Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-03-2021 08:17
Behavioral task
behavioral1
Sample
Overdue-Debt-362804077-03042021.xls
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Overdue-Debt-362804077-03042021.xls
Resource
win10v20201028
General
-
Target
Overdue-Debt-362804077-03042021.xls
-
Size
76KB
-
MD5
a5ce788938ede1feac694ca1bd819792
-
SHA1
76921b6a68d2ea6ac336c03e3303eb2463f9020c
-
SHA256
be481b1e185c71d87c8f3b68f6c3bb8d09cc30e9ff735f97c474ce89187dd627
-
SHA512
0cec65ffa96a5177c8af308623baf989baf17c59afdc3d5490f845252a70cc477bec3511da26562ff51d61fc939c63f0b0f4de1e78944b2e06cd41c5f6a7f4c2
Malware Config
Signatures
-
Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2332 3584 rundll32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3864 3584 rundll32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3928 3584 rundll32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3592 3584 rundll32.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3844 3584 rundll32.exe EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3584 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3584 EXCEL.EXE 3584 EXCEL.EXE 3584 EXCEL.EXE 3584 EXCEL.EXE 3584 EXCEL.EXE 3584 EXCEL.EXE 3584 EXCEL.EXE 3584 EXCEL.EXE 3584 EXCEL.EXE 3584 EXCEL.EXE 3584 EXCEL.EXE 3584 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 3584 wrote to memory of 2332 3584 EXCEL.EXE rundll32.exe PID 3584 wrote to memory of 2332 3584 EXCEL.EXE rundll32.exe PID 3584 wrote to memory of 3864 3584 EXCEL.EXE rundll32.exe PID 3584 wrote to memory of 3864 3584 EXCEL.EXE rundll32.exe PID 3584 wrote to memory of 3928 3584 EXCEL.EXE rundll32.exe PID 3584 wrote to memory of 3928 3584 EXCEL.EXE rundll32.exe PID 3584 wrote to memory of 3592 3584 EXCEL.EXE rundll32.exe PID 3584 wrote to memory of 3592 3584 EXCEL.EXE rundll32.exe PID 3584 wrote to memory of 3844 3584 EXCEL.EXE rundll32.exe PID 3584 wrote to memory of 3844 3584 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Overdue-Debt-362804077-03042021.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Vijaser.lasjr,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Vijaser.lasjr1,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Vijaser.lasjr2,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Vijaser.lasjr3,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Vijaser.lasjr4,DllRegisterServer2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2332-7-0x0000000000000000-mapping.dmp
-
memory/3584-2-0x00007FFB667A0000-0x00007FFB667B0000-memory.dmpFilesize
64KB
-
memory/3584-3-0x00007FFB667A0000-0x00007FFB667B0000-memory.dmpFilesize
64KB
-
memory/3584-4-0x00007FFB667A0000-0x00007FFB667B0000-memory.dmpFilesize
64KB
-
memory/3584-5-0x00007FFB667A0000-0x00007FFB667B0000-memory.dmpFilesize
64KB
-
memory/3584-6-0x00007FFB89D60000-0x00007FFB8A397000-memory.dmpFilesize
6.2MB
-
memory/3592-10-0x0000000000000000-mapping.dmp
-
memory/3844-11-0x0000000000000000-mapping.dmp
-
memory/3864-8-0x0000000000000000-mapping.dmp
-
memory/3928-9-0x0000000000000000-mapping.dmp