Analysis
-
max time kernel
220s -
max time network
295s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2023 17:15
Behavioral task
behavioral1
Sample
08032023.doc
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
08032023.doc
Resource
win10v2004-20230220-en
General
-
Target
08032023.doc
-
Size
525.3MB
-
MD5
d2dee88803a04a6457a9c62840e53223
-
SHA1
1be346c29ae7d0bfa91b50532bd16bba6c0bf624
-
SHA256
eaf050eabdfffde46a85a1651438dbbae8a3e048090c80f231efddef019895a0
-
SHA512
42e7a7dc77e54575563378be4f605baaee5fe7df2ffb823caeec1c06eae140e5bcaa34c74def12ebc8c8eb274be30e5b9c2eb696f13c0b4b0d410867acf5eea7
-
SSDEEP
3072:2JX29m8QBUoItA/leC6gSJ+2JiclnUOvrRxqmLcHeNJxPkdVdTRcDK6:2EmleC6gSJWclU0RxVLcHe5cdTR
Malware Config
Extracted
emotet
Epoch4
164.68.99.3:8080
164.90.222.65:443
186.194.240.217:443
1.234.2.232:8080
103.75.201.2:443
187.63.160.88:80
147.139.166.154:8080
91.207.28.33:8080
5.135.159.50:443
153.92.5.27:8080
213.239.212.5:443
103.43.75.120:443
159.65.88.10:8080
167.172.253.162:8080
153.126.146.25:7080
119.59.103.152:8080
107.170.39.149:8080
183.111.227.137:8080
159.89.202.34:443
110.232.117.186:8080
129.232.188.93:443
172.105.226.75:8080
197.242.150.244:8080
188.44.20.25:443
66.228.32.31:7080
91.121.146.47:8080
202.129.205.3:8080
45.176.232.124:443
160.16.142.56:8080
94.23.45.86:4143
95.217.221.146:8080
72.15.201.15:8080
167.172.199.165:8080
115.68.227.76:8080
139.59.126.41:443
185.4.135.165:8080
79.137.35.198:8080
206.189.28.199:8080
163.44.196.120:8080
201.94.166.162:443
104.168.155.143:8080
173.212.193.249:8080
45.235.8.30:8080
169.57.156.166:8080
149.56.131.28:8080
182.162.143.56:443
103.132.242.26:8080
82.223.21.224:8080
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3548 4676 regsvr32.exe WINWORD.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 680 4676 regsvr32.exe WINWORD.EXE -
Loads dropped DLL 4 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 3548 regsvr32.exe 2424 regsvr32.exe 680 regsvr32.exe 5040 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MAMgVHTiWW.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\ZKsfLQDIXajnhQCI\\MAMgVHTiWW.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Script User-Agent 10 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 32 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 34 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 41 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 93 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 30 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 36 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 95 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 97 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 99 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 101 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4676 WINWORD.EXE 4676 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exepid process 3548 regsvr32.exe 3548 regsvr32.exe 2424 regsvr32.exe 2424 regsvr32.exe 2424 regsvr32.exe 2424 regsvr32.exe 680 regsvr32.exe 680 regsvr32.exe 5040 regsvr32.exe 5040 regsvr32.exe 5040 regsvr32.exe 5040 regsvr32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
WINWORD.EXEpid process 4676 WINWORD.EXE 4676 WINWORD.EXE 4676 WINWORD.EXE 4676 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
WINWORD.EXEpid process 4676 WINWORD.EXE 4676 WINWORD.EXE 4676 WINWORD.EXE 4676 WINWORD.EXE 4676 WINWORD.EXE 4676 WINWORD.EXE 4676 WINWORD.EXE 4676 WINWORD.EXE 4676 WINWORD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
WINWORD.EXEregsvr32.exeregsvr32.exedescription pid process target process PID 4676 wrote to memory of 3548 4676 WINWORD.EXE regsvr32.exe PID 4676 wrote to memory of 3548 4676 WINWORD.EXE regsvr32.exe PID 3548 wrote to memory of 2424 3548 regsvr32.exe regsvr32.exe PID 3548 wrote to memory of 2424 3548 regsvr32.exe regsvr32.exe PID 4676 wrote to memory of 680 4676 WINWORD.EXE regsvr32.exe PID 4676 wrote to memory of 680 4676 WINWORD.EXE regsvr32.exe PID 680 wrote to memory of 5040 680 regsvr32.exe regsvr32.exe PID 680 wrote to memory of 5040 680 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\08032023.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\172038.tmp"2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZKsfLQDIXajnhQCI\MAMgVHTiWW.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\172248.tmp"2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\JhELYFCmxHoErC\agtOwbDjbOa.dll"3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\172038.tmpFilesize
527.5MB
MD5d4d306a6d9d1ae637e0cfacf04f7431a
SHA168b7fb0aa0d65569aa62937620f58a50bd3e9fdd
SHA256a6e1b44ccb61a67b8e16ddc67eccacdd4b9b31a9de1fd048793c5c46b22337e2
SHA512d473a2c746eba2b0add8252f5d44eca39b5a862978de80bc8e0d83f3adfee4601f21bcba3f63caa4fda02fc4c79cae704ac0905f4c938af8abbc2381332f682c
-
C:\Users\Admin\AppData\Local\Temp\172038.tmpFilesize
527.5MB
MD5d4d306a6d9d1ae637e0cfacf04f7431a
SHA168b7fb0aa0d65569aa62937620f58a50bd3e9fdd
SHA256a6e1b44ccb61a67b8e16ddc67eccacdd4b9b31a9de1fd048793c5c46b22337e2
SHA512d473a2c746eba2b0add8252f5d44eca39b5a862978de80bc8e0d83f3adfee4601f21bcba3f63caa4fda02fc4c79cae704ac0905f4c938af8abbc2381332f682c
-
C:\Users\Admin\AppData\Local\Temp\172040.zipFilesize
821KB
MD5f1ec7bd22e219fdb389f5e2a0a8132df
SHA1fe8cf0aa2da1a147024c82ac45989795e5b467e0
SHA2568582757782e4048ba84898de0953c7c9710d84c2e764d1fca8b1d393c436dbc8
SHA5122b77027da8f0811f7cfc3735e579c4fd7e3506d85fa78ad667e88bd43dc0ab376d2b8b0c6aab3d35678810a9ee6e589b93d60aa481239ad3acf91cadc88f4969
-
C:\Users\Admin\AppData\Local\Temp\172248.tmpFilesize
515.2MB
MD521622efe7840235778508a7179bf5f43
SHA120465830eb5ab3321ff259582297d923d504e176
SHA2562cc7c5ed24a8058d29b28ec2010938c96e865277988c0d324965e14f896da13d
SHA512c88f91832dc659e352cf168a41ce3d54c7ac58ea215df98ad69094130c59e30ae4283653d4f7a69fd19c2a47acaf845615fb720dfd454634086f9ceb08c05d4d
-
C:\Users\Admin\AppData\Local\Temp\172248.tmpFilesize
524.9MB
MD5d3986d1ef52c87e7cae49477512da665
SHA1b7a96e70e25c08979fee5aeb97df527678c34f63
SHA25660ba6a4b117a64d2db19871745d91dfb1f5530257e43a07a5d4ac0a28fb352c7
SHA51247409cc2d90114c9d8a12d6a55a41b13a5180ffaa76c507471dc277913d4ed0920aefdd2ffa06725b56cd10385ffe8fbb4f7868797c23f24422862156d473db9
-
C:\Users\Admin\AppData\Local\Temp\172301\tPuBVdK7di.dllFilesize
496.1MB
MD5c427428f217657965bf952aa04733453
SHA1b3b546fca4b67eeddc84b03bd3343cb107c754a5
SHA256a0808fa2cf3bd364630695113d3cd68255a04b13645ee43a887b14e6c64156ea
SHA51263c6fef658536a1949bd158fe00cf771a70fae9d6652aa0ae2aec07f7778269eb42e8a5af0991c381096478235be4d8c9fa6aaf8096289bc11351882e52dd34d
-
C:\Windows\System32\JhELYFCmxHoErC\agtOwbDjbOa.dllFilesize
469.5MB
MD5e8da765059b459762ed8d56c07f059d8
SHA1222b3fba070d421e82fb8f1d45f41df65d433815
SHA2560c028316fd5f3d3961c2cf21df44ff4102da93a1424bca3a4475fbbd1b89fd35
SHA512889729f900dd74a4fb3aefba46b6ada06efa04b628ddb76db94f36ca581e0a88a76af9c93eff8da3ebf6285baededf48713f232d5c99eb800cb219ce971f1d1f
-
C:\Windows\System32\ZKsfLQDIXajnhQCI\MAMgVHTiWW.dllFilesize
527.5MB
MD5d4d306a6d9d1ae637e0cfacf04f7431a
SHA168b7fb0aa0d65569aa62937620f58a50bd3e9fdd
SHA256a6e1b44ccb61a67b8e16ddc67eccacdd4b9b31a9de1fd048793c5c46b22337e2
SHA512d473a2c746eba2b0add8252f5d44eca39b5a862978de80bc8e0d83f3adfee4601f21bcba3f63caa4fda02fc4c79cae704ac0905f4c938af8abbc2381332f682c
-
memory/3548-179-0x0000000180000000-0x000000018002D000-memory.dmpFilesize
180KB
-
memory/3548-181-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/4676-139-0x00007FF7C0C10000-0x00007FF7C0C20000-memory.dmpFilesize
64KB
-
memory/4676-138-0x00007FF7C0C10000-0x00007FF7C0C20000-memory.dmpFilesize
64KB
-
memory/4676-133-0x00007FF7C30F0000-0x00007FF7C3100000-memory.dmpFilesize
64KB
-
memory/4676-137-0x00007FF7C30F0000-0x00007FF7C3100000-memory.dmpFilesize
64KB
-
memory/4676-136-0x00007FF7C30F0000-0x00007FF7C3100000-memory.dmpFilesize
64KB
-
memory/4676-134-0x00007FF7C30F0000-0x00007FF7C3100000-memory.dmpFilesize
64KB
-
memory/4676-135-0x00007FF7C30F0000-0x00007FF7C3100000-memory.dmpFilesize
64KB