Analysis
-
max time kernel
300s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-01-2021 20:46
General
-
Target
Statement of Account as of 01_20_2021.xlsm
-
Size
37KB
-
MD5
28e9c78dcffb4a80c7bcfcd818791940
-
SHA1
0f239865c9e2bdd64d2017c7d26cac19dc7d3cde
-
SHA256
09cceb619174c99d026734f860f26cda0107af31b9153a9f7d6613c86fd57772
-
SHA512
082d84c5d6b4442f0c6d10231c0368e74906a62348aaf7bb070a602695f9420abc3aa2cce28dfeaaaae784ba7e96a8008ab9e9d5bd6f2a5dfb591e8c8f5729fc
Malware Config
Extracted
dridex
10444
194.225.58.214:443
211.110.44.63:5353
69.164.207.140:3388
198.57.200.100:3786
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exeregsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 592 4808 regsvr32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1184 4808 regsvr32.exe EXCEL.EXE -
Processes:
resource yara_rule behavioral1/memory/1344-13-0x0000000073D20000-0x0000000073D5D000-memory.dmp dridex_ldr behavioral1/memory/1344-14-0x0000000073D20000-0x0000000073D5D000-memory.dmp dridex_ldr behavioral1/memory/1344-16-0x0000000073D20000-0x0000000073D5D000-memory.dmp dridex_ldr -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 1344 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4808 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4808 EXCEL.EXE 4808 EXCEL.EXE 4808 EXCEL.EXE 4808 EXCEL.EXE 4808 EXCEL.EXE 4808 EXCEL.EXE 4808 EXCEL.EXE 4808 EXCEL.EXE 4808 EXCEL.EXE 4808 EXCEL.EXE 4808 EXCEL.EXE 4808 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEregsvr32.exedescription pid process target process PID 4808 wrote to memory of 592 4808 EXCEL.EXE regsvr32.exe PID 4808 wrote to memory of 592 4808 EXCEL.EXE regsvr32.exe PID 4808 wrote to memory of 1184 4808 EXCEL.EXE regsvr32.exe PID 4808 wrote to memory of 1184 4808 EXCEL.EXE regsvr32.exe PID 1184 wrote to memory of 1344 1184 regsvr32.exe regsvr32.exe PID 1184 wrote to memory of 1344 1184 regsvr32.exe regsvr32.exe PID 1184 wrote to memory of 1344 1184 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Statement of Account as of 01_20_2021.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\jyuxguis.dll2⤵
- Process spawned unexpected child process
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\jyuxguis.dll2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\jyuxguis.dll3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jyuxguis.dllMD5
4b0e1750691b96e97f20da52f7d7032c
SHA1b8a4f7901bbf6f26f1f2e6886ebd85cf08fadd11
SHA2563459d30b5d2e6c58ddb8dcd9f45f5141f8d15c55fff16f9cc76ec621e6d829fb
SHA512b2eb64cb2b49fa53bb4020413f00793f2aa69235c458ef7a903d5a4a4711b9638c1dcb66cfaed145834fc9c1cb08c08eff84f670ef9f2a458b9dc45dde9c71ab
-
\Users\Admin\AppData\Local\Temp\jyuxguis.dllMD5
4b0e1750691b96e97f20da52f7d7032c
SHA1b8a4f7901bbf6f26f1f2e6886ebd85cf08fadd11
SHA2563459d30b5d2e6c58ddb8dcd9f45f5141f8d15c55fff16f9cc76ec621e6d829fb
SHA512b2eb64cb2b49fa53bb4020413f00793f2aa69235c458ef7a903d5a4a4711b9638c1dcb66cfaed145834fc9c1cb08c08eff84f670ef9f2a458b9dc45dde9c71ab
-
memory/592-7-0x0000000000000000-mapping.dmp
-
memory/1184-9-0x0000000000000000-mapping.dmp
-
memory/1344-11-0x0000000000000000-mapping.dmp
-
memory/1344-16-0x0000000073D20000-0x0000000073D5D000-memory.dmpFilesize
244KB
-
memory/1344-15-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/1344-14-0x0000000073D20000-0x0000000073D5D000-memory.dmpFilesize
244KB
-
memory/1344-13-0x0000000073D20000-0x0000000073D5D000-memory.dmpFilesize
244KB
-
memory/4808-5-0x00007FFA613D0000-0x00007FFA61A07000-memory.dmpFilesize
6.2MB
-
memory/4808-8-0x000001BFF8C80000-0x000001BFF8C84000-memory.dmpFilesize
16KB
-
memory/4808-6-0x00007FFA3D590000-0x00007FFA3D5A0000-memory.dmpFilesize
64KB
-
memory/4808-2-0x00007FFA3D590000-0x00007FFA3D5A0000-memory.dmpFilesize
64KB
-
memory/4808-4-0x00007FFA3D590000-0x00007FFA3D5A0000-memory.dmpFilesize
64KB
-
memory/4808-3-0x00007FFA3D590000-0x00007FFA3D5A0000-memory.dmpFilesize
64KB