Analysis

  • max time kernel
    14s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2023, 08:03

General

  • Target

    Dat_8NWR9UK2ORB.doc

  • Size

    522.3MB

  • MD5

    2148a6a2bef5a35ce5665cbc12d5e474

  • SHA1

    2e87b33309c888ab7d655e92a45a31f15753fdee

  • SHA256

    f616da0ebb4f984aecd40da922c0cdf70987643a86afadc969aa76598120cd5d

  • SHA512

    fb232985018569cdbba001273278a6128af1395e1dc4631b023a0c49fefffd43a93dd6b0332c2cc634aa87d850ea2866614cacb6b064e57f4d48c7b41b60ea4c

  • SSDEEP

    6144:xPn4VZXbatu7MDogsDkHS50LdfcGcbz1f5M9KTFrMpSlMK3Ru+Q28:xP4PbNMkgg3Ru+x

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Dat_8NWR9UK2ORB.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2664
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\090459.tmp"
      2⤵
      • Process spawned unexpected child process
      PID:1612
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OsIvcJGjWQdT\dAPOUwKvZvStJITW.dll"
        3⤵
          PID:4864

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\090459.tmp

            Filesize

            423.9MB

            MD5

            e7aec5d74b56b7c838da008347773f3b

            SHA1

            0c3769ff83bd69c3fb8d3462618b7c161f0f6b3e

            SHA256

            547fcaa035adc635c4d8cf367cfb8fc0b7bf80eb8ebffffe0644d5213d6a9ede

            SHA512

            c90e5e5983431011a29b340ab1bdaa0d605e6bf02041da85cec99d9379baad712617b1b4bb2158c00aed3e8f9e1e0542ff639addfb997ac7d914cba22f232c39

          • C:\Users\Admin\AppData\Local\Temp\090459.tmp

            Filesize

            452.7MB

            MD5

            d34257bfb904226b88971189a96744ef

            SHA1

            4f5b72fdc31e507d033008c4d5def42cba936d01

            SHA256

            2ca46d1f638e42b1d50043215ef6d7edcb5f75af5fc26eeda5010374c188da18

            SHA512

            46152195bbfae9aa4dd1530f517c3e2a700f9be20766f77d49ca73b122c2b6e53e85e94f9b83d7bc3d2506aee3af3f42ee1a1c828764757e9303d960c78ec475

          • C:\Users\Admin\AppData\Local\Temp\090459.tmp

            Filesize

            423.7MB

            MD5

            ef368ce37d25f25af5ec1561e3926ac6

            SHA1

            4133b5ab2e07e4998704b917267a94dce65d89f2

            SHA256

            eabfbaf087a3ef8859b0ca9aeb31ddad4c09a690d427847ec47065246bcb5261

            SHA512

            318c410ba9bac8c72189527b39e5bfdef556a1b0ee2a6b89ed33ef77eae3fa51b6ff8443a933dfabe1d1b480d875e372559372a330c6bb7e12ba721b75262d9b

          • C:\Users\Admin\AppData\Local\Temp\090500.zip

            Filesize

            867KB

            MD5

            909549241403bb8529a01fb67601e799

            SHA1

            45bd807feed98f9b73c1470930b26db429ecdc66

            SHA256

            f51c81ec5c615651109c343acc8f7a712a78801b83fabd0b0925a2abde9629ff

            SHA512

            186d29c7fa1dc39a8b6a61e40b45af740b1dcbde0609ab397ff6d94745342f288ed71e4db1b051e060b30371a97deb3e37882782b2942103819360d6c7a43a75

          • C:\Windows\System32\OsIvcJGjWQdT\dAPOUwKvZvStJITW.dll

            Filesize

            398.4MB

            MD5

            1300dfad652942a602b9b703e3e98dbd

            SHA1

            ed716e78b3fd7f12796b61fa25f924001b7723c8

            SHA256

            6d34cd0f58973f834b41104d4b210d53a9d99622b609ef93c753ece346f2b4f2

            SHA512

            3e311fb24667653638d846b74f4e23aefdc6fbb5f3cdb0127ecbdd6ea6632e2a1adc83526790689c207773032376ecc9e8637c5478d05d13f366c933edec0b12

          • C:\Windows\System32\OsIvcJGjWQdT\dAPOUwKvZvStJITW.dll

            Filesize

            384.6MB

            MD5

            d2c6731f5b0e0022d44d3042ce6846ad

            SHA1

            6702b746d248046a4051547dfa4dedf4aa526152

            SHA256

            1960bdfd534aa2ebc618eb78ad7e460b5ae4dee4d486a820c738b7f495c4ac4d

            SHA512

            4bb7297c1f2c8fcba6971430cac241a13e016cddf4ceb1816de375ae417ee56e7edd33361a89ced3ec012976b63a9201de0d47797a6c9a22a39554853b21e6eb

          • memory/1612-180-0x0000000002070000-0x0000000002120000-memory.dmp

            Filesize

            704KB

          • memory/1612-185-0x0000000002120000-0x0000000002121000-memory.dmp

            Filesize

            4KB

          • memory/1612-182-0x0000000180000000-0x000000018002D000-memory.dmp

            Filesize

            180KB

          • memory/2664-221-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

            Filesize

            64KB

          • memory/2664-136-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

            Filesize

            64KB

          • memory/2664-137-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

            Filesize

            64KB

          • memory/2664-135-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

            Filesize

            64KB

          • memory/2664-138-0x00007FFCA6E90000-0x00007FFCA6EA0000-memory.dmp

            Filesize

            64KB

          • memory/2664-133-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

            Filesize

            64KB

          • memory/2664-134-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

            Filesize

            64KB

          • memory/2664-139-0x00007FFCA6E90000-0x00007FFCA6EA0000-memory.dmp

            Filesize

            64KB

          • memory/2664-222-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

            Filesize

            64KB

          • memory/2664-224-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

            Filesize

            64KB

          • memory/2664-223-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

            Filesize

            64KB

          • memory/4864-188-0x0000000002040000-0x00000000020F0000-memory.dmp

            Filesize

            704KB

          • memory/4864-194-0x0000000002040000-0x00000000020F0000-memory.dmp

            Filesize

            704KB