Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2022 01:44
Behavioral task
behavioral1
Sample
FILE_79431044.xlsm
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
FILE_79431044.xlsm
Resource
win10v2004-20220812-en
General
-
Target
FILE_79431044.xlsm
-
Size
228KB
-
MD5
b9dd57a79aaa1a8ff03b3c482abbf204
-
SHA1
0816d70a7be2e6c77a45c406f6051701a39f68d5
-
SHA256
74a77b0770be378c8faadbeb90fe614ae8a90b870af0695996b9cc5b3cf10c8e
-
SHA512
a2491c04004f65a41ea4fb55f98d703b628b8b6dd106a81c8e73becbf7df2d7ddf482f79ad815bd0ccad7af84e16446a8d53f76521dcaf4880898968bb3ee5b3
-
SSDEEP
6144:hR2WMrfxxjhBMMrxBRXZ5Dz3M1qa8L4cyU:hR2LDHf9PH5XUqRLTyU
Malware Config
Extracted
https://bencevendeghaz.hu/2zjoi/aUJLqwAxxlq/
http://ftp.agoraexpress.info/cgi-bin/rooSQD2tWB/
http://45.32.114.141/xilte/SYtPsYVOaJpNvcqVTOi/
http://www.nipunpharmaskill.com/fonts/jHAVDcbRKKHP24FAf/
Extracted
emotet
Epoch5
178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1244 1644 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4520 1644 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2300 1644 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2232 1644 regsvr32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 2232 regsvr32.exe 1588 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pkApD.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\FzZbSlWq\\pkApD.dll\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1644 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 2232 regsvr32.exe 2232 regsvr32.exe 1588 regsvr32.exe 1588 regsvr32.exe 1588 regsvr32.exe 1588 regsvr32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE 1644 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
EXCEL.EXEregsvr32.exedescription pid process target process PID 1644 wrote to memory of 1244 1644 EXCEL.EXE regsvr32.exe PID 1644 wrote to memory of 1244 1644 EXCEL.EXE regsvr32.exe PID 1644 wrote to memory of 4520 1644 EXCEL.EXE regsvr32.exe PID 1644 wrote to memory of 4520 1644 EXCEL.EXE regsvr32.exe PID 1644 wrote to memory of 2300 1644 EXCEL.EXE regsvr32.exe PID 1644 wrote to memory of 2300 1644 EXCEL.EXE regsvr32.exe PID 1644 wrote to memory of 2232 1644 EXCEL.EXE regsvr32.exe PID 1644 wrote to memory of 2232 1644 EXCEL.EXE regsvr32.exe PID 2232 wrote to memory of 1588 2232 regsvr32.exe regsvr32.exe PID 2232 wrote to memory of 1588 2232 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\FILE_79431044.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\FzZbSlWq\pkApD.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\oxnv2.ooccxxFilesize
1KB
MD5f184d55a54eae149f306684766cdee7a
SHA1d3f640f50591aa8523a8caff9d278abf96840781
SHA2566c7fd4878ef23fdd99f03af133480bdf349f2ba1c71ea6a7eff67bd5f420e48b
SHA512d5f4277db836a419c12bb43cf96eef683b6104e92fabf2b37631e46b03ee80c8dbfd6167d72a945287dc4a6bc54c8896185701e14407631db03b9348a1112241
-
C:\Users\Admin\oxnv4.ooccxxFilesize
579KB
MD5bf9ac1c60cae203dfc4ea5293fcb24bd
SHA16dd8677031ad96da4520f3fb35ca0c59b9375997
SHA25625b209a3fc13d714ab325fd4fa976a5115f98655c0d3932225aa245fa48a28ae
SHA5121703a0a7d91127acd3778fb7b4f54ad6b748c323163e97eb08704ad38f07ff2de5ab59b2b1dacdea7070c51ee604d5055c635a9b9a5efc1a24268c0d00f023ac
-
C:\Users\Admin\oxnv4.ooccxxFilesize
579KB
MD5bf9ac1c60cae203dfc4ea5293fcb24bd
SHA16dd8677031ad96da4520f3fb35ca0c59b9375997
SHA25625b209a3fc13d714ab325fd4fa976a5115f98655c0d3932225aa245fa48a28ae
SHA5121703a0a7d91127acd3778fb7b4f54ad6b748c323163e97eb08704ad38f07ff2de5ab59b2b1dacdea7070c51ee604d5055c635a9b9a5efc1a24268c0d00f023ac
-
C:\Windows\System32\FzZbSlWq\pkApD.dllFilesize
579KB
MD5bf9ac1c60cae203dfc4ea5293fcb24bd
SHA16dd8677031ad96da4520f3fb35ca0c59b9375997
SHA25625b209a3fc13d714ab325fd4fa976a5115f98655c0d3932225aa245fa48a28ae
SHA5121703a0a7d91127acd3778fb7b4f54ad6b748c323163e97eb08704ad38f07ff2de5ab59b2b1dacdea7070c51ee604d5055c635a9b9a5efc1a24268c0d00f023ac
-
memory/1244-139-0x0000000000000000-mapping.dmp
-
memory/1588-149-0x0000000000000000-mapping.dmp
-
memory/1644-136-0x00007FFD677B0000-0x00007FFD677C0000-memory.dmpFilesize
64KB
-
memory/1644-138-0x00007FFD656B0000-0x00007FFD656C0000-memory.dmpFilesize
64KB
-
memory/1644-137-0x00007FFD656B0000-0x00007FFD656C0000-memory.dmpFilesize
64KB
-
memory/1644-132-0x00007FFD677B0000-0x00007FFD677C0000-memory.dmpFilesize
64KB
-
memory/1644-135-0x00007FFD677B0000-0x00007FFD677C0000-memory.dmpFilesize
64KB
-
memory/1644-134-0x00007FFD677B0000-0x00007FFD677C0000-memory.dmpFilesize
64KB
-
memory/1644-133-0x00007FFD677B0000-0x00007FFD677C0000-memory.dmpFilesize
64KB
-
memory/2232-143-0x0000000000000000-mapping.dmp
-
memory/2232-146-0x0000000180000000-0x0000000180030000-memory.dmpFilesize
192KB
-
memory/2300-142-0x0000000000000000-mapping.dmp
-
memory/4520-140-0x0000000000000000-mapping.dmp