Analysis

  • max time kernel
    52s
  • max time network
    141s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-03-2023 22:21

General

  • Target

    091d65cc343eab8301709efb9461703e8302e0fb52f4121bc20dd073431e32cd.doc

  • Size

    208KB

  • MD5

    96ab4a29276cee6daaf4d99286d3402b

  • SHA1

    56a1c1ca9a23b6ee7cdd4bbcc321b6a5263eaedd

  • SHA256

    091d65cc343eab8301709efb9461703e8302e0fb52f4121bc20dd073431e32cd

  • SHA512

    dce4b4afda601436f92ce24271a7e13434dfdb64d6b7a3516197eed960d0137f967df4302b9afb2d18c7f664d22215dfd4488fef6404dffeb7bd00bca817a1a8

  • SSDEEP

    3072:Xe054HEKTduag1iUJ8y9fDfl5a1QqzAwrUGtlz:1ycbEUJ8+bLaOqzAclz

Malware Config

Extracted

Family

emotet

Botnet

Epoch4

C2

213.239.212.5:443

129.232.188.93:443

103.43.75.120:443

197.242.150.244:8080

1.234.2.232:8080

110.232.117.186:8080

95.217.221.146:8080

159.89.202.34:443

159.65.88.10:8080

82.223.21.224:8080

169.57.156.166:8080

45.176.232.124:443

45.235.8.30:8080

173.212.193.249:8080

107.170.39.149:8080

119.59.103.152:8080

167.172.199.165:8080

91.207.28.33:8080

185.4.135.165:8080

104.168.155.143:8080

eck1.plain
ecs1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\091d65cc343eab8301709efb9461703e8302e0fb52f4121bc20dd073431e32cd.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3796
    • C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\232142.tmp"
      2⤵
      • Process spawned unexpected child process
      PID:4360
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GgdsDpWtyM\kTfOBkpmjE.dll"
        3⤵
          PID:1184

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    3
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\232142.tmp
      Filesize

      301.4MB

      MD5

      48c3f441c540f6baa6073c1d21bf6006

      SHA1

      8e75484c9f102baa24373b709c52efc73ad2210e

      SHA256

      1ced7bb5b15ae4efad1e1a93c171388924a8e15d77e516c1bfe3894dd23ec1b6

      SHA512

      07b78ba4d72da4fbc9699c7d6b00c4d0ec49d1bc2c423f0416beb3305e6deb63aee9d2bb408e5d1b36b93185a0db3bc25f7b1cfc3b53b3575b1b7863fc72f8b5

    • C:\Users\Admin\AppData\Local\Temp\232217.zip
      Filesize

      957KB

      MD5

      5d1329c1d2495c55a15c691b25a2841c

      SHA1

      8a236f176708c39b19801e57e4e1b1794583f78f

      SHA256

      9dcf4ee48d9b986ad1c8e55ea10f51c3ce8067ca99daca0ab7d0b37f3106e1b6

      SHA512

      8c1b1240a3324a9266d717863072e9bd93f15c112c57c671bdb0832bb8e278705bdc4497c96eb0c12c74f667f4a4fcdf375fbd9380535c669268df5f4a226200

    • \Users\Admin\AppData\Local\Temp\232142.tmp
      Filesize

      301.1MB

      MD5

      d7ad7f674507ccc04a2d2ce559c50c8d

      SHA1

      7741a6af2a0c7fd8546a2506ac48811e62e9a442

      SHA256

      e606a1f098df18a1be456c29687fe5ffd12a5be2d055dbe8b5eaa855bfc576fe

      SHA512

      355655dcb5f058e9a19ffe01ac63e60d5ef265f5442249350f72f7068661ccbe1adec58fd6145a47852879f2930a7246fac4ad1d558dbc69c4adbe990e419439

    • memory/3796-124-0x00007FFD904B0000-0x00007FFD904C0000-memory.dmp
      Filesize

      64KB

    • memory/3796-127-0x00007FFD8D690000-0x00007FFD8D6A0000-memory.dmp
      Filesize

      64KB

    • memory/3796-128-0x00007FFD8D690000-0x00007FFD8D6A0000-memory.dmp
      Filesize

      64KB

    • memory/3796-121-0x00007FFD904B0000-0x00007FFD904C0000-memory.dmp
      Filesize

      64KB

    • memory/3796-123-0x00007FFD904B0000-0x00007FFD904C0000-memory.dmp
      Filesize

      64KB

    • memory/3796-122-0x00007FFD904B0000-0x00007FFD904C0000-memory.dmp
      Filesize

      64KB

    • memory/3796-443-0x00007FFD904B0000-0x00007FFD904C0000-memory.dmp
      Filesize

      64KB

    • memory/3796-442-0x00007FFD904B0000-0x00007FFD904C0000-memory.dmp
      Filesize

      64KB

    • memory/3796-444-0x00007FFD904B0000-0x00007FFD904C0000-memory.dmp
      Filesize

      64KB

    • memory/3796-441-0x00007FFD904B0000-0x00007FFD904C0000-memory.dmp
      Filesize

      64KB

    • memory/4360-333-0x00000000024B0000-0x000000000250A000-memory.dmp
      Filesize

      360KB

    • memory/4360-340-0x0000000000B90000-0x0000000000B91000-memory.dmp
      Filesize

      4KB