Analysis

  • max time kernel
    16s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/03/2023, 09:39

General

  • Target

    K-1 03.07.2023.doc

  • Size

    527.2MB

  • MD5

    fd37aece5d1c1538fdaab4b4fa1fa16a

  • SHA1

    101fbc6beec580efc3582c7f619c711e9fb6d385

  • SHA256

    d9988c6dcd1c169af8db5bc3c363f18f66501a63dd9fc1b671ad32f5de359472

  • SHA512

    99cc15b540873054513d9f3fb13b250b253ab77ca83c45b350af17d04572b76db67c5f176627aaa8741113bc26d6890a15bde794557065dc9c341a65a4c13fb0

  • SSDEEP

    3072:eoEW2aOtFjH0lP2IpjctfRcVVwEi/A8NVM1wIOCbX6bYLjWFJuvx7ueK6:ZE1aOtFa2I9c3aVw4zwxCbJ4Jup

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

129.232.188.93:443

164.90.222.65:443

159.65.88.10:8080

172.105.226.75:8080

115.68.227.76:8080

187.63.160.88:80

169.57.156.166:8080

185.4.135.165:8080

153.126.146.25:7080

197.242.150.244:8080

139.59.126.41:443

186.194.240.217:443

103.132.242.26:8080

206.189.28.199:8080

163.44.196.120:8080

95.217.221.146:8080

159.89.202.34:443

119.59.103.152:8080

183.111.227.137:8080

201.94.166.162:443

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\K-1 03.07.2023.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3800
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\104024.tmp"
      2⤵
      • Process spawned unexpected child process
      PID:4660
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VRAJJQQJL\yWjhEe.dll"
        3⤵
          PID:4284

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\104024.tmp

            Filesize

            542.7MB

            MD5

            407ecc018ab4b48fedffc6a0c7afb3b7

            SHA1

            f20e7f4ae374a23cfe4be7aba503105997d188a6

            SHA256

            685b22e7220ed04b3e2aeef8afeb52e22529a105b9efe00fe84c1675725fbfaa

            SHA512

            57bc8331df71a34475bac5a2de5db0c8a1909eeb4f573e9dc050a876ea95a7ae30fd1b53a2f7ff5fea62f545d82f46cfaad920d8418beb93d8f8117e9bc95d1d

          • C:\Users\Admin\AppData\Local\Temp\104024.tmp

            Filesize

            542.7MB

            MD5

            407ecc018ab4b48fedffc6a0c7afb3b7

            SHA1

            f20e7f4ae374a23cfe4be7aba503105997d188a6

            SHA256

            685b22e7220ed04b3e2aeef8afeb52e22529a105b9efe00fe84c1675725fbfaa

            SHA512

            57bc8331df71a34475bac5a2de5db0c8a1909eeb4f573e9dc050a876ea95a7ae30fd1b53a2f7ff5fea62f545d82f46cfaad920d8418beb93d8f8117e9bc95d1d

          • C:\Users\Admin\AppData\Local\Temp\104030.zip

            Filesize

            878KB

            MD5

            e4ca5ade365a549639456e7002246f22

            SHA1

            f07d577919e7a34eda0e55d2b249248384da4b0c

            SHA256

            dc7832d51eed30c96cb7ea377dc59753c1fe13fd7745a3530c95422ca1e4d760

            SHA512

            caa1d75ad6b8acd990e6ec0fa4c7a39b7a55d7c75394ef258ef1ea9a18e8c6855cff261946d5d0985d981541a343cd072b5d7a5f72388ccc5b683e9ef2fc7e26

          • C:\Windows\System32\VRAJJQQJL\yWjhEe.dll

            Filesize

            476.4MB

            MD5

            0ddda937ce91f2d26ac5df03c19c4f77

            SHA1

            2049f06bd7cb4f4d33a5e2966035ef9dcca4e582

            SHA256

            0c37eb5c62f73ab62e003344f5e0ead9e3b74dbf3ca90d79a65d6098e513d1b5

            SHA512

            5ac8d65081644c35ddfbbb66371746b6142739e0222470a29a2f58ce4caa557386b3d0d81ed94639319744912e08bb724fb24be24f20faa9789ae9762fbd743f

          • C:\Windows\System32\VRAJJQQJL\yWjhEe.dll

            Filesize

            531.1MB

            MD5

            123478feffed2d5d5ea3fcd65bbceadc

            SHA1

            496b0d950d187b2f32783f5e77e0ecd5710d0d82

            SHA256

            e47e2c305617a64731f516059a2e5f64bbf85693649e30d3f8739882d7756992

            SHA512

            6d9cef4449b390ba5be000b287775b59ae654138783c95d298a9dbc7817acd7653ef6b2b9017af9ec17cd7b101dcdee923303cea56cc371dab9ad98353eb9f31

          • memory/3800-138-0x00007FFD1F7E0000-0x00007FFD1F7F0000-memory.dmp

            Filesize

            64KB

          • memory/3800-218-0x00007FFD220B0000-0x00007FFD220C0000-memory.dmp

            Filesize

            64KB

          • memory/3800-133-0x00007FFD220B0000-0x00007FFD220C0000-memory.dmp

            Filesize

            64KB

          • memory/3800-137-0x00007FFD220B0000-0x00007FFD220C0000-memory.dmp

            Filesize

            64KB

          • memory/3800-221-0x00007FFD220B0000-0x00007FFD220C0000-memory.dmp

            Filesize

            64KB

          • memory/3800-136-0x00007FFD220B0000-0x00007FFD220C0000-memory.dmp

            Filesize

            64KB

          • memory/3800-220-0x00007FFD220B0000-0x00007FFD220C0000-memory.dmp

            Filesize

            64KB

          • memory/3800-219-0x00007FFD220B0000-0x00007FFD220C0000-memory.dmp

            Filesize

            64KB

          • memory/3800-134-0x00007FFD220B0000-0x00007FFD220C0000-memory.dmp

            Filesize

            64KB

          • memory/3800-135-0x00007FFD220B0000-0x00007FFD220C0000-memory.dmp

            Filesize

            64KB

          • memory/3800-139-0x00007FFD1F7E0000-0x00007FFD1F7F0000-memory.dmp

            Filesize

            64KB

          • memory/4284-189-0x00000000006F0000-0x00000000007A0000-memory.dmp

            Filesize

            704KB

          • memory/4284-184-0x00000000006F0000-0x00000000007A0000-memory.dmp

            Filesize

            704KB

          • memory/4660-181-0x0000000002330000-0x0000000002331000-memory.dmp

            Filesize

            4KB

          • memory/4660-178-0x0000000180000000-0x000000018002D000-memory.dmp

            Filesize

            180KB