Resubmissions

19-03-2023 10:48

230319-mwcnraga54 10

19-03-2023 10:03

230319-l3pffsfh76 4

Analysis

  • max time kernel
    133s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-03-2023 10:48

General

  • Target

    2ab79bee-2569-4172-a936-9bbdff78a6d0.one

  • Size

    130KB

  • MD5

    46834650761c4b600e7f03160f3409b6

  • SHA1

    2732fa105dc7e6b8edd2ec6fef01fb2905ef4dfa

  • SHA256

    88b0df77fd1b775c3e069c2b22fd3e3c61f31e0c0792a939f89ff72b9d2b3f85

  • SHA512

    0eeeb34796fcae5a0954fefa0fc432e05808612718eccb546fe22429f5846da0f5fc6dedb5170347528d389594c25e16dd1394c75a99cd1227a6982b2e33bfbf

  • SSDEEP

    3072:PrfWMINYf3K19kzCnEEQvSMVnte8ZP1Y6J0cTgGn:d6nInM8TXJ5n

Malware Config

Extracted

Family

emotet

Botnet

Epoch5

C2

103.85.95.4:8080

103.224.241.74:8080

178.238.225.252:8080

37.59.103.148:8080

78.47.204.80:443

138.197.14.67:8080

128.199.242.164:8080

54.37.228.122:443

37.44.244.177:8080

139.59.80.108:8080

218.38.121.17:443

82.98.180.154:7080

114.79.130.68:443

159.65.135.222:7080

174.138.33.49:7080

195.77.239.39:8080

193.194.92.175:443

198.199.70.22:8080

85.214.67.203:8080

93.84.115.205:7080

ecs1.plain
eck1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\2ab79bee-2569-4172-a936-9bbdff78a6d0.one"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{27578566-736B-4806-8CB6-8338F3073F0F}\NT\0\click.wsf"
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Windows\System32\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{27578566-736B-4806-8CB6-8338F3073F0F}\NT\0\radC2358.tmp.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3436
        • C:\Windows\system32\regsvr32.exe
          C:\Windows\system32\regsvr32.exe "C:\Windows\system32\SgdNahtBMBTq\RFdOX.dll"
          4⤵
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          PID:3496

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BL.bin
    Filesize

    61KB

    MD5

    45282862aeb428ffb5d4986704a8f4d5

    SHA1

    fa2b0a82f3ca6bc7c00704556c9494b303613972

    SHA256

    af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

    SHA512

    db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BM.bin
    Filesize

    48KB

    MD5

    b7fc313714edd7866f4c76527282c2b5

    SHA1

    c86217b46956933fae4a30483a63b33f34b8c503

    SHA256

    b6d25f5eb52d5c24ef6c325bd25f18e413f3e23d20413a3693749275ba4b192c

    SHA512

    038a73b7a69dd976c964f1538f5b4f7c6c64721e4f2f1a831815598faae84cac53305c03f5cea6e66acdc110a9a5117eee191345ea004b9576c752122f8d88f7

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BN.bin
    Filesize

    567B

    MD5

    d055ce625528e448c61315eaaef5bb71

    SHA1

    029df4c872b1c154f32e7fe94f434547c3ba6192

    SHA256

    85bf1e672b4e86e9af0c7874681ec9620dfdc78e0335b83eef38c17d813b6705

    SHA512

    705b6b729e967fa946469571109aa892f5cb55a01c74d40ae02140d10cbf9b65dd5e511c06ebfe494e407742f8c6f4fbbe88664b78b37abfb2f19db1f66f4247

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BP.bin
    Filesize

    9B

    MD5

    07f5a0cffd9b2616ea44fb90ccc04480

    SHA1

    641b12c5ffa1a31bc367390e34d441a9ce1958ee

    SHA256

    a0430a038e7d879375c9ca5bf94cb440a3b9a002712118a7bccc1ff82f1ea896

    SHA512

    09e7488c138dead45343a79ad0cb37036c5444606cdfd8aa859ee70227a96964376a17f07e03d0fc353708ca9aaf979abf8bc917e6c2d005a0052575e074f531

  • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{27578566-736B-4806-8CB6-8338F3073F0F}\NT\0\click.wsf
    Filesize

    61KB

    MD5

    45282862aeb428ffb5d4986704a8f4d5

    SHA1

    fa2b0a82f3ca6bc7c00704556c9494b303613972

    SHA256

    af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e

    SHA512

    db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db

  • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{27578566-736B-4806-8CB6-8338F3073F0F}\NT\0\click.wsf
    Filesize

    9B

    MD5

    07f5a0cffd9b2616ea44fb90ccc04480

    SHA1

    641b12c5ffa1a31bc367390e34d441a9ce1958ee

    SHA256

    a0430a038e7d879375c9ca5bf94cb440a3b9a002712118a7bccc1ff82f1ea896

    SHA512

    09e7488c138dead45343a79ad0cb37036c5444606cdfd8aa859ee70227a96964376a17f07e03d0fc353708ca9aaf979abf8bc917e6c2d005a0052575e074f531

  • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{27578566-736B-4806-8CB6-8338F3073F0F}\NT\0\radC2358.tmp.dll
    Filesize

    561KB

    MD5

    c901c8089c5e017f8e9b4b15c8ef154f

    SHA1

    336c2bea43bfa2e8afd27a164dba640f36c0013c

    SHA256

    fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a

    SHA512

    9ff052f9fc9cc3cf74b170f76d6a20a01c5dbb74b2d97edc9e55b75f52b408f3104e49bf290773bd63d216f2787d945aa7d954b58e927c99e1db18c6a7d74ade

  • C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{27578566-736B-4806-8CB6-8338F3073F0F}\NT\0\radC2358.tmp.dll
    Filesize

    561KB

    MD5

    c901c8089c5e017f8e9b4b15c8ef154f

    SHA1

    336c2bea43bfa2e8afd27a164dba640f36c0013c

    SHA256

    fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a

    SHA512

    9ff052f9fc9cc3cf74b170f76d6a20a01c5dbb74b2d97edc9e55b75f52b408f3104e49bf290773bd63d216f2787d945aa7d954b58e927c99e1db18c6a7d74ade

  • C:\Windows\System32\SgdNahtBMBTq\RFdOX.dll
    Filesize

    561KB

    MD5

    c901c8089c5e017f8e9b4b15c8ef154f

    SHA1

    336c2bea43bfa2e8afd27a164dba640f36c0013c

    SHA256

    fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6d9a5210be414a5cc5a

    SHA512

    9ff052f9fc9cc3cf74b170f76d6a20a01c5dbb74b2d97edc9e55b75f52b408f3104e49bf290773bd63d216f2787d945aa7d954b58e927c99e1db18c6a7d74ade

  • memory/1172-137-0x00007FFAE6A50000-0x00007FFAE6A60000-memory.dmp
    Filesize

    64KB

  • memory/1172-139-0x00007FFAE4720000-0x00007FFAE4730000-memory.dmp
    Filesize

    64KB

  • memory/1172-138-0x00007FFAE4720000-0x00007FFAE4730000-memory.dmp
    Filesize

    64KB

  • memory/1172-133-0x00007FFAE6A50000-0x00007FFAE6A60000-memory.dmp
    Filesize

    64KB

  • memory/1172-136-0x00007FFAE6A50000-0x00007FFAE6A60000-memory.dmp
    Filesize

    64KB

  • memory/1172-135-0x00007FFAE6A50000-0x00007FFAE6A60000-memory.dmp
    Filesize

    64KB

  • memory/1172-134-0x00007FFAE6A50000-0x00007FFAE6A60000-memory.dmp
    Filesize

    64KB

  • memory/1516-214-0x000002624EF20000-0x000002624EF5B000-memory.dmp
    Filesize

    236KB

  • memory/3436-190-0x00000000023C0000-0x00000000023EC000-memory.dmp
    Filesize

    176KB

  • memory/3436-193-0x0000000000B50000-0x0000000000B51000-memory.dmp
    Filesize

    4KB