dc58e47ae7ee4c62f5733e94de8e157de3cb6b3b21f013ea1fc6d923f47a6e69

General

Target

INV20200716CATALOG_DESIGN_PO.xlsx
Size

14KB
MD5

9a8024a499fbd0528ce3a41f641225b4
SHA1

ee2d4450412bb4092d62168a43a4e66a8eae4e8a
SHA256

dc58e47ae7ee4c62f5733e94de8e157de3cb6b3b21f013ea1fc6d923f47a6e69
SHA512

37e3f683a4a15e6c5b7d1310685c785e05475d31bba592ef8b65fdc54095b51e2698082c9d8bc09910f368e1b2f3ad0df8bd167eabdf8b0b85122ff8e94dea06

Score

8^/10

spyware

Malware Config

Signatures

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 1096	1432	EQNEDT32.EXE	27
PID 1432 wrote to memory of 1096	1432	EQNEDT32.EXE	27
PID 1432 wrote to memory of 1096	1432	EQNEDT32.EXE	27
PID 1432 wrote to memory of 1096	1432	EQNEDT32.EXE	27
PID 1096 wrote to memory of 1856	1096	regasms.exe	29
PID 1096 wrote to memory of 1856	1096	regasms.exe	29
PID 1096 wrote to memory of 1856	1096	regasms.exe	29
PID 1096 wrote to memory of 1856	1096	regasms.exe	29
PID 1096 wrote to memory of 1856	1096	regasms.exe	29
PID 1096 wrote to memory of 1856	1096	regasms.exe	29
PID 1096 wrote to memory of 1856	1096	regasms.exe	29
PID 1096 wrote to memory of 1856	1096	regasms.exe	29
PID 1096 wrote to memory of 1856	1096	regasms.exe	29

Executes dropped EXE 2 IoCs

pid	Process
1096	regasms.exe
1856	regasms.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1096 set thread context of 1856	1096	regasms.exe	29

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1856	regasms.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1856	regasms.exe
1856	regasms.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1060	EXCEL.EXE

Blacklisted process makes network request 1 IoCs

flow	pid	Process
5	1432	EQNEDT32.EXE

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
1432	EQNEDT32.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1060	EXCEL.EXE
1060	EXCEL.EXE
1060	EXCEL.EXE
1856	regasms.exe

Loads dropped DLL 1 IoCs

pid	Process
1432	EQNEDT32.EXE

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\INV20200716CATALOG_DESIGN_PO.xlsx
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1060

C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Suspicious use of WriteProcessMemory
- Blacklisted process makes network request
- Launches Equation Editor
- Loads dropped DLL
PID:1432
- C:\Users\Admin\AppData\Roaming\regasms.exe
  C:\Users\Admin\AppData\Roaming\regasms.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1096
- - C:\Users\Admin\AppData\Roaming\regasms.exe
    "{path}"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-6-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1856-9-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1856-10-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download

Analysis

Sharing