Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 21:35

General

  • Target

    c911d0ce249b8f215c7b5a8fc5b8e5d02bdf4c5566a2d1727a40bc23fca46c5a.xls

  • Size

    40KB

  • MD5

    b5bda83d748d7e6a1f44b3a18a51fdfe

  • SHA1

    658c6abda0b3730c50e1e2298b5954193ff8a983

  • SHA256

    c911d0ce249b8f215c7b5a8fc5b8e5d02bdf4c5566a2d1727a40bc23fca46c5a

  • SHA512

    fbd9196360afae95de5bc5df1aca5ed434f372d219fb495e51bf1c11cf331c7e0e68cdc9ba3445f03b5745c2ccd94b921cfba5b6d1d3378db829ce173e67e635

  • SSDEEP

    768:pkZKpb8rGYrMPe3q7Q0XV5xtezEs/68/dgAdCBn9kC+xbqc6q+otrvEVLcAA:p+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/d5

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.itesmeitic.com/term/IFjx5ElE0ldr8wDDHjub/

xlm40.dropper

https://www.ingonherbal.com/application/PhEbceg4Tx/

Extracted

Family

emotet

Botnet

Epoch4

C2

131.100.24.231:80

103.132.242.26:8080

167.172.253.162:8080

149.56.131.28:8080

209.126.98.206:8080

188.44.20.25:443

212.237.17.99:8080

129.232.188.93:443

160.16.142.56:8080

46.55.222.11:443

1.234.2.232:8080

45.235.8.30:8080

185.157.82.211:8080

158.69.222.101:443

185.4.135.165:8080

27.54.89.58:8080

197.242.150.244:8080

153.126.146.25:7080

183.111.227.137:8080

103.75.201.2:443

ecs1.plain
eck1.plain

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Emotet family
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\c911d0ce249b8f215c7b5a8fc5b8e5d02bdf4c5566a2d1727a40bc23fca46c5a.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Windows\System32\regsvr32.exe
      C:\Windows\System32\regsvr32.exe ..\wurod.ocx
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4964
      • C:\Windows\system32\regsvr32.exe
        C:\Windows\system32\regsvr32.exe "C:\Windows\system32\PwBdCkHvbXI\ZaLHUtZ.dll"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4316

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\wurod.ocx

          Filesize

          532KB

          MD5

          477ae271369180cbbb395906dd62cc99

          SHA1

          71286680dd8b667ea88fcd8424cb4fd9b33816d4

          SHA256

          d8d1c87acea954ae4167c6d3524063f44e40019b0995fecbb1ac22b49b404db6

          SHA512

          95b610e74cb77938e640c60dfe066c472aac0d78dfb501f03151cccaf22ac23de399e20f29ea1a3d073a40e4624fb741fddb19007f0fdf726252e8ec2022e80a

        • memory/4316-53-0x0000000180000000-0x0000000180030000-memory.dmp

          Filesize

          192KB

        • memory/4500-10-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4500-12-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4500-5-0x00007FFA3C650000-0x00007FFA3C660000-memory.dmp

          Filesize

          64KB

        • memory/4500-9-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4500-8-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4500-11-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4500-13-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4500-4-0x00007FFA3C650000-0x00007FFA3C660000-memory.dmp

          Filesize

          64KB

        • memory/4500-7-0x00007FFA3C650000-0x00007FFA3C660000-memory.dmp

          Filesize

          64KB

        • memory/4500-15-0x00007FFA3A3E0000-0x00007FFA3A3F0000-memory.dmp

          Filesize

          64KB

        • memory/4500-6-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4500-0-0x00007FFA3C650000-0x00007FFA3C660000-memory.dmp

          Filesize

          64KB

        • memory/4500-14-0x00007FFA3A3E0000-0x00007FFA3A3F0000-memory.dmp

          Filesize

          64KB

        • memory/4500-3-0x00007FFA3C650000-0x00007FFA3C660000-memory.dmp

          Filesize

          64KB

        • memory/4500-25-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4500-26-0x00007FFA7C66D000-0x00007FFA7C66E000-memory.dmp

          Filesize

          4KB

        • memory/4500-27-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4500-2-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4500-1-0x00007FFA7C66D000-0x00007FFA7C66E000-memory.dmp

          Filesize

          4KB

        • memory/4964-46-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4964-47-0x00007FFA58EF0000-0x00007FFA58F79000-memory.dmp

          Filesize

          548KB

        • memory/4964-48-0x00007FFA7C5D0000-0x00007FFA7C7C5000-memory.dmp

          Filesize

          2.0MB

        • memory/4964-43-0x0000000180000000-0x0000000180030000-memory.dmp

          Filesize

          192KB