Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
09-03-2023 13:19
Behavioral task
behavioral1
Sample
Contract - Mar-09-2023.doc
Resource
win7-20230220-en
General
-
Target
Contract - Mar-09-2023.doc
-
Size
522.3MB
-
MD5
31f97ce2bbc58266f6eb92213f1a2454
-
SHA1
3be2b2eb3215d451dc475d63048eee889da48cbc
-
SHA256
62ab0b86d0eda61c16827847de2edf4920558f8e4c6b63eb720a09e6dea6f734
-
SHA512
a1c36524b14f633d2346b369ecc07b23a549793c842f50452d3189218cad32bf871113368a98c531f5575e041affe76f2c144875f9cf378e39378495ff6393f7
-
SSDEEP
6144:QDuxuMOZCBtANveapnaWVgsaNlbfXhoEHC87pnkTnlzIWZ4:18yGZZak8fxJB1e5IWZ4
Malware Config
Extracted
emotet
Epoch4
129.232.188.93:443
164.90.222.65:443
159.65.88.10:8080
172.105.226.75:8080
115.68.227.76:8080
187.63.160.88:80
169.57.156.166:8080
185.4.135.165:8080
153.126.146.25:7080
197.242.150.244:8080
139.59.126.41:443
186.194.240.217:443
103.132.242.26:8080
206.189.28.199:8080
163.44.196.120:8080
95.217.221.146:8080
159.89.202.34:443
119.59.103.152:8080
183.111.227.137:8080
201.94.166.162:443
103.75.201.2:443
149.56.131.28:8080
79.137.35.198:8080
5.135.159.50:443
66.228.32.31:7080
91.121.146.47:8080
153.92.5.27:8080
45.235.8.30:8080
72.15.201.15:8080
107.170.39.149:8080
45.176.232.124:443
82.223.21.224:8080
167.172.199.165:8080
213.239.212.5:443
202.129.205.3:8080
94.23.45.86:4143
147.139.166.154:8080
167.172.253.162:8080
91.207.28.33:8080
188.44.20.25:443
104.168.155.143:8080
110.232.117.186:8080
164.68.99.3:8080
1.234.2.232:8080
173.212.193.249:8080
182.162.143.56:443
160.16.142.56:8080
101.50.0.91:8080
103.43.75.120:443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4168 640 regsvr32.exe WINWORD.EXE -
Loads dropped DLL 3 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 4168 regsvr32.exe 1444 regsvr32.exe 1444 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 43 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 640 WINWORD.EXE 640 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 4168 regsvr32.exe 4168 regsvr32.exe 1444 regsvr32.exe 1444 regsvr32.exe 1444 regsvr32.exe 1444 regsvr32.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
WINWORD.EXEpid process 640 WINWORD.EXE 640 WINWORD.EXE 640 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 640 WINWORD.EXE 640 WINWORD.EXE 640 WINWORD.EXE 640 WINWORD.EXE 640 WINWORD.EXE 640 WINWORD.EXE 640 WINWORD.EXE 640 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
WINWORD.EXEregsvr32.exedescription pid process target process PID 640 wrote to memory of 4168 640 WINWORD.EXE regsvr32.exe PID 640 wrote to memory of 4168 640 WINWORD.EXE regsvr32.exe PID 4168 wrote to memory of 1444 4168 regsvr32.exe regsvr32.exe PID 4168 wrote to memory of 1444 4168 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Contract - Mar-09-2023.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\142034.tmp"2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\LNoPOjSoefFcwCj\FaNl.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\142034.tmpFilesize
519.5MB
MD58369f8222def57832e649eb39fd2e1cb
SHA1d42f215ae5af681e8e0125c7a8399759803f6f01
SHA256290192ceb0b157166d9ae46d4d8980ea2840e91b97411c49dba08da45125e429
SHA5122e9a47cdddc536cd455fa42774bf55d193aea100aa61adaf20f155f9199132b014da2c19327b984eb09537170d40af59fde81396aea3228cf767d31fa42732e6
-
C:\Users\Admin\AppData\Local\Temp\142034.tmpFilesize
519.5MB
MD58369f8222def57832e649eb39fd2e1cb
SHA1d42f215ae5af681e8e0125c7a8399759803f6f01
SHA256290192ceb0b157166d9ae46d4d8980ea2840e91b97411c49dba08da45125e429
SHA5122e9a47cdddc536cd455fa42774bf55d193aea100aa61adaf20f155f9199132b014da2c19327b984eb09537170d40af59fde81396aea3228cf767d31fa42732e6
-
C:\Users\Admin\AppData\Local\Temp\142035.zipFilesize
804KB
MD57821adc2f937cd7f7f6fc3499ceda7c3
SHA15e4c4bd7a474c4bebe39b3741ccbc54e524692d4
SHA25695944d22d1e39c3d3f1b7f35fc225b81fd937d711a662b219fa94422e78c8f17
SHA512f850146e6bd3a1a43da0f01db570c8881642aabf3a315db429a1bb2834cfe7baed183f575cd3774948ef5cd485f7a042d580dbb48f77f47a081e967273bb85cb
-
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lexFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Windows\System32\LNoPOjSoefFcwCj\FaNl.dllFilesize
519.5MB
MD58369f8222def57832e649eb39fd2e1cb
SHA1d42f215ae5af681e8e0125c7a8399759803f6f01
SHA256290192ceb0b157166d9ae46d4d8980ea2840e91b97411c49dba08da45125e429
SHA5122e9a47cdddc536cd455fa42774bf55d193aea100aa61adaf20f155f9199132b014da2c19327b984eb09537170d40af59fde81396aea3228cf767d31fa42732e6
-
C:\Windows\System32\LNoPOjSoefFcwCj\FaNl.dllFilesize
519.5MB
MD58369f8222def57832e649eb39fd2e1cb
SHA1d42f215ae5af681e8e0125c7a8399759803f6f01
SHA256290192ceb0b157166d9ae46d4d8980ea2840e91b97411c49dba08da45125e429
SHA5122e9a47cdddc536cd455fa42774bf55d193aea100aa61adaf20f155f9199132b014da2c19327b984eb09537170d40af59fde81396aea3228cf767d31fa42732e6
-
memory/640-138-0x00007FFD886C0000-0x00007FFD886D0000-memory.dmpFilesize
64KB
-
memory/640-224-0x00007FFD8AB30000-0x00007FFD8AB40000-memory.dmpFilesize
64KB
-
memory/640-133-0x00007FFD8AB30000-0x00007FFD8AB40000-memory.dmpFilesize
64KB
-
memory/640-137-0x00007FFD8AB30000-0x00007FFD8AB40000-memory.dmpFilesize
64KB
-
memory/640-226-0x00007FFD8AB30000-0x00007FFD8AB40000-memory.dmpFilesize
64KB
-
memory/640-227-0x00007FFD8AB30000-0x00007FFD8AB40000-memory.dmpFilesize
64KB
-
memory/640-136-0x00007FFD8AB30000-0x00007FFD8AB40000-memory.dmpFilesize
64KB
-
memory/640-225-0x00007FFD8AB30000-0x00007FFD8AB40000-memory.dmpFilesize
64KB
-
memory/640-135-0x00007FFD8AB30000-0x00007FFD8AB40000-memory.dmpFilesize
64KB
-
memory/640-134-0x00007FFD8AB30000-0x00007FFD8AB40000-memory.dmpFilesize
64KB
-
memory/640-139-0x00007FFD886C0000-0x00007FFD886D0000-memory.dmpFilesize
64KB
-
memory/1444-196-0x00000000008D0000-0x0000000000958000-memory.dmpFilesize
544KB
-
memory/1444-185-0x00000000008D0000-0x0000000000958000-memory.dmpFilesize
544KB
-
memory/4168-177-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/4168-174-0x0000000180000000-0x000000018002D000-memory.dmpFilesize
180KB