Analysis
- max time kernel
93s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
14/03/2023, 10:43
General
- Target Invoice Number 979646.doc
- Size 535.3MB
- Sample230314-msapzseh94
- SHA256 5be08e46bbe7dc937ad38deb70d95fa9d64595191baf16afb84f45a58ea494c1
Malware Config
Extracted
-
emotet
-
Epoch4
-
164.68.99.3:8080
-
164.90.222.65:443
-
186.194.240.217:443
-
1.234.2.232:8080
-
103.75.201.2:443
-
187.63.160.88:80
-
147.139.166.154:8080
-
91.207.28.33:8080
-
5.135.159.50:443
-
153.92.5.27:8080
-
213.239.212.5:443
-
103.43.75.120:443
-
159.65.88.10:8080
-
167.172.253.162:8080
-
153.126.146.25:7080
-
119.59.103.152:8080
-
107.170.39.149:8080
-
183.111.227.137:8080
-
159.89.202.34:443
-
110.232.117.186:8080
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Invoice Number 979646.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\114404.tmp"2⤵
- Process spawned unexpected child process
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\HEXFGwdsxR\TdJhRoHW.dll"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
114404.tmp
114404.tmp
114526.zip
TdJhRoHW.dll
memory/1588-137-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp
memory/1588-135-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp
memory/1588-139-0x00007FF840A10000-0x00007FF840A20000-memory.dmp
memory/1588-151-0x00000148649F0000-0x0000014864C4F000-memory.dmp
memory/1588-133-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp
memory/1588-220-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp
memory/1588-136-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp
memory/1588-138-0x00007FF840A10000-0x00007FF840A20000-memory.dmp
memory/1588-222-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp
memory/1588-134-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp
memory/1588-215-0x00000148649F0000-0x0000014864C4F000-memory.dmp
memory/1588-219-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp
memory/1588-221-0x00007FF842D90000-0x00007FF842DA0000-memory.dmp
memory/3484-195-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/3484-192-0x0000000000E00000-0x0000000000E2D000-memory.dmp