Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 07:26
Static task
static1
Behavioral task
behavioral1
Sample
Hendra Sagita CV.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Hendra Sagita CV.xlsx
Resource
win10v20201028
General
-
Target
Hendra Sagita CV.xlsx
-
Size
1.6MB
-
MD5
d9a813eb9a8a68214f8be31ed477c759
-
SHA1
38d011ee73abc7857d443b7afb9589c43441d60b
-
SHA256
a098f194fe69795901a85cf320aacb6effbb5dd2546e720e3d37fd9b6ebd1856
-
SHA512
1205d50b745bc93e1c9cd6c78b1c2a766d98025d20b7d10528775b2c7fb59a1f7f684d5a01e4ba3aa41ae1838cfeacee7baf4eccec18769aa0ec204dcbf386f4
Malware Config
Extracted
remcos
wedsazxcvfghyuiokjhbnvfcdsaweyplmhbvrtud.ydns.eu:1996
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 7 1988 EQNEDT32.EXE -
Executes dropped EXE 4 IoCs
Processes:
vbc.exevbc.exewin.exewin.exepid process 924 vbc.exe 932 vbc.exe 480 win.exe 608 win.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEcmd.exepid process 1988 EQNEDT32.EXE 1988 EQNEDT32.EXE 1608 cmd.exe 1608 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
vbc.exewin.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\"" vbc.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ win.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\win.exe\"" win.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
Processes:
vbc.exewin.exepid process 924 vbc.exe 924 vbc.exe 924 vbc.exe 924 vbc.exe 924 vbc.exe 924 vbc.exe 924 vbc.exe 924 vbc.exe 480 win.exe 480 win.exe 480 win.exe 480 win.exe 480 win.exe 480 win.exe 480 win.exe 480 win.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
vbc.exewin.exedescription pid process target process PID 924 set thread context of 932 924 vbc.exe vbc.exe PID 480 set thread context of 608 480 win.exe win.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1536 timeout.exe 1828 timeout.exe 284 timeout.exe 1824 timeout.exe 944 timeout.exe 560 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 528 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
vbc.exewin.exepid process 924 vbc.exe 924 vbc.exe 924 vbc.exe 480 win.exe 480 win.exe 480 win.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exewin.exedescription pid process Token: SeDebugPrivilege 924 vbc.exe Token: SeDebugPrivilege 480 win.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
EXCEL.EXEwin.exepid process 528 EXCEL.EXE 528 EXCEL.EXE 528 EXCEL.EXE 608 win.exe -
Suspicious use of WriteProcessMemory 86 IoCs
Processes:
EQNEDT32.EXEvbc.execmd.execmd.execmd.exevbc.exeWScript.execmd.exewin.execmd.execmd.exedescription pid process target process PID 1988 wrote to memory of 924 1988 EQNEDT32.EXE vbc.exe PID 1988 wrote to memory of 924 1988 EQNEDT32.EXE vbc.exe PID 1988 wrote to memory of 924 1988 EQNEDT32.EXE vbc.exe PID 1988 wrote to memory of 924 1988 EQNEDT32.EXE vbc.exe PID 924 wrote to memory of 1708 924 vbc.exe cmd.exe PID 924 wrote to memory of 1708 924 vbc.exe cmd.exe PID 924 wrote to memory of 1708 924 vbc.exe cmd.exe PID 924 wrote to memory of 1708 924 vbc.exe cmd.exe PID 1708 wrote to memory of 284 1708 cmd.exe timeout.exe PID 1708 wrote to memory of 284 1708 cmd.exe timeout.exe PID 1708 wrote to memory of 284 1708 cmd.exe timeout.exe PID 1708 wrote to memory of 284 1708 cmd.exe timeout.exe PID 924 wrote to memory of 1564 924 vbc.exe cmd.exe PID 924 wrote to memory of 1564 924 vbc.exe cmd.exe PID 924 wrote to memory of 1564 924 vbc.exe cmd.exe PID 924 wrote to memory of 1564 924 vbc.exe cmd.exe PID 1564 wrote to memory of 1824 1564 cmd.exe timeout.exe PID 1564 wrote to memory of 1824 1564 cmd.exe timeout.exe PID 1564 wrote to memory of 1824 1564 cmd.exe timeout.exe PID 1564 wrote to memory of 1824 1564 cmd.exe timeout.exe PID 924 wrote to memory of 340 924 vbc.exe cmd.exe PID 924 wrote to memory of 340 924 vbc.exe cmd.exe PID 924 wrote to memory of 340 924 vbc.exe cmd.exe PID 924 wrote to memory of 340 924 vbc.exe cmd.exe PID 340 wrote to memory of 944 340 cmd.exe timeout.exe PID 340 wrote to memory of 944 340 cmd.exe timeout.exe PID 340 wrote to memory of 944 340 cmd.exe timeout.exe PID 340 wrote to memory of 944 340 cmd.exe timeout.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 924 wrote to memory of 932 924 vbc.exe vbc.exe PID 932 wrote to memory of 524 932 vbc.exe WScript.exe PID 932 wrote to memory of 524 932 vbc.exe WScript.exe PID 932 wrote to memory of 524 932 vbc.exe WScript.exe PID 932 wrote to memory of 524 932 vbc.exe WScript.exe PID 524 wrote to memory of 1608 524 WScript.exe cmd.exe PID 524 wrote to memory of 1608 524 WScript.exe cmd.exe PID 524 wrote to memory of 1608 524 WScript.exe cmd.exe PID 524 wrote to memory of 1608 524 WScript.exe cmd.exe PID 1608 wrote to memory of 480 1608 cmd.exe win.exe PID 1608 wrote to memory of 480 1608 cmd.exe win.exe PID 1608 wrote to memory of 480 1608 cmd.exe win.exe PID 1608 wrote to memory of 480 1608 cmd.exe win.exe PID 480 wrote to memory of 780 480 win.exe cmd.exe PID 480 wrote to memory of 780 480 win.exe cmd.exe PID 480 wrote to memory of 780 480 win.exe cmd.exe PID 480 wrote to memory of 780 480 win.exe cmd.exe PID 780 wrote to memory of 560 780 cmd.exe timeout.exe PID 780 wrote to memory of 560 780 cmd.exe timeout.exe PID 780 wrote to memory of 560 780 cmd.exe timeout.exe PID 780 wrote to memory of 560 780 cmd.exe timeout.exe PID 480 wrote to memory of 944 480 win.exe cmd.exe PID 480 wrote to memory of 944 480 win.exe cmd.exe PID 480 wrote to memory of 944 480 win.exe cmd.exe PID 480 wrote to memory of 944 480 win.exe cmd.exe PID 944 wrote to memory of 1536 944 cmd.exe timeout.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Hendra Sagita CV.xlsx"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\win.exe"5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\win.exeC:\Users\Admin\AppData\Roaming\win.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 17⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 18⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
4a74e626596d6e66b4bbc59ee6848f2d
SHA1047849ac8735ecc0943428c7cd5e00b52eee06ed
SHA25698bd6dc219a7a3e04d3d67bbec9f0b4d4640831a3a6be0a0078b050041088b0e
SHA5121cd943482d0f1ce2ffaf6ee4a82895e4d57c52051bb14bbda0548cf072b4c5cbe719d2cdb549b5ae7c0241dd9c68dd9d1674acd26aed684b8145500079cc5403
-
C:\Users\Admin\AppData\Roaming\win.exeMD5
40c5609d0196211eae06a33b3bae5ec8
SHA1a97cc0116b12526e68bdc1b7846810977abf6241
SHA2565adf963b1c92ba79a5003d87943b4cb6c8a72fb9db63d8922c43f6631ad27995
SHA512379281e99a5260d17891d9507101d39b3ee1e22c7924fbdb7120bb5af42c69063912a5f114ec258be9dbe41e4d6961098d113e5b3f06c89b9698fec764a68124
-
C:\Users\Admin\AppData\Roaming\win.exeMD5
40c5609d0196211eae06a33b3bae5ec8
SHA1a97cc0116b12526e68bdc1b7846810977abf6241
SHA2565adf963b1c92ba79a5003d87943b4cb6c8a72fb9db63d8922c43f6631ad27995
SHA512379281e99a5260d17891d9507101d39b3ee1e22c7924fbdb7120bb5af42c69063912a5f114ec258be9dbe41e4d6961098d113e5b3f06c89b9698fec764a68124
-
C:\Users\Admin\AppData\Roaming\win.exeMD5
40c5609d0196211eae06a33b3bae5ec8
SHA1a97cc0116b12526e68bdc1b7846810977abf6241
SHA2565adf963b1c92ba79a5003d87943b4cb6c8a72fb9db63d8922c43f6631ad27995
SHA512379281e99a5260d17891d9507101d39b3ee1e22c7924fbdb7120bb5af42c69063912a5f114ec258be9dbe41e4d6961098d113e5b3f06c89b9698fec764a68124
-
C:\Users\Public\vbc.exeMD5
40c5609d0196211eae06a33b3bae5ec8
SHA1a97cc0116b12526e68bdc1b7846810977abf6241
SHA2565adf963b1c92ba79a5003d87943b4cb6c8a72fb9db63d8922c43f6631ad27995
SHA512379281e99a5260d17891d9507101d39b3ee1e22c7924fbdb7120bb5af42c69063912a5f114ec258be9dbe41e4d6961098d113e5b3f06c89b9698fec764a68124
-
C:\Users\Public\vbc.exeMD5
40c5609d0196211eae06a33b3bae5ec8
SHA1a97cc0116b12526e68bdc1b7846810977abf6241
SHA2565adf963b1c92ba79a5003d87943b4cb6c8a72fb9db63d8922c43f6631ad27995
SHA512379281e99a5260d17891d9507101d39b3ee1e22c7924fbdb7120bb5af42c69063912a5f114ec258be9dbe41e4d6961098d113e5b3f06c89b9698fec764a68124
-
C:\Users\Public\vbc.exeMD5
40c5609d0196211eae06a33b3bae5ec8
SHA1a97cc0116b12526e68bdc1b7846810977abf6241
SHA2565adf963b1c92ba79a5003d87943b4cb6c8a72fb9db63d8922c43f6631ad27995
SHA512379281e99a5260d17891d9507101d39b3ee1e22c7924fbdb7120bb5af42c69063912a5f114ec258be9dbe41e4d6961098d113e5b3f06c89b9698fec764a68124
-
\Users\Admin\AppData\Roaming\win.exeMD5
40c5609d0196211eae06a33b3bae5ec8
SHA1a97cc0116b12526e68bdc1b7846810977abf6241
SHA2565adf963b1c92ba79a5003d87943b4cb6c8a72fb9db63d8922c43f6631ad27995
SHA512379281e99a5260d17891d9507101d39b3ee1e22c7924fbdb7120bb5af42c69063912a5f114ec258be9dbe41e4d6961098d113e5b3f06c89b9698fec764a68124
-
\Users\Admin\AppData\Roaming\win.exeMD5
40c5609d0196211eae06a33b3bae5ec8
SHA1a97cc0116b12526e68bdc1b7846810977abf6241
SHA2565adf963b1c92ba79a5003d87943b4cb6c8a72fb9db63d8922c43f6631ad27995
SHA512379281e99a5260d17891d9507101d39b3ee1e22c7924fbdb7120bb5af42c69063912a5f114ec258be9dbe41e4d6961098d113e5b3f06c89b9698fec764a68124
-
\Users\Public\vbc.exeMD5
40c5609d0196211eae06a33b3bae5ec8
SHA1a97cc0116b12526e68bdc1b7846810977abf6241
SHA2565adf963b1c92ba79a5003d87943b4cb6c8a72fb9db63d8922c43f6631ad27995
SHA512379281e99a5260d17891d9507101d39b3ee1e22c7924fbdb7120bb5af42c69063912a5f114ec258be9dbe41e4d6961098d113e5b3f06c89b9698fec764a68124
-
\Users\Public\vbc.exeMD5
40c5609d0196211eae06a33b3bae5ec8
SHA1a97cc0116b12526e68bdc1b7846810977abf6241
SHA2565adf963b1c92ba79a5003d87943b4cb6c8a72fb9db63d8922c43f6631ad27995
SHA512379281e99a5260d17891d9507101d39b3ee1e22c7924fbdb7120bb5af42c69063912a5f114ec258be9dbe41e4d6961098d113e5b3f06c89b9698fec764a68124
-
memory/284-18-0x0000000000000000-mapping.dmp
-
memory/340-21-0x0000000000000000-mapping.dmp
-
memory/480-36-0x0000000000000000-mapping.dmp
-
memory/480-44-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/480-39-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/480-38-0x000000006CD40000-0x000000006D42E000-memory.dmpFilesize
6.9MB
-
memory/524-27-0x0000000000000000-mapping.dmp
-
memory/524-32-0x0000000002690000-0x0000000002694000-memory.dmpFilesize
16KB
-
memory/528-2-0x000000002F4D1000-0x000000002F4D4000-memory.dmpFilesize
12KB
-
memory/528-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/528-3-0x0000000071C01000-0x0000000071C03000-memory.dmpFilesize
8KB
-
memory/552-6-0x000007FEF7D40000-0x000007FEF7FBA000-memory.dmpFilesize
2.5MB
-
memory/560-43-0x0000000000000000-mapping.dmp
-
memory/608-50-0x0000000000413FA4-mapping.dmp
-
memory/608-53-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/780-42-0x0000000000000000-mapping.dmp
-
memory/924-13-0x00000000010A0000-0x00000000010A1000-memory.dmpFilesize
4KB
-
memory/924-16-0x0000000000520000-0x0000000000550000-memory.dmpFilesize
192KB
-
memory/924-9-0x0000000000000000-mapping.dmp
-
memory/924-12-0x000000006CD50000-0x000000006D43E000-memory.dmpFilesize
6.9MB
-
memory/924-15-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/932-30-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/932-24-0x0000000000413FA4-mapping.dmp
-
memory/932-23-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/944-22-0x0000000000000000-mapping.dmp
-
memory/944-45-0x0000000000000000-mapping.dmp
-
memory/1536-46-0x0000000000000000-mapping.dmp
-
memory/1564-19-0x0000000000000000-mapping.dmp
-
memory/1568-47-0x0000000000000000-mapping.dmp
-
memory/1608-31-0x0000000000000000-mapping.dmp
-
memory/1708-17-0x0000000000000000-mapping.dmp
-
memory/1824-20-0x0000000000000000-mapping.dmp
-
memory/1828-48-0x0000000000000000-mapping.dmp
-
memory/1988-5-0x0000000075D01000-0x0000000075D03000-memory.dmpFilesize
8KB