Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12-01-2021 06:07
Static task
static1
Behavioral task
behavioral1
Sample
2021 NEW PURCHASE REQUIREMENT .xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
2021 NEW PURCHASE REQUIREMENT .xlsx
Resource
win10v20201028
General
-
Target
2021 NEW PURCHASE REQUIREMENT .xlsx
-
Size
1.9MB
-
MD5
61c601674bb718dfbfb466c613e481ad
-
SHA1
f94bb9d92c0fdf08043438f3e921e1547aa60cad
-
SHA256
e7d76442af18fc1784adc2191d9ee6d078b3ba402a2465a6f061def541dd5138
-
SHA512
359c26536607d41185b190319d413ff0e478fb5861e5897682dc6dd3ed7ef5310463f3692afdc3412ae56468025e1cb6e7ecfe2bf6eb36a0f7cb05086b502c50
Malware Config
Extracted
remcos
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 6 1432 EQNEDT32.EXE -
Executes dropped EXE 4 IoCs
Processes:
vbc.exevbc.exevlc.exevlc.exepid process 844 vbc.exe 1956 vbc.exe 976 vlc.exe 1896 vlc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEcmd.exepid process 1432 EQNEDT32.EXE 1432 EQNEDT32.EXE 1624 cmd.exe 1624 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
vbc.exevlc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vbc.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vlc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vlc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
vbc.exevlc.exepid process 844 vbc.exe 844 vbc.exe 844 vbc.exe 844 vbc.exe 844 vbc.exe 844 vbc.exe 844 vbc.exe 844 vbc.exe 976 vlc.exe 976 vlc.exe 976 vlc.exe 976 vlc.exe 976 vlc.exe 976 vlc.exe 976 vlc.exe 976 vlc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
vbc.exevlc.exedescription pid process target process PID 844 set thread context of 1956 844 vbc.exe vbc.exe PID 976 set thread context of 1896 976 vlc.exe vlc.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1708 timeout.exe 1524 timeout.exe 1180 timeout.exe 432 timeout.exe 1676 timeout.exe 508 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 372 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
vbc.exevlc.exepid process 844 vbc.exe 844 vbc.exe 844 vbc.exe 976 vlc.exe 976 vlc.exe 976 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exevlc.exedescription pid process Token: SeDebugPrivilege 844 vbc.exe Token: SeDebugPrivilege 976 vlc.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEvlc.exepid process 372 EXCEL.EXE 372 EXCEL.EXE 372 EXCEL.EXE 1896 vlc.exe -
Suspicious use of WriteProcessMemory 86 IoCs
Processes:
EQNEDT32.EXEvbc.execmd.execmd.execmd.exevbc.exeWScript.execmd.exevlc.execmd.execmd.exedescription pid process target process PID 1432 wrote to memory of 844 1432 EQNEDT32.EXE vbc.exe PID 1432 wrote to memory of 844 1432 EQNEDT32.EXE vbc.exe PID 1432 wrote to memory of 844 1432 EQNEDT32.EXE vbc.exe PID 1432 wrote to memory of 844 1432 EQNEDT32.EXE vbc.exe PID 844 wrote to memory of 924 844 vbc.exe cmd.exe PID 844 wrote to memory of 924 844 vbc.exe cmd.exe PID 844 wrote to memory of 924 844 vbc.exe cmd.exe PID 844 wrote to memory of 924 844 vbc.exe cmd.exe PID 924 wrote to memory of 432 924 cmd.exe timeout.exe PID 924 wrote to memory of 432 924 cmd.exe timeout.exe PID 924 wrote to memory of 432 924 cmd.exe timeout.exe PID 924 wrote to memory of 432 924 cmd.exe timeout.exe PID 844 wrote to memory of 1100 844 vbc.exe cmd.exe PID 844 wrote to memory of 1100 844 vbc.exe cmd.exe PID 844 wrote to memory of 1100 844 vbc.exe cmd.exe PID 844 wrote to memory of 1100 844 vbc.exe cmd.exe PID 1100 wrote to memory of 1676 1100 cmd.exe timeout.exe PID 1100 wrote to memory of 1676 1100 cmd.exe timeout.exe PID 1100 wrote to memory of 1676 1100 cmd.exe timeout.exe PID 1100 wrote to memory of 1676 1100 cmd.exe timeout.exe PID 844 wrote to memory of 1712 844 vbc.exe cmd.exe PID 844 wrote to memory of 1712 844 vbc.exe cmd.exe PID 844 wrote to memory of 1712 844 vbc.exe cmd.exe PID 844 wrote to memory of 1712 844 vbc.exe cmd.exe PID 1712 wrote to memory of 508 1712 cmd.exe timeout.exe PID 1712 wrote to memory of 508 1712 cmd.exe timeout.exe PID 1712 wrote to memory of 508 1712 cmd.exe timeout.exe PID 1712 wrote to memory of 508 1712 cmd.exe timeout.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 844 wrote to memory of 1956 844 vbc.exe vbc.exe PID 1956 wrote to memory of 1432 1956 vbc.exe WScript.exe PID 1956 wrote to memory of 1432 1956 vbc.exe WScript.exe PID 1956 wrote to memory of 1432 1956 vbc.exe WScript.exe PID 1956 wrote to memory of 1432 1956 vbc.exe WScript.exe PID 1432 wrote to memory of 1624 1432 WScript.exe cmd.exe PID 1432 wrote to memory of 1624 1432 WScript.exe cmd.exe PID 1432 wrote to memory of 1624 1432 WScript.exe cmd.exe PID 1432 wrote to memory of 1624 1432 WScript.exe cmd.exe PID 1624 wrote to memory of 976 1624 cmd.exe vlc.exe PID 1624 wrote to memory of 976 1624 cmd.exe vlc.exe PID 1624 wrote to memory of 976 1624 cmd.exe vlc.exe PID 1624 wrote to memory of 976 1624 cmd.exe vlc.exe PID 976 wrote to memory of 828 976 vlc.exe cmd.exe PID 976 wrote to memory of 828 976 vlc.exe cmd.exe PID 976 wrote to memory of 828 976 vlc.exe cmd.exe PID 976 wrote to memory of 828 976 vlc.exe cmd.exe PID 828 wrote to memory of 1708 828 cmd.exe timeout.exe PID 828 wrote to memory of 1708 828 cmd.exe timeout.exe PID 828 wrote to memory of 1708 828 cmd.exe timeout.exe PID 828 wrote to memory of 1708 828 cmd.exe timeout.exe PID 976 wrote to memory of 924 976 vlc.exe cmd.exe PID 976 wrote to memory of 924 976 vlc.exe cmd.exe PID 976 wrote to memory of 924 976 vlc.exe cmd.exe PID 976 wrote to memory of 924 976 vlc.exe cmd.exe PID 924 wrote to memory of 1524 924 cmd.exe timeout.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\2021 NEW PURCHASE REQUIREMENT .xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
0fd303b21c1a43c6a9078e6f5280ca85
SHA10db8f1ae34f4e2e72184e337951fde826c0bd26f
SHA2565d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc
SHA512be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
7a99807a434f33b10783b43bc2906fbe
SHA1070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA25609a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
7a99807a434f33b10783b43bc2906fbe
SHA1070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA25609a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
7a99807a434f33b10783b43bc2906fbe
SHA1070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA25609a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591
-
C:\Users\Public\vbc.exeMD5
7a99807a434f33b10783b43bc2906fbe
SHA1070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA25609a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591
-
C:\Users\Public\vbc.exeMD5
7a99807a434f33b10783b43bc2906fbe
SHA1070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA25609a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591
-
C:\Users\Public\vbc.exeMD5
7a99807a434f33b10783b43bc2906fbe
SHA1070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA25609a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
7a99807a434f33b10783b43bc2906fbe
SHA1070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA25609a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
7a99807a434f33b10783b43bc2906fbe
SHA1070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA25609a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591
-
\Users\Public\vbc.exeMD5
7a99807a434f33b10783b43bc2906fbe
SHA1070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA25609a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591
-
\Users\Public\vbc.exeMD5
7a99807a434f33b10783b43bc2906fbe
SHA1070af96b019f7e8f0d0dfa1ccd51a41f2f127c7e
SHA25609a2e4f8534369466eba713828653e44916f2307420fc47306b1b9cfff181e2c
SHA512d83ef5e5ca85f600cb3cedadd686f6c677aa26682f1f2c48816195ae94303ac632574b92f4a8742f6703f798b6d4432cecd05a042cf4c0867da998fb5b8ed591
-
memory/432-13-0x0000000000000000-mapping.dmp
-
memory/508-17-0x0000000000000000-mapping.dmp
-
memory/828-35-0x0000000000000000-mapping.dmp
-
memory/844-11-0x0000000000300000-0x000000000032F000-memory.dmpFilesize
188KB
-
memory/844-9-0x00000000010C0000-0x00000000010C1000-memory.dmpFilesize
4KB
-
memory/844-8-0x000000006C620000-0x000000006CD0E000-memory.dmpFilesize
6.9MB
-
memory/844-5-0x0000000000000000-mapping.dmp
-
memory/924-12-0x0000000000000000-mapping.dmp
-
memory/924-37-0x0000000000000000-mapping.dmp
-
memory/976-29-0x0000000000000000-mapping.dmp
-
memory/976-45-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/976-31-0x000000006C610000-0x000000006CCFE000-memory.dmpFilesize
6.9MB
-
memory/1100-14-0x0000000000000000-mapping.dmp
-
memory/1180-40-0x0000000000000000-mapping.dmp
-
memory/1320-2-0x000007FEF6350000-0x000007FEF65CA000-memory.dmpFilesize
2.5MB
-
memory/1356-39-0x0000000000000000-mapping.dmp
-
memory/1432-22-0x0000000000000000-mapping.dmp
-
memory/1432-25-0x00000000026E0000-0x00000000026E4000-memory.dmpFilesize
16KB
-
memory/1524-38-0x0000000000000000-mapping.dmp
-
memory/1624-24-0x0000000000000000-mapping.dmp
-
memory/1676-15-0x0000000000000000-mapping.dmp
-
memory/1708-36-0x0000000000000000-mapping.dmp
-
memory/1712-16-0x0000000000000000-mapping.dmp
-
memory/1896-42-0x0000000000413FA4-mapping.dmp
-
memory/1896-44-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1956-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1956-19-0x0000000000413FA4-mapping.dmp
-
memory/1956-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB