Analysis
- max time kernel
220s - max time network
295s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
13/03/2023, 17:15
General
- Target 08032023.doc
- Size 525.3MB
- Sample230313-vssvkabd34
- SHA256 eaf050eabdfffde46a85a1651438dbbae8a3e048090c80f231efddef019895a0
Malware Config
Extracted
-
emotet
-
Epoch4
-
164.68.99.3:8080
-
164.90.222.65:443
-
186.194.240.217:443
-
1.234.2.232:8080
-
103.75.201.2:443
-
187.63.160.88:80
-
147.139.166.154:8080
-
91.207.28.33:8080
-
5.135.159.50:443
-
153.92.5.27:8080
-
213.239.212.5:443
-
103.43.75.120:443
-
159.65.88.10:8080
-
167.172.253.162:8080
-
153.126.146.25:7080
-
119.59.103.152:8080
-
107.170.39.149:8080
-
183.111.227.137:8080
-
159.89.202.34:443
-
110.232.117.186:8080
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Script User-Agent 10 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\08032023.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\172038.tmp"2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZKsfLQDIXajnhQCI\MAMgVHTiWW.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\172248.tmp"2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\JhELYFCmxHoErC\agtOwbDjbOa.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
172038.tmp
172038.tmp
172040.zip
172248.tmp
172248.tmp
tPuBVdK7di.dll
agtOwbDjbOa.dll
MAMgVHTiWW.dll
memory/3548-179-0x0000000180000000-0x000000018002D000-memory.dmp
memory/3548-181-0x0000000000BC0000-0x0000000000BC1000-memory.dmp
memory/4676-139-0x00007FF7C0C10000-0x00007FF7C0C20000-memory.dmp
memory/4676-138-0x00007FF7C0C10000-0x00007FF7C0C20000-memory.dmp
memory/4676-133-0x00007FF7C30F0000-0x00007FF7C3100000-memory.dmp
memory/4676-137-0x00007FF7C30F0000-0x00007FF7C3100000-memory.dmp
memory/4676-136-0x00007FF7C30F0000-0x00007FF7C3100000-memory.dmp
memory/4676-134-0x00007FF7C30F0000-0x00007FF7C3100000-memory.dmp
memory/4676-135-0x00007FF7C30F0000-0x00007FF7C3100000-memory.dmp