Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
11-01-2021 18:00
Static task
static1
Behavioral task
behavioral1
Sample
Doc_74657456348374.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Doc_74657456348374.xlsx
Resource
win10v20201028
General
-
Target
Doc_74657456348374.xlsx
-
Size
1.9MB
-
MD5
13bafa262ca4ed3538288d5f86d2ba1c
-
SHA1
a5a883022720a69e6d31a52995d364c2da660478
-
SHA256
185f57d1f0ef4addee6ba740f0439d0d8023d60588d5e7412c0af7c177a1ae21
-
SHA512
62d1c529e438859c9c6a8f44ce7a350ed95ce305c8d687a6f669698a62d7da6917728f92452fd156b1ed0d8e1c490cdb038816737dc10cbffa5e9e3efb7e3f7b
Malware Config
Extracted
formbook
http://www.herbmedia.net/csv8/
slgacha.com
oohdough.com
6983ylc.com
aykassociate.com
latin-hotspot.com
starrockindia.com
beamsubway.com
queensboutique1000.com
madbaddie.com
bhoomimart.com
ankitparivar.com
aldanasanchezmx.com
citest1597669833.com
cristianofreitas.com
myplantus.com
counterfeitmilk.com
8xf39.com
pregnantwomens.com
yyyut6.com
stnanguo.com
fessusesefsee.com
logansshop.net
familydalmatianhomes.com
accessible.legal
epicmassiveconcepts.com
indianfactopedia.com
exit-divorce.com
colliapse.com
nosishop.com
hayat-aljowaily.com
soundon.events
previnacovid19-br.com
traptlongview.com
splendidhotelspa.com
masterzushop.com
ednevents.com
studentdividers.com
treningi-enduro.com
hostingcoaster.com
gourmetgroceriesfast.com
thesouthbeachlife.com
teemergin.com
fixmygearfast.com
arb-invest.com
shemaledreamz.com
1819apparel.com
thedigitalsatyam.com
alparmuhendislik.com
distinctmusicproductions.com
procreditexpert.com
insights4innovation.com
jzbtl.com
1033325.com
sorteocamper.info
scheherazadelegault.com
glowportraiture.com
cleitstaapps.com
globepublishers.com
stattests.com
brainandbodystrengthcoach.com
magenx2.info
escaparati.com
wood-decor24.com
travelnetafrica.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1748-18-0x000000000041D0C0-mapping.dmp xloader behavioral1/memory/1748-17-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1572-19-0x0000000000000000-mapping.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 6 1976 EQNEDT32.EXE -
Executes dropped EXE 1 IoCs
Processes:
vbc.exepid process 1536 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1976 EQNEDT32.EXE 1976 EQNEDT32.EXE 1976 EQNEDT32.EXE 1976 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.execontrol.exedescription pid process target process PID 1536 set thread context of 1748 1536 vbc.exe vbc.exe PID 1748 set thread context of 1260 1748 vbc.exe Explorer.EXE PID 1572 set thread context of 1260 1572 control.exe Explorer.EXE -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1936 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
vbc.exevbc.execontrol.exepid process 1536 vbc.exe 1748 vbc.exe 1748 vbc.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe 1572 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.execontrol.exepid process 1748 vbc.exe 1748 vbc.exe 1748 vbc.exe 1572 control.exe 1572 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevbc.execontrol.exedescription pid process Token: SeDebugPrivilege 1536 vbc.exe Token: SeDebugPrivilege 1748 vbc.exe Token: SeDebugPrivilege 1572 control.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1936 EXCEL.EXE 1936 EXCEL.EXE 1936 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEcontrol.exedescription pid process target process PID 1976 wrote to memory of 1536 1976 EQNEDT32.EXE vbc.exe PID 1976 wrote to memory of 1536 1976 EQNEDT32.EXE vbc.exe PID 1976 wrote to memory of 1536 1976 EQNEDT32.EXE vbc.exe PID 1976 wrote to memory of 1536 1976 EQNEDT32.EXE vbc.exe PID 1536 wrote to memory of 1096 1536 vbc.exe schtasks.exe PID 1536 wrote to memory of 1096 1536 vbc.exe schtasks.exe PID 1536 wrote to memory of 1096 1536 vbc.exe schtasks.exe PID 1536 wrote to memory of 1096 1536 vbc.exe schtasks.exe PID 1536 wrote to memory of 1748 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1748 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1748 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1748 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1748 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1748 1536 vbc.exe vbc.exe PID 1536 wrote to memory of 1748 1536 vbc.exe vbc.exe PID 1260 wrote to memory of 1572 1260 Explorer.EXE control.exe PID 1260 wrote to memory of 1572 1260 Explorer.EXE control.exe PID 1260 wrote to memory of 1572 1260 Explorer.EXE control.exe PID 1260 wrote to memory of 1572 1260 Explorer.EXE control.exe PID 1572 wrote to memory of 1436 1572 control.exe cmd.exe PID 1572 wrote to memory of 1436 1572 control.exe cmd.exe PID 1572 wrote to memory of 1436 1572 control.exe cmd.exe PID 1572 wrote to memory of 1436 1572 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Doc_74657456348374.xlsx2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1936 -
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵PID:1436
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EjZzLtS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAC27.tmp"3⤵
- Creates scheduled task(s)
PID:1096 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAC27.tmpMD5
841f9f2fa723a6c911bb864f682ae3af
SHA11a8eb255827910ce795309216dc9ce1e0b9cd499
SHA2566f0336e4d938965516b9e70cdd78386d8f43ed2c68dabc2d1deacc7eeabba5b7
SHA5127c7e5918f9eea04edaa672f5b0272f55375bf342390cf7eb2807ec595d804171bab3b6866e6f20f86f8c4a5b266f2b5dea87887b55ff2ab545fea512db09c6ba
-
C:\Users\Public\vbc.exeMD5
61b73554fb05d79c58046660462acda8
SHA1a5972374dc0e9377e6b1badeed0a4235d3f43ab0
SHA256d28c56accd73a0c2d4c5a62a288ae12af64ee719ac6060ef2c7ea9be3c5d400f
SHA5126b5f69f1d8acaebbc93c98f8364bd15028031ebe3e41d8d1372b00b1647320af9718b4a4c9a632423e1387d7299d52e30c2657b0b617be53953675bbdf0247ad
-
C:\Users\Public\vbc.exeMD5
61b73554fb05d79c58046660462acda8
SHA1a5972374dc0e9377e6b1badeed0a4235d3f43ab0
SHA256d28c56accd73a0c2d4c5a62a288ae12af64ee719ac6060ef2c7ea9be3c5d400f
SHA5126b5f69f1d8acaebbc93c98f8364bd15028031ebe3e41d8d1372b00b1647320af9718b4a4c9a632423e1387d7299d52e30c2657b0b617be53953675bbdf0247ad
-
\Users\Public\vbc.exeMD5
61b73554fb05d79c58046660462acda8
SHA1a5972374dc0e9377e6b1badeed0a4235d3f43ab0
SHA256d28c56accd73a0c2d4c5a62a288ae12af64ee719ac6060ef2c7ea9be3c5d400f
SHA5126b5f69f1d8acaebbc93c98f8364bd15028031ebe3e41d8d1372b00b1647320af9718b4a4c9a632423e1387d7299d52e30c2657b0b617be53953675bbdf0247ad
-
\Users\Public\vbc.exeMD5
61b73554fb05d79c58046660462acda8
SHA1a5972374dc0e9377e6b1badeed0a4235d3f43ab0
SHA256d28c56accd73a0c2d4c5a62a288ae12af64ee719ac6060ef2c7ea9be3c5d400f
SHA5126b5f69f1d8acaebbc93c98f8364bd15028031ebe3e41d8d1372b00b1647320af9718b4a4c9a632423e1387d7299d52e30c2657b0b617be53953675bbdf0247ad
-
\Users\Public\vbc.exeMD5
61b73554fb05d79c58046660462acda8
SHA1a5972374dc0e9377e6b1badeed0a4235d3f43ab0
SHA256d28c56accd73a0c2d4c5a62a288ae12af64ee719ac6060ef2c7ea9be3c5d400f
SHA5126b5f69f1d8acaebbc93c98f8364bd15028031ebe3e41d8d1372b00b1647320af9718b4a4c9a632423e1387d7299d52e30c2657b0b617be53953675bbdf0247ad
-
\Users\Public\vbc.exeMD5
61b73554fb05d79c58046660462acda8
SHA1a5972374dc0e9377e6b1badeed0a4235d3f43ab0
SHA256d28c56accd73a0c2d4c5a62a288ae12af64ee719ac6060ef2c7ea9be3c5d400f
SHA5126b5f69f1d8acaebbc93c98f8364bd15028031ebe3e41d8d1372b00b1647320af9718b4a4c9a632423e1387d7299d52e30c2657b0b617be53953675bbdf0247ad
-
memory/1096-15-0x0000000000000000-mapping.dmp
-
memory/1436-21-0x0000000000000000-mapping.dmp
-
memory/1536-13-0x0000000000520000-0x000000000052E000-memory.dmpFilesize
56KB
-
memory/1536-14-0x0000000005650000-0x00000000056DD000-memory.dmpFilesize
564KB
-
memory/1536-11-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/1536-10-0x000000006BD20000-0x000000006C40E000-memory.dmpFilesize
6.9MB
-
memory/1536-7-0x0000000000000000-mapping.dmp
-
memory/1572-19-0x0000000000000000-mapping.dmp
-
memory/1572-20-0x0000000000940000-0x000000000095F000-memory.dmpFilesize
124KB
-
memory/1572-22-0x0000000004B10000-0x0000000004BE1000-memory.dmpFilesize
836KB
-
memory/1572-23-0x0000000004B10000-0x0000000004BE1000-memory.dmpFilesize
836KB
-
memory/1680-2-0x000007FEF5BC0000-0x000007FEF5E3A000-memory.dmpFilesize
2.5MB
-
memory/1748-18-0x000000000041D0C0-mapping.dmp
-
memory/1748-17-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB