Analysis

  • max time kernel
    145s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    17-03-2023 03:33

General

  • Target

    G-1048.doc

  • Size

    518.3MB

  • MD5

    7d7db707e071ac52671b16dd16efdd9e

  • SHA1

    5e12e817cafea907aa156e79c7e2cc55c6b681e0

  • SHA256

    1265914cccdafd5770969ebfc4aa9ebdecb5363d3c87036b61ef6e7ba37b4d92

  • SHA512

    c572cfc0924b7509499f3d4089fb575f2cf27c7346dc5da0a7c0695f9e52f5d74685f794e312198f2254c01962d9d1bfc91e187a7195e78fe450e30954aeafe6

  • SSDEEP

    6144:ip32/gDd0Nmt71wFmSWjfDrV8YQnZocbyrX4NqclWL9:ip32SEmtJwFmhjfPtrXqqyW

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.85.95.4:8080

103.224.241.74:8080

178.238.225.252:8080

37.59.103.148:8080

78.47.204.80:443

138.197.14.67:8080

128.199.242.164:8080

54.37.228.122:443

37.44.244.177:8080

139.59.80.108:8080

218.38.121.17:443

82.98.180.154:7080

114.79.130.68:443

159.65.135.222:7080

174.138.33.49:7080

195.77.239.39:8080

193.194.92.175:443

198.199.70.22:8080

85.214.67.203:8080

93.84.115.205:7080

ecs1.plain
eck1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\G-1048.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1744
      • C:\Windows\SysWOW64\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\033359.tmp"
        2⤵
        • Process spawned unexpected child process
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1972
        • C:\Windows\system32\regsvr32.exe
          /s "C:\Users\Admin\AppData\Local\Temp\033359.tmp"
          3⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1628
          • C:\Windows\system32\regsvr32.exe
            C:\Windows\system32\regsvr32.exe "C:\Windows\system32\JFMJCiWQdZs\AfPfWWxnLueI.dll"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1708

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\033359.tmp
      Filesize

      645KB

      MD5

      6f262e779fc26d8dd89c942c744eecba

      SHA1

      7e1221991f652f468b71b0050276f6588f3ab562

      SHA256

      0b8682fe1ee1d9a8ad485452179e9c8651c682660591077e0fb7077e89af81bd

      SHA512

      5831b66c566ef87fddd33c22fe1120c451477f298da66bc48813445470f28ab767d19f02127547d2652be11f01650c0f9b2a1b3a13d2d2d523cd58d53208ca20

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      9abed40f3eb16fbe96fcf415eff25d5a

      SHA1

      270d25535d5f395ecdc341597616a19c6000eab3

      SHA256

      fc0b001c64dd3307f56842961cb55ee223c5d607765b03690f188546d1d0a06d

      SHA512

      451dc59dd638e9685a7ed49c7dedb702978de661dd228193b27c3d876dabe51137a19d9bb599863cc7e52b3ceaf63f0cf13b7ec8fc136f787faf97ba78056e7b

    • \Users\Admin\AppData\Local\Temp\033359.tmp
      Filesize

      645KB

      MD5

      6f262e779fc26d8dd89c942c744eecba

      SHA1

      7e1221991f652f468b71b0050276f6588f3ab562

      SHA256

      0b8682fe1ee1d9a8ad485452179e9c8651c682660591077e0fb7077e89af81bd

      SHA512

      5831b66c566ef87fddd33c22fe1120c451477f298da66bc48813445470f28ab767d19f02127547d2652be11f01650c0f9b2a1b3a13d2d2d523cd58d53208ca20

    • \Users\Admin\AppData\Local\Temp\033359.tmp
      Filesize

      645KB

      MD5

      6f262e779fc26d8dd89c942c744eecba

      SHA1

      7e1221991f652f468b71b0050276f6588f3ab562

      SHA256

      0b8682fe1ee1d9a8ad485452179e9c8651c682660591077e0fb7077e89af81bd

      SHA512

      5831b66c566ef87fddd33c22fe1120c451477f298da66bc48813445470f28ab767d19f02127547d2652be11f01650c0f9b2a1b3a13d2d2d523cd58d53208ca20

    • memory/1616-54-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1616-1468-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1628-1443-0x0000000000320000-0x000000000034C000-memory.dmp
      Filesize

      176KB

    • memory/1628-1450-0x0000000000120000-0x0000000000121000-memory.dmp
      Filesize

      4KB