Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 17:36

General

  • Target

    f29002bbf4f3da19b6173627c53d90ac653a44c0614aaa46e264a6bb2e3539a7.xls

  • Size

    40KB

  • MD5

    43404c9ff5a00c28704e25a7b8d2de3e

  • SHA1

    f82b66098bf91ef2e63f500480d1c8ebf5db7d28

  • SHA256

    f29002bbf4f3da19b6173627c53d90ac653a44c0614aaa46e264a6bb2e3539a7

  • SHA512

    2d90e0fb7bd4ebc69efd3763e2e9b38e9d7d7108f8f820d8afcfbe9fd8303b8bc620a1c95efb4c30882e6c8c25179561a5f4523b1df4001c487fe636153a7b8d

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAI:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

xlm40.dropper

https://www.ingonherbal.com/application/PhEbceg4Tx/

Extracted

Family

emotet

Botnet

Epoch4

C2

131.100.24.231:80

103.132.242.26:8080

167.172.253.162:8080

149.56.131.28:8080

209.126.98.206:8080

188.44.20.25:443

212.237.17.99:8080

129.232.188.93:443

160.16.142.56:8080

46.55.222.11:443

1.234.2.232:8080

45.235.8.30:8080

185.157.82.211:8080

158.69.222.101:443

185.4.135.165:8080

27.54.89.58:8080

197.242.150.244:8080

153.126.146.25:7080

183.111.227.137:8080

103.75.201.2:443

ecs1.plain
eck1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f29002bbf4f3da19b6173627c53d90ac653a44c0614aaa46e264a6bb2e3539a7.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3948
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe ..\wurod.ocx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QpJlucBwVtTIC\ZWYLdGpw.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    befe9ea0d49ba6e663aff1f3446c55c4

    SHA1

    c0e817038dc3ba8e9ea16f34f8120a5c97c90f7e

    SHA256

    ce557f2d8862984faa1c0c1c112944f969b009d74c2c90be145d8ca512878e79

    SHA512

    88ad2b326ccea6c4dbfa08d7becdcb65fc4f5aa0cc2d90ee16d66478f5245160e3ce8bd931d37ddb89b6d9f90fb49f37da29189440b5c004c4eb4ada0d7dfbaf

  • C:\Users\Admin\wurod.ocx

    Filesize

    532KB

    MD5

    477ae271369180cbbb395906dd62cc99

    SHA1

    71286680dd8b667ea88fcd8424cb4fd9b33816d4

    SHA256

    d8d1c87acea954ae4167c6d3524063f44e40019b0995fecbb1ac22b49b404db6

    SHA512

    95b610e74cb77938e640c60dfe066c472aac0d78dfb501f03151cccaf22ac23de399e20f29ea1a3d073a40e4624fb741fddb19007f0fdf726252e8ec2022e80a

  • memory/3948-15-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-32-0x00007FFCF728D000-0x00007FFCF728E000-memory.dmp

    Filesize

    4KB

  • memory/3948-2-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

    Filesize

    64KB

  • memory/3948-6-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-7-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-9-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-11-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-12-0x00007FFCB4910000-0x00007FFCB4920000-memory.dmp

    Filesize

    64KB

  • memory/3948-10-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-13-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-8-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-4-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

    Filesize

    64KB

  • memory/3948-1-0x00007FFCF728D000-0x00007FFCF728E000-memory.dmp

    Filesize

    4KB

  • memory/3948-0-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

    Filesize

    64KB

  • memory/3948-31-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-19-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-16-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-14-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-18-0x00007FFCB4910000-0x00007FFCB4920000-memory.dmp

    Filesize

    64KB

  • memory/3948-5-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

    Filesize

    64KB

  • memory/3948-33-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3948-3-0x00007FFCB7270000-0x00007FFCB7280000-memory.dmp

    Filesize

    64KB

  • memory/3948-17-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4620-58-0x0000000180000000-0x0000000180030000-memory.dmp

    Filesize

    192KB

  • memory/4972-52-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB

  • memory/4972-54-0x00007FFCD2530000-0x00007FFCD25B9000-memory.dmp

    Filesize

    548KB

  • memory/4972-49-0x0000000180000000-0x0000000180030000-memory.dmp

    Filesize

    192KB

  • memory/4972-59-0x00007FFCF71F0000-0x00007FFCF73E5000-memory.dmp

    Filesize

    2.0MB