Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 06:22
Behavioral task
behavioral1
Sample
1.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1.xls
Resource
win10v2004-20230221-en
General
-
Target
1.xls
-
Size
255KB
-
MD5
a1a832bedb8e1773a616cfe4ea57667d
-
SHA1
e6b7d0279681155adbaa6ae520ebdca55591d0a3
-
SHA256
655d910f284bd28364f826c9001492dc528846a392c10052c4ba1d1e4e436762
-
SHA512
2a68205052c9b8665ba9668493fcd54f4f4af27a97b1048e3776cf7cc7fedc70231cc23018effb49cd4d298a2be03c0c86bae18e3ce99f1f79cf8a1960a499c8
-
SSDEEP
6144:bKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgzmnaVGraWWqXqzzyd17O6t0RmUoBQ:aXWWqazOd165RmvQ
Malware Config
Extracted
https://datie-tw.com/img/SvH/
http://central-nutrition.com/wp-content/Nh1L6YR4qlDFWS58cVB/
http://championsfactorysampaios.com.br/xt5HKu/tDs8WsKOxQFq/
https://dacsandongthapmuoi.vn/system/cron/HwOtNCFo/
Extracted
emotet
Epoch5
178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1248 2120 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4092 2120 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4088 2120 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 936 2120 regsvr32.exe EXCEL.EXE -
Downloads MZ/PE file
-
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 936 regsvr32.exe 3252 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cqoUmz.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\BLfKNmSxbyuibe\\cqoUmz.dll\"" regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2120 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
regsvr32.exeregsvr32.exepid process 936 regsvr32.exe 936 regsvr32.exe 3252 regsvr32.exe 3252 regsvr32.exe 3252 regsvr32.exe 3252 regsvr32.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE 2120 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
EXCEL.EXEregsvr32.exedescription pid process target process PID 2120 wrote to memory of 1248 2120 EXCEL.EXE regsvr32.exe PID 2120 wrote to memory of 1248 2120 EXCEL.EXE regsvr32.exe PID 2120 wrote to memory of 4092 2120 EXCEL.EXE regsvr32.exe PID 2120 wrote to memory of 4092 2120 EXCEL.EXE regsvr32.exe PID 2120 wrote to memory of 4088 2120 EXCEL.EXE regsvr32.exe PID 2120 wrote to memory of 4088 2120 EXCEL.EXE regsvr32.exe PID 2120 wrote to memory of 936 2120 EXCEL.EXE regsvr32.exe PID 2120 wrote to memory of 936 2120 EXCEL.EXE regsvr32.exe PID 936 wrote to memory of 3252 936 regsvr32.exe regsvr32.exe PID 936 wrote to memory of 3252 936 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv1.ooccxx2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv2.ooccxx2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv3.ooccxx2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exeC:\Windows\System32\regsvr32.exe /S ..\oxnv4.ooccxx2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\BLfKNmSxbyuibe\cqoUmz.dll"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\oxnv2.ooccxxFilesize
888B
MD5998bed8bb5fb5a2207b8d94268d1e0b9
SHA158f3f1208b7d8d2fd0298dd804ebab5d3d91b40c
SHA2564dd3d615813a715cd47725ce1afc19ba31787b11523081a307288a1aa0ad509c
SHA5122c4626646fc8a48344c6de7c470a4cb5c956690ebcd34aecb5418ab29fe2866075838352b413cab34125d00fa55f5c10d40815e839c31192ca2072cfcb614529
-
C:\Users\Admin\oxnv3.ooccxxFilesize
773B
MD5b30aa7e985bf41477a23491eae987ae6
SHA10541fa57c2a8debf5c428d8cd6fbe74c81e4794a
SHA2561e3aa4cbfb10fad2b2ad72b0634d574d051b75febda62f664cfa03eacbfdbf9b
SHA512db7b5fdbcb0ea13058912c8574bb4d84ad002e561cddc8b512c801d7b3bed762556ed683b22a06a9ec058148487231f252314b52206aa1468a6e2c85ccd2aec5
-
C:\Users\Admin\oxnv4.ooccxxFilesize
570KB
MD5ee15dbb42e1c2d8f5b3e2a8558994d54
SHA1f92371dee2dfb9fdaabdf8c36d8f2ef614972ade
SHA25677e8629423878a042c368984a1c567194b97b05bbd240f6be6fd0c4366f82b3b
SHA5123a1b7c8286c6ad179a29fa1edd720db50f77e263acf92e0a08a2d43733f33015b11fee6e9e0989109a86535e35724b55da558354e22b9ba824944bd057b95b3a
-
C:\Users\Admin\oxnv4.ooccxxFilesize
570KB
MD5ee15dbb42e1c2d8f5b3e2a8558994d54
SHA1f92371dee2dfb9fdaabdf8c36d8f2ef614972ade
SHA25677e8629423878a042c368984a1c567194b97b05bbd240f6be6fd0c4366f82b3b
SHA5123a1b7c8286c6ad179a29fa1edd720db50f77e263acf92e0a08a2d43733f33015b11fee6e9e0989109a86535e35724b55da558354e22b9ba824944bd057b95b3a
-
C:\Windows\System32\BLfKNmSxbyuibe\cqoUmz.dllFilesize
570KB
MD5ee15dbb42e1c2d8f5b3e2a8558994d54
SHA1f92371dee2dfb9fdaabdf8c36d8f2ef614972ade
SHA25677e8629423878a042c368984a1c567194b97b05bbd240f6be6fd0c4366f82b3b
SHA5123a1b7c8286c6ad179a29fa1edd720db50f77e263acf92e0a08a2d43733f33015b11fee6e9e0989109a86535e35724b55da558354e22b9ba824944bd057b95b3a
-
memory/936-178-0x0000000001160000-0x0000000001161000-memory.dmpFilesize
4KB
-
memory/936-172-0x0000000180000000-0x0000000180030000-memory.dmpFilesize
192KB
-
memory/2120-136-0x00007FFAC4410000-0x00007FFAC4420000-memory.dmpFilesize
64KB
-
memory/2120-139-0x00007FFAC2200000-0x00007FFAC2210000-memory.dmpFilesize
64KB
-
memory/2120-138-0x00007FFAC2200000-0x00007FFAC2210000-memory.dmpFilesize
64KB
-
memory/2120-137-0x00007FFAC4410000-0x00007FFAC4420000-memory.dmpFilesize
64KB
-
memory/2120-133-0x00007FFAC4410000-0x00007FFAC4420000-memory.dmpFilesize
64KB
-
memory/2120-134-0x00007FFAC4410000-0x00007FFAC4420000-memory.dmpFilesize
64KB
-
memory/2120-135-0x00007FFAC4410000-0x00007FFAC4420000-memory.dmpFilesize
64KB