Analysis
-
max time kernel
102s -
max time network
72s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 15:37
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.XLM.Trojan.Abracadabra.1.Gen.30953.18655.xls
Resource
win7
Behavioral task
behavioral2
Sample
SecuriteInfo.com.XLM.Trojan.Abracadabra.1.Gen.30953.18655.xls
Resource
win10v200430
General
-
Target
SecuriteInfo.com.XLM.Trojan.Abracadabra.1.Gen.30953.18655.xls
-
Size
690KB
-
MD5
720a5d88e66d53347ac4318371258379
-
SHA1
160be83ca612a9da4ee8c0f445e2c12dc6b4e19e
-
SHA256
617b85bbb3d9c6278c69d899fc91a06f5b843e0db503da23eed661af3626754c
-
SHA512
226a470fdfd271a64320aa87dd7d262515cc6f5af59f7d6d2df3b5443f903da44b0a28f542785a72d2d5111d160a6f8899c03916fdeed0e30daf7f994c932c8c
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
EXCEL.EXEpid process 1452 EXCEL.EXE -
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
Processes:
DW20.EXEdescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 112 1452 DW20.EXE EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEDW20.EXEdescription pid process target process PID 1452 wrote to memory of 112 1452 EXCEL.EXE DW20.EXE PID 1452 wrote to memory of 112 1452 EXCEL.EXE DW20.EXE PID 1452 wrote to memory of 112 1452 EXCEL.EXE DW20.EXE PID 1452 wrote to memory of 112 1452 EXCEL.EXE DW20.EXE PID 1452 wrote to memory of 112 1452 EXCEL.EXE DW20.EXE PID 112 wrote to memory of 736 112 DW20.EXE dwwin.exe PID 112 wrote to memory of 736 112 DW20.EXE dwwin.exe PID 112 wrote to memory of 736 112 DW20.EXE dwwin.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
dwwin.exepid process 736 dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1452 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1452 EXCEL.EXE 1452 EXCEL.EXE 1452 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.XLM.Trojan.Abracadabra.1.Gen.30953.18655.xls1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1452 -
C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE"C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 11562⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 11563⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:736