Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2022 02:56
Behavioral task
behavioral1
Sample
72587_120600.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
72587_120600.xls
Resource
win10v2004-20220812-en
General
-
Target
72587_120600.xls
-
Size
91KB
-
MD5
3b7c1af004581e0081622da0aa1e7bb1
-
SHA1
200b021751f34af2f7d571b18d22127573caad2d
-
SHA256
22b930d5b30553606c6dc4e340eff495ae3fdf7297e2b8bab9af3296f24b14c7
-
SHA512
dab54cac66c6a95f19f1abe4c9f1d779007c95abd59d61a12a0a8147497bf752ad9b698a123d197c706eb18baa794b09adbf965912f3079ffacce9d16e3f6324
-
SSDEEP
1536:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgObCXuZH4gb4CEn9J4Z70O:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgu
Malware Config
Extracted
http://bevos-training.com/images/MtzUd/
http://ec2-52-89-237-150.us-west-2.compute.amazonaws.com/bhr/wwqjkbu6mk/
http://bwsengineering.co.za/configSHV/H0Rs/
http://ctel.com.my/images/J5FV3DsngleQ3/
Extracted
emotet
Epoch5
202.28.34.99:8080
80.211.107.116:8080
175.126.176.79:8080
218.38.121.17:443
139.196.72.155:8080
103.71.99.57:8080
87.106.97.83:7080
178.62.112.199:8080
64.227.55.231:8080
46.101.98.60:8080
54.37.228.122:443
128.199.217.206:443
190.145.8.4:443
209.239.112.82:8080
85.214.67.203:8080
198.199.70.22:8080
128.199.242.164:8080
178.238.225.252:8080
103.85.95.4:8080
103.126.216.86:443
104.244.79.94:443
36.67.23.59:443
37.44.244.177:8080
160.16.143.191:8080
85.25.120.45:8080
103.56.149.105:8080
210.57.209.142:8080
195.77.239.39:8080
62.171.178.147:8080
118.98.72.86:443
103.224.241.74:8080
185.148.169.10:8080
103.41.204.169:8080
186.250.48.5:443
165.22.254.236:8080
93.104.209.107:8080
139.59.80.108:8080
196.44.98.190:8080
114.79.130.68:443
115.178.55.22:80
103.254.12.236:7080
172.105.115.71:8080
174.138.33.49:7080
51.75.33.122:443
83.229.80.93:8080
78.47.204.80:443
188.165.79.151:443
202.134.4.210:7080
82.98.180.154:7080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1888 5100 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3692 5100 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4380 5100 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 380 5100 regsvr32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 4380 regsvr32.exe 1204 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KKSwQ.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\HdScM\\KKSwQ.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 5100 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 4380 regsvr32.exe 4380 regsvr32.exe 1204 regsvr32.exe 1204 regsvr32.exe 1204 regsvr32.exe 1204 regsvr32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 5100 EXCEL.EXE 5100 EXCEL.EXE 5100 EXCEL.EXE 5100 EXCEL.EXE 5100 EXCEL.EXE 5100 EXCEL.EXE 5100 EXCEL.EXE 5100 EXCEL.EXE 5100 EXCEL.EXE 5100 EXCEL.EXE 5100 EXCEL.EXE 5100 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
EXCEL.EXEregsvr32.exedescription pid process target process PID 5100 wrote to memory of 1888 5100 EXCEL.EXE regsvr32.exe PID 5100 wrote to memory of 1888 5100 EXCEL.EXE regsvr32.exe PID 5100 wrote to memory of 3692 5100 EXCEL.EXE regsvr32.exe PID 5100 wrote to memory of 3692 5100 EXCEL.EXE regsvr32.exe PID 5100 wrote to memory of 4380 5100 EXCEL.EXE regsvr32.exe PID 5100 wrote to memory of 4380 5100 EXCEL.EXE regsvr32.exe PID 4380 wrote to memory of 1204 4380 regsvr32.exe regsvr32.exe PID 4380 wrote to memory of 1204 4380 regsvr32.exe regsvr32.exe PID 5100 wrote to memory of 380 5100 EXCEL.EXE regsvr32.exe PID 5100 wrote to memory of 380 5100 EXCEL.EXE regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\72587_120600.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\HdScM\KKSwQ.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\elv3.ooocccxxxFilesize
621KB
MD53aae4a9d4f5d015042ae34f813ae8129
SHA16f0216c9f7953fc97f4a8195906645634dce6729
SHA256b88577b3d9a051360d05f5953ad9dc045d9b2acaec898620969751363fab5bf4
SHA512b5286efd17951372359b22fc92d8e9d269194ad9333ce7e3c1a474cc281ab706f40c2b6713a656db88d4eb7871268c8e7ca23396c175d548a77cc10e3b0213dd
-
C:\Users\Admin\elv3.ooocccxxxFilesize
621KB
MD53aae4a9d4f5d015042ae34f813ae8129
SHA16f0216c9f7953fc97f4a8195906645634dce6729
SHA256b88577b3d9a051360d05f5953ad9dc045d9b2acaec898620969751363fab5bf4
SHA512b5286efd17951372359b22fc92d8e9d269194ad9333ce7e3c1a474cc281ab706f40c2b6713a656db88d4eb7871268c8e7ca23396c175d548a77cc10e3b0213dd
-
C:\Windows\System32\HdScM\KKSwQ.dllFilesize
621KB
MD53aae4a9d4f5d015042ae34f813ae8129
SHA16f0216c9f7953fc97f4a8195906645634dce6729
SHA256b88577b3d9a051360d05f5953ad9dc045d9b2acaec898620969751363fab5bf4
SHA512b5286efd17951372359b22fc92d8e9d269194ad9333ce7e3c1a474cc281ab706f40c2b6713a656db88d4eb7871268c8e7ca23396c175d548a77cc10e3b0213dd
-
memory/380-152-0x0000000000000000-mapping.dmp
-
memory/1204-147-0x0000000000000000-mapping.dmp
-
memory/1888-139-0x0000000000000000-mapping.dmp
-
memory/3692-140-0x0000000000000000-mapping.dmp
-
memory/4380-144-0x0000000002D40000-0x0000000002D6E000-memory.dmpFilesize
184KB
-
memory/4380-141-0x0000000000000000-mapping.dmp
-
memory/5100-138-0x00007FFA42FA0000-0x00007FFA42FB0000-memory.dmpFilesize
64KB
-
memory/5100-137-0x00007FFA42FA0000-0x00007FFA42FB0000-memory.dmpFilesize
64KB
-
memory/5100-136-0x00007FFA45370000-0x00007FFA45380000-memory.dmpFilesize
64KB
-
memory/5100-132-0x00007FFA45370000-0x00007FFA45380000-memory.dmpFilesize
64KB
-
memory/5100-135-0x00007FFA45370000-0x00007FFA45380000-memory.dmpFilesize
64KB
-
memory/5100-134-0x00007FFA45370000-0x00007FFA45380000-memory.dmpFilesize
64KB
-
memory/5100-133-0x00007FFA45370000-0x00007FFA45380000-memory.dmpFilesize
64KB