Play interactive tour
Edit tourWindows Analysis Report ggnlRjkfr4
Overview
General Information
| Sample Name: | ggnlRjkfr4 (renamed file extension from none to xls) |
| Analysis ID: | 544305 |
| MD5: | 6c23aab5ed898b3b5629c8c6a91c96c3 |
| SHA1: | 603910f1c1df4c58bf59eec256d6957f0e0a9184 |
| SHA256: | bb1f500a59544aa8e44a0377cc506dfbebca1ecb7a8c73dc72d3268803976ff5 |
| Tags: | excelxlsx |
| Infos: | |
Most interesting Screenshot:  | |
Detection
Hidden Macro 4.0 Emotet
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected Emotet
Antivirus detection for URL or domain
Sigma detected: Suspicious MSHTA Process Patterns
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: Suspicious PowerShell Command Line
Powershell drops PE file
Sigma detected: MSHTA Spawning Windows Shell
Found Excel 4.0 Macro with suspicious formulas
Obfuscated command line found
Tries to detect virtualization through RDTSC time measurements
Sigma detected: Mshta Spawning Windows Shell
C2 URLs / IPs found in malware configuration
Document exploit detected (process start blacklist hit)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Potential document exploit detected (performs DNS queries)
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Downloads executable code via HTTP
Contains functionality for execution timing, often used to detect debuggers
Document misses a certain OLE stream usually present in this Microsoft Office document type
Abnormal high CPU Usage
Enables debug privileges
Found a hidden Excel 4.0 Macro sheet
Potential document exploit detected (unknown TCP traffic)
Searches for the Microsoft Outlook file path
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Yara detected Xls With Macro 4.0
Connects to several IPs in different countries
Creates a window with clipboard capturing capabilities
Document contains embedded VBA macros
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Classification
Process Tree |
|---|
|
Malware Configuration |
|---|
Threatname: Emotet |
|---|
{"C2 list": ["54.37.212.235:80", "45.15.23.184:443", "41.76.108.46:8080", "212.237.5.209:443", "46.55.222.11:443", "207.38.84.195:8080", "103.8.26.102:8080", "138.185.72.26:8080", "104.251.214.46:8080", "110.232.117.186:8080", "51.68.175.8:8080", "176.104.106.96:8080", "216.158.226.206:443", "103.8.26.103:8080", "103.75.201.2:443", "210.57.217.132:8080", "195.154.133.20:443", "45.142.114.231:8080", "107.182.225.142:8080", "158.69.222.101:443", "45.118.115.99:8080", "192.254.71.210:443", "178.79.147.66:8080", "203.114.109.124:443", "212.237.56.116:7080", "173.212.193.249:8080", "58.227.42.236:80", "50.116.54.215:443", "162.214.50.39:7080", "45.118.135.203:7080", "212.237.17.99:8080", "81.0.236.90:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2"]}Yara Overview |
|---|
Initial Sample |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| SUSP_EnableContent_String_Gen | Detects suspicious string that asks to enable active content in Office Doc | Florian Roth |
| |
| SUSP_Excel4Macro_AutoOpen | Detects Excel4 macro use with auto open / close | John Lambert @JohnLaTwC |
| |
| JoeSecurity_XlsWithMacro4 | Yara detected Xls With Macro 4.0 | Joe Security |
Memory Dumps |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
| JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security |
Unpacked PEs |
|---|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security | ||
| JoeSecurity_Emotet_1 | Yara detected Emotet | Joe Security |
Sigma Overview |
|---|
System Summary: |   |
|---|
| Sigma detected: Suspicious MSHTA Process Patterns | Show sources | ||
| Source: | Author: Florian Roth: | ||
| Sigma detected: Microsoft Office Product Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: | ||
| Sigma detected: Suspicious PowerShell Command Line | Show sources | ||
| Source: | Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): | ||
| Sigma detected: MSHTA Spawning Windows Shell | Show sources | ||
| Source: | Author: Michael Haag: | ||
| Sigma detected: Mshta Spawning Windows Shell | Show sources | ||
| Source: | Author: Florian Roth: | ||
| Sigma detected: Non Interactive PowerShell | Show sources | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
Jbx Signature Overview |
|---|
Click to jump to signature section
Show All Signature Results
AV Detection: | |
|---|
| Found malware configuration | Show sources | ||
| Source: | Malware Configuration Extractor: | ||
| Multi AV Scanner detection for submitted file | Show sources | ||
| Source: | Virustotal: | Perma Link | ||
| Antivirus detection for URL or domain | Show sources | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 8_2_729CB634 | |
| Source: | Code function: | 8_2_729CB581 | |
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
Software Vulnerabilities: | |
|---|
| Document exploit detected (process start blacklist hit) | Show sources | ||
| Source: | Process created: | ||
| Source: | DNS query: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
Networking: | |
|---|
| C2 URLs / IPs found in malware configuration | Show sources | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | IPs: | ||
| Source: | ASN Name: | ||
| Source: | ASN Name: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | IP Address: | ||
| Source: | IP Address: | ||
| Source: | HTTP traffic detected: | ||