Malware Analysis Report

2025-08-05 12:45

Sample ID 230308-jxvn6sec9w
Target Dat_8NWR9UK2ORB.doc
SHA256 f616da0ebb4f984aecd40da922c0cdf70987643a86afadc969aa76598120cd5d
Tags
macro macro_on_action emotet epoch4 banker trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f616da0ebb4f984aecd40da922c0cdf70987643a86afadc969aa76598120cd5d

Threat Level: Known bad

The file Dat_8NWR9UK2ORB.doc was found to be: Known bad.

Malicious Activity Summary

macro macro_on_action emotet epoch4 banker trojan

Emotet

Process spawned unexpected child process

Office macro that triggers on suspicious action

Suspicious Office macro

Office loads VBA resources, possible macro or embedded object present

Script User-Agent

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-08 08:04

Signatures

Office macro that triggers on suspicious action

macro macro_on_action
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-08 08:03

Reported

2023-03-08 08:08

Platform

win7-20230220-en

Max time kernel

24s

Max time network

34s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Dat_8NWR9UK2ORB.doc"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\regsvr32.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Dat_8NWR9UK2ORB.doc"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\080527.tmp"

C:\Windows\system32\regsvr32.exe

/s "C:\Users\Admin\AppData\Local\Temp\080527.tmp"

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JuqBhCjlXmKzE\RDMdV.dll"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.dnautik.com udp
RS 195.252.110.130:80 www.dnautik.com tcp

Files

memory/1980-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1980-57-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-58-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-59-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-60-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-61-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-62-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-64-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-65-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-66-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-68-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-69-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-70-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-71-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-72-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-67-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-73-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-76-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-77-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-78-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-79-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-80-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-81-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-83-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-84-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-86-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-85-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-87-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-89-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-88-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-90-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-93-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-94-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-96-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-95-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-98-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-97-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-92-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-91-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-82-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-75-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-74-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-63-0x00000000006D0000-0x00000000007D0000-memory.dmp

memory/1980-99-0x00000000006D0000-0x00000000007D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\080531.zip

MD5 909549241403bb8529a01fb67601e799
SHA1 45bd807feed98f9b73c1470930b26db429ecdc66
SHA256 f51c81ec5c615651109c343acc8f7a712a78801b83fabd0b0925a2abde9629ff
SHA512 186d29c7fa1dc39a8b6a61e40b45af740b1dcbde0609ab397ff6d94745342f288ed71e4db1b051e060b30371a97deb3e37882782b2942103819360d6c7a43a75

memory/1980-1077-0x0000000006740000-0x0000000006741000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\080527.tmp

MD5 935efad544e947a1cb3528c032bfd5bf
SHA1 ab93701646972666deb6c04ff13465e43ddc8738
SHA256 c3a062fb0b8306188cbc31c11b3230cb528105f7362a1604464d9e794ada6e85
SHA512 cb7d73bb56e746a837dce2341f3aad66fdce9ae0062d35ff9af3f276188956364de4037f39488885df2643ffabb29c4eaed819b1deb01385e018591ba41ffcf6

\Users\Admin\AppData\Local\Temp\080527.tmp

MD5 e0d2a4b737ebef8e00d2ebe240d752d4
SHA1 25b2372044524ade538b598edaf87f617f3758b9
SHA256 724822ad4c5feae6bc02e5b8684a759e704f707d0663d8ba61aa2d3e5ca26312
SHA512 c233c413842c4f6777ff8ae81d9fccc2df4be6c787ecc83ce3574c4cfd83986ffb76d673e3171b18e6c24eb1f575d114c32bb89791894c5d7fc1e497c2b4483d

\Users\Admin\AppData\Local\Temp\080527.tmp

MD5 276747ace8f3409cae9736782835d7d6
SHA1 9e054029bcd0a4007966671e6826ec5f2b1070e0
SHA256 3a9294cb2efb9b424d00dd3170aee44421eead93133a7bcafe5d20b9bd97b4d1
SHA512 c94adedf107ec1925f6bf210049eba646be5048b9e5140de8e9c8ecc44f3012702e1d5e73f0cbdcf2d45f4b08328c352c5eaf00d8b33bad3c8a2658fefc6c2a7

memory/1672-1264-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/1980-1270-0x0000000006740000-0x0000000006741000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-03-08 08:03

Reported

2023-03-08 08:07

Platform

win10v2004-20230220-en

Max time kernel

14s

Max time network

144s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Dat_8NWR9UK2ORB.doc" /o ""

Signatures

Emotet

trojan banker emotet

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Script User-Agent

Description Indicator Process Target
HTTP User-Agent header Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) N/A N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Dat_8NWR9UK2ORB.doc" /o ""

C:\Windows\System32\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\090459.tmp"

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OsIvcJGjWQdT\dAPOUwKvZvStJITW.dll"

Network

Country Destination Domain Proto
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 210.81.184.52.in-addr.arpa udp
US 8.8.8.8:53 24.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 www.dnautik.com udp
RS 195.252.110.130:80 www.dnautik.com tcp
US 8.8.8.8:53 130.110.252.195.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 131.72.42.20.in-addr.arpa udp
US 8.8.8.8:53 164.2.77.40.in-addr.arpa udp
US 20.42.73.24:443 tcp
US 8.8.8.8:53 126.135.241.8.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
NL 173.223.113.164:443 tcp
US 8.8.8.8:53 234.238.32.23.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp

Files

memory/2664-133-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

memory/2664-134-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

memory/2664-135-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

memory/2664-136-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

memory/2664-137-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

memory/2664-138-0x00007FFCA6E90000-0x00007FFCA6EA0000-memory.dmp

memory/2664-139-0x00007FFCA6E90000-0x00007FFCA6EA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\090500.zip

MD5 909549241403bb8529a01fb67601e799
SHA1 45bd807feed98f9b73c1470930b26db429ecdc66
SHA256 f51c81ec5c615651109c343acc8f7a712a78801b83fabd0b0925a2abde9629ff
SHA512 186d29c7fa1dc39a8b6a61e40b45af740b1dcbde0609ab397ff6d94745342f288ed71e4db1b051e060b30371a97deb3e37882782b2942103819360d6c7a43a75

C:\Users\Admin\AppData\Local\Temp\090459.tmp

MD5 e7aec5d74b56b7c838da008347773f3b
SHA1 0c3769ff83bd69c3fb8d3462618b7c161f0f6b3e
SHA256 547fcaa035adc635c4d8cf367cfb8fc0b7bf80eb8ebffffe0644d5213d6a9ede
SHA512 c90e5e5983431011a29b340ab1bdaa0d605e6bf02041da85cec99d9379baad712617b1b4bb2158c00aed3e8f9e1e0542ff639addfb997ac7d914cba22f232c39

memory/1612-180-0x0000000002070000-0x0000000002120000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\090459.tmp

MD5 ef368ce37d25f25af5ec1561e3926ac6
SHA1 4133b5ab2e07e4998704b917267a94dce65d89f2
SHA256 eabfbaf087a3ef8859b0ca9aeb31ddad4c09a690d427847ec47065246bcb5261
SHA512 318c410ba9bac8c72189527b39e5bfdef556a1b0ee2a6b89ed33ef77eae3fa51b6ff8443a933dfabe1d1b480d875e372559372a330c6bb7e12ba721b75262d9b

memory/1612-182-0x0000000180000000-0x000000018002D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\090459.tmp

MD5 d34257bfb904226b88971189a96744ef
SHA1 4f5b72fdc31e507d033008c4d5def42cba936d01
SHA256 2ca46d1f638e42b1d50043215ef6d7edcb5f75af5fc26eeda5010374c188da18
SHA512 46152195bbfae9aa4dd1530f517c3e2a700f9be20766f77d49ca73b122c2b6e53e85e94f9b83d7bc3d2506aee3af3f42ee1a1c828764757e9303d960c78ec475

memory/1612-185-0x0000000002120000-0x0000000002121000-memory.dmp

memory/4864-188-0x0000000002040000-0x00000000020F0000-memory.dmp

C:\Windows\System32\OsIvcJGjWQdT\dAPOUwKvZvStJITW.dll

MD5 d2c6731f5b0e0022d44d3042ce6846ad
SHA1 6702b746d248046a4051547dfa4dedf4aa526152
SHA256 1960bdfd534aa2ebc618eb78ad7e460b5ae4dee4d486a820c738b7f495c4ac4d
SHA512 4bb7297c1f2c8fcba6971430cac241a13e016cddf4ceb1816de375ae417ee56e7edd33361a89ced3ec012976b63a9201de0d47797a6c9a22a39554853b21e6eb

C:\Windows\System32\OsIvcJGjWQdT\dAPOUwKvZvStJITW.dll

MD5 1300dfad652942a602b9b703e3e98dbd
SHA1 ed716e78b3fd7f12796b61fa25f924001b7723c8
SHA256 6d34cd0f58973f834b41104d4b210d53a9d99622b609ef93c753ece346f2b4f2
SHA512 3e311fb24667653638d846b74f4e23aefdc6fbb5f3cdb0127ecbdd6ea6632e2a1adc83526790689c207773032376ecc9e8637c5478d05d13f366c933edec0b12

memory/4864-194-0x0000000002040000-0x00000000020F0000-memory.dmp

memory/2664-221-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

memory/2664-222-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

memory/2664-224-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp

memory/2664-223-0x00007FFCA97F0000-0x00007FFCA9800000-memory.dmp