Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/03/2023, 04:25

General

  • Target

    I19984860741841252_202303081146.doc

  • Size

    516.3MB

  • MD5

    c2ba98ea49f3d5f5b04d7980ed36b75d

  • SHA1

    0b66f823f6edf03c3992d9265a43aa5ffa24938a

  • SHA256

    1e041bead6abf833504e173d6b1026ee766bfef84635a7d222e520a673d8896c

  • SHA512

    108011d99c013c97e462cb1792a8e5de1a1ebdccd5073acc2c5ac08dc8fcca0acd20eb0bfd37850721a46dffdf54d88bfac59aca6399dda8e4ee53434796e365

  • SSDEEP

    6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Loads dropped DLL 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\I19984860741841252_202303081146.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:352
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\052709.tmp"
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\TqpjeRquNIjkUh\MoxKQmnrix.dll"
        3⤵
          PID:1364
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        2⤵
          PID:1212

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\052709.tmp

              Filesize

              529.7MB

              MD5

              851c375861d36292311383733358ff80

              SHA1

              35884c49e55cfa7541ad99bd383873841f483d0a

              SHA256

              b0412b6bf2bf2ea874ef2a7f0967956d20f6fe5aa75604755dd234b71faaba6a

              SHA512

              54d85257637e1d78ed5d2708b68fdc808df0b8a246916539b4691b257af1fe00dd286eb6f03b6feb0654a7e1bf93ed9a61fc7fd04e345944b69af22ab4e5cbe3

            • C:\Users\Admin\AppData\Local\Temp\052711.zip

              Filesize

              865KB

              MD5

              f722207b3e742ae5b5aeb999bfdb35f0

              SHA1

              0dd46925311e4f7b9ffba1839e3990c586f08456

              SHA256

              289b313d6977527c3d3a9e1235da66982be9bdf3ff00bc0f91cac2785a7eba52

              SHA512

              e85d98636e4da0bce8daea6ce16d721ff25b63e80c262e05309ba3ee7563ca216a6d5fbf9b192a9b0270d3a3d621cb9e33e9cc570745b233c9dd1dca5261d882

            • \Users\Admin\AppData\Local\Temp\052709.tmp

              Filesize

              529.7MB

              MD5

              851c375861d36292311383733358ff80

              SHA1

              35884c49e55cfa7541ad99bd383873841f483d0a

              SHA256

              b0412b6bf2bf2ea874ef2a7f0967956d20f6fe5aa75604755dd234b71faaba6a

              SHA512

              54d85257637e1d78ed5d2708b68fdc808df0b8a246916539b4691b257af1fe00dd286eb6f03b6feb0654a7e1bf93ed9a61fc7fd04e345944b69af22ab4e5cbe3

            • \Users\Admin\AppData\Local\Temp\052709.tmp

              Filesize

              529.7MB

              MD5

              851c375861d36292311383733358ff80

              SHA1

              35884c49e55cfa7541ad99bd383873841f483d0a

              SHA256

              b0412b6bf2bf2ea874ef2a7f0967956d20f6fe5aa75604755dd234b71faaba6a

              SHA512

              54d85257637e1d78ed5d2708b68fdc808df0b8a246916539b4691b257af1fe00dd286eb6f03b6feb0654a7e1bf93ed9a61fc7fd04e345944b69af22ab4e5cbe3

            • memory/352-125-0x00007FFEEC7D0000-0x00007FFEEC7E0000-memory.dmp

              Filesize

              64KB

            • memory/352-126-0x00007FFEEC7D0000-0x00007FFEEC7E0000-memory.dmp

              Filesize

              64KB

            • memory/352-122-0x00007FFEF0340000-0x00007FFEF0350000-memory.dmp

              Filesize

              64KB

            • memory/352-121-0x00007FFEF0340000-0x00007FFEF0350000-memory.dmp

              Filesize

              64KB

            • memory/352-119-0x00007FFEF0340000-0x00007FFEF0350000-memory.dmp

              Filesize

              64KB

            • memory/352-120-0x00007FFEF0340000-0x00007FFEF0350000-memory.dmp

              Filesize

              64KB

            • memory/4424-329-0x00000000021C0000-0x0000000002270000-memory.dmp

              Filesize

              704KB

            • memory/4424-331-0x0000000180000000-0x000000018002D000-memory.dmp

              Filesize

              180KB

            • memory/4424-339-0x00000000009E0000-0x00000000009E1000-memory.dmp

              Filesize

              4KB

            • memory/4424-348-0x00000000021C0000-0x0000000002270000-memory.dmp

              Filesize

              704KB