Analysis

  • max time kernel
    24s
  • max time network
    50s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2023, 04:32

General

  • Target

    I19984860741841252_202303081146.doc

  • Size

    516.3MB

  • MD5

    c2ba98ea49f3d5f5b04d7980ed36b75d

  • SHA1

    0b66f823f6edf03c3992d9265a43aa5ffa24938a

  • SHA256

    1e041bead6abf833504e173d6b1026ee766bfef84635a7d222e520a673d8896c

  • SHA512

    108011d99c013c97e462cb1792a8e5de1a1ebdccd5073acc2c5ac08dc8fcca0acd20eb0bfd37850721a46dffdf54d88bfac59aca6399dda8e4ee53434796e365

  • SSDEEP

    6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\I19984860741841252_202303081146.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4260
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\053330.tmp"
      2⤵
      • Process spawned unexpected child process
      PID:4160
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JQdMFtdJGOoPDhg\Wkce.dll"
        3⤵
          PID:2516

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\053330.tmp

            Filesize

            68.8MB

            MD5

            fd97c79f31def5eef4e156f2e220bf0c

            SHA1

            3b9b7161b4658b02870cd521833aeae2d3596fe9

            SHA256

            fa0a19e065f08f430430a2ffe9c40e2e3b6bd50490459f1c3ebe457740e9f209

            SHA512

            e063e5962009c04ed3c21ee473385654968d39f48df9621241c995bffec2d761450565890f83ffa040b8744e287bbb2ae8771b9247caf870da62fc3ac81e124d

          • C:\Users\Admin\AppData\Local\Temp\053330.tmp

            Filesize

            71.4MB

            MD5

            e70864474c83c98aa509b9697cfd9ea9

            SHA1

            c35cc65d7c1a8a72b21ad343f52c501b978d3605

            SHA256

            ab419f82d140705042fa2e3bdf0d1522540c6f7dfc95d5943c003430e3e4f56e

            SHA512

            396475516a40d85a2cafc981ebb8d6d777813abe37eb33a37268bf2815274964a639a0b40d6561de29fe982c00803c413021302f1c2cfccef151aaa0dcb3945d

          • C:\Users\Admin\AppData\Local\Temp\053331.zip

            Filesize

            865KB

            MD5

            f722207b3e742ae5b5aeb999bfdb35f0

            SHA1

            0dd46925311e4f7b9ffba1839e3990c586f08456

            SHA256

            289b313d6977527c3d3a9e1235da66982be9bdf3ff00bc0f91cac2785a7eba52

            SHA512

            e85d98636e4da0bce8daea6ce16d721ff25b63e80c262e05309ba3ee7563ca216a6d5fbf9b192a9b0270d3a3d621cb9e33e9cc570745b233c9dd1dca5261d882

          • C:\Windows\System32\JQdMFtdJGOoPDhg\Wkce.dll

            Filesize

            60.1MB

            MD5

            48c45c6b9c3cb926acd4223826d3a32b

            SHA1

            4494baa4cc1151304c06e43abed7003f585b162c

            SHA256

            6382d809ee65f1f98253b46a0291ae3ecddc5aae080f2dfbd74afb9b33e7dade

            SHA512

            4eb07de0fd1e118c5ad09ada04a9232ddce9e1c0a70ac1930d6ec4ab2ab41f2ad00531940434608a5dbb0a847fae81dca0634657fe2ed772b4f7c1529b25e6c3

          • memory/2516-188-0x0000000000400000-0x00000000004B0000-memory.dmp

            Filesize

            704KB

          • memory/4160-180-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

            Filesize

            4KB

          • memory/4160-177-0x0000000180000000-0x000000018002D000-memory.dmp

            Filesize

            180KB

          • memory/4260-136-0x00007FF8EA3B0000-0x00007FF8EA3C0000-memory.dmp

            Filesize

            64KB

          • memory/4260-140-0x00007FF8E8190000-0x00007FF8E81A0000-memory.dmp

            Filesize

            64KB

          • memory/4260-138-0x00007FF8E8190000-0x00007FF8E81A0000-memory.dmp

            Filesize

            64KB

          • memory/4260-137-0x00007FF8EA3B0000-0x00007FF8EA3C0000-memory.dmp

            Filesize

            64KB

          • memory/4260-133-0x00007FF8EA3B0000-0x00007FF8EA3C0000-memory.dmp

            Filesize

            64KB

          • memory/4260-135-0x00007FF8EA3B0000-0x00007FF8EA3C0000-memory.dmp

            Filesize

            64KB

          • memory/4260-134-0x00007FF8EA3B0000-0x00007FF8EA3C0000-memory.dmp

            Filesize

            64KB