xilte/Uqm6Eysf3Hkjwh/

xlm40.dropper

http://ruitaiwz.com/wp-admin/MXlp5IsUKwT1k0DtzT/

Extracted

Family

emotet

Botnet

Epoch5

C2

202.28.34.99:8080

80.211.107.116:8080

175.126.176.79:8080

218.38.121.17:443

139.196.72.155:8080

103.71.99.57:8080

87.106.97.83:7080

178.62.112.199:8080

64.227.55.231:8080

46.101.98.60:8080

54.37.228.122:443

128.199.217.206:443

190.145.8.4:443

209.239.112.82:8080

85.214.67.203:8080

198.199.70.22:8080

128.199.242.164:8080

178.238.225.252:8080

103.85.95.4:8080

103.126.216.86:443

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 4 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0a8ddb6313292d0c7ce3f8c6336d8b960f855bb50b5a1a34619682e0bccc2497.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3664
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FzemTQqqW\qWQxStM.dll"
        3⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:4356
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3536
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SgWxBJuxRnchHOpo\jGSCkVwt.dll"
        3⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:4460
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      PID:300
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:768
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GlBqOEuGi\EwLNHjcZ.dll"
        3⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:204

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\elv1.ooocccxxx

          Filesize

          621KB

          MD5

          287abecca3fd35d9f3ed53f4f7377c7e

          SHA1

          4d1693f6b31d926633e8a7e349fee96c4e60120b

          SHA256

          6426c9c4829f9e4ec0ce794317153e46cb6b74050b74197c9a588fa7d3de679c

          SHA512

          348f77291ee436dcf5e0de2da792b1d9e6c0daf1fb925122ed06984bf14f21d909b14dd6d3096fc229143c2d2562f1f57ea159db9d4f4ec717602943780ab385

        • C:\Users\Admin\elv2.ooocccxxx

          Filesize

          621KB

          MD5

          e13fecff6dc982531324cdba4f224d1d

          SHA1

          0de9ca7b8770ce588684237d2739d456bc64dade

          SHA256

          78b7f834255ee4c7e897393c70172de692415c784bcaeedf1cd304fe1ce401e0

          SHA512

          0e159d00676d286d104631f80a1989e308037fde82ddae495628866a1ad49059705fb9c47d7f612a108bbbb0d3f540695782dec3c4b389a56c4ac91a28a8653b

        • C:\Users\Admin\elv4.ooocccxxx

          Filesize

          621KB

          MD5

          d116dbcd3054af5ebab5374c82d51952

          SHA1

          3c84bc88251a196328d46f61051fd78c31db4a1d

          SHA256

          292a2fd7687179531f2c92eb70c3399f1100450689ba338f5be57ab8bee176f8

          SHA512

          d907482458586b1bba5bfe4792dec2d7932a8034eb1bcdc765407beda481a9f50a8aca775222be128cf92eb9ccb3fae5e223876e9d4571fcbcb795ad26df7ace

        • \Users\Admin\elv1.ooocccxxx

          Filesize

          621KB

          MD5

          287abecca3fd35d9f3ed53f4f7377c7e

          SHA1

          4d1693f6b31d926633e8a7e349fee96c4e60120b

          SHA256

          6426c9c4829f9e4ec0ce794317153e46cb6b74050b74197c9a588fa7d3de679c

          SHA512

          348f77291ee436dcf5e0de2da792b1d9e6c0daf1fb925122ed06984bf14f21d909b14dd6d3096fc229143c2d2562f1f57ea159db9d4f4ec717602943780ab385

        • \Users\Admin\elv2.ooocccxxx

          Filesize

          621KB

          MD5

          e13fecff6dc982531324cdba4f224d1d

          SHA1

          0de9ca7b8770ce588684237d2739d456bc64dade

          SHA256

          78b7f834255ee4c7e897393c70172de692415c784bcaeedf1cd304fe1ce401e0

          SHA512

          0e159d00676d286d104631f80a1989e308037fde82ddae495628866a1ad49059705fb9c47d7f612a108bbbb0d3f540695782dec3c4b389a56c4ac91a28a8653b

        • \Users\Admin\elv4.ooocccxxx

          Filesize

          621KB

          MD5

          d116dbcd3054af5ebab5374c82d51952

          SHA1

          3c84bc88251a196328d46f61051fd78c31db4a1d

          SHA256

          292a2fd7687179531f2c92eb70c3399f1100450689ba338f5be57ab8bee176f8

          SHA512

          d907482458586b1bba5bfe4792dec2d7932a8034eb1bcdc765407beda481a9f50a8aca775222be128cf92eb9ccb3fae5e223876e9d4571fcbcb795ad26df7ace

        • memory/3664-265-0x00000000028D0000-0x00000000028FE000-memory.dmp

          Filesize

          184KB

        • memory/3668-342-0x00007FFE31BE0000-0x00007FFE31BF0000-memory.dmp

          Filesize

          64KB

        • memory/3668-120-0x00007FFE31BE0000-0x00007FFE31BF0000-memory.dmp

          Filesize

          64KB

        • memory/3668-341-0x00007FFE31BE0000-0x00007FFE31BF0000-memory.dmp

          Filesize

          64KB

        • memory/3668-121-0x00007FFE31BE0000-0x00007FFE31BF0000-memory.dmp

          Filesize

          64KB

        • memory/3668-130-0x00007FFE2EE10000-0x00007FFE2EE20000-memory.dmp

          Filesize

          64KB

        • memory/3668-119-0x00007FFE31BE0000-0x00007FFE31BF0000-memory.dmp

          Filesize

          64KB

        • memory/3668-118-0x00007FFE31BE0000-0x00007FFE31BF0000-memory.dmp

          Filesize

          64KB

        • memory/3668-131-0x00007FFE2EE10000-0x00007FFE2EE20000-memory.dmp

          Filesize

          64KB

        • memory/3668-339-0x00007FFE31BE0000-0x00007FFE31BF0000-memory.dmp

          Filesize

          64KB

        • memory/3668-340-0x00007FFE31BE0000-0x00007FFE31BF0000-memory.dmp

          Filesize

          64KB