Analysis
-
max time kernel
67s -
max time network
66s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-03-2021 22:02
Behavioral task
behavioral1
Sample
Private file #3741119.xls
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
Private file #3741119.xls
-
Size
90KB
-
MD5
764d3e3bf1bd4c9fe1a06e6c7ce511cd
-
SHA1
95e56031bf5ddb9b5aeed9e9f1d2d92410f69490
-
SHA256
ddd23286a06e4a24ae80188fd959f6f1aff568c133c27e74b5ff98b14695ff70
-
SHA512
5008a03926dd1420883ca172dc2dd28c6cb807813a38ceb16630742a35b1fad83a4014e829e811d13f3538df993cb59f869438992b6b9de152f44eff04565b14
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
https://techlog.xyz/page.icore
Extracted
Family
buer
C2
miyfandecompany.com
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 816 2028 wmic.exe 24 -
Buer Loader 1 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral1/memory/1332-14-0x0000000040000000-0x000000004000A000-memory.dmp buer -
Executes dropped EXE 2 IoCs
pid Process 1740 neiq.auw 1332 neiq.auw -
Loads dropped DLL 2 IoCs
pid Process 1740 neiq.auw 1740 neiq.auw -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1740 set thread context of 1332 1740 neiq.auw 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 8 IoCs
resource yara_rule behavioral1/files/0x00040000000130e5-7.dat nsis_installer_1 behavioral1/files/0x00040000000130e5-7.dat nsis_installer_2 behavioral1/files/0x00040000000130e5-9.dat nsis_installer_1 behavioral1/files/0x00040000000130e5-9.dat nsis_installer_2 behavioral1/files/0x00040000000130e5-11.dat nsis_installer_1 behavioral1/files/0x00040000000130e5-11.dat nsis_installer_2 behavioral1/files/0x00040000000130e5-13.dat nsis_installer_1 behavioral1/files/0x00040000000130e5-13.dat nsis_installer_2 -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2028 EXCEL.EXE -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1740 neiq.auw -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 816 wmic.exe Token: SeSecurityPrivilege 816 wmic.exe Token: SeTakeOwnershipPrivilege 816 wmic.exe Token: SeLoadDriverPrivilege 816 wmic.exe Token: SeSystemProfilePrivilege 816 wmic.exe Token: SeSystemtimePrivilege 816 wmic.exe Token: SeProfSingleProcessPrivilege 816 wmic.exe Token: SeIncBasePriorityPrivilege 816 wmic.exe Token: SeCreatePagefilePrivilege 816 wmic.exe Token: SeBackupPrivilege 816 wmic.exe Token: SeRestorePrivilege 816 wmic.exe Token: SeShutdownPrivilege 816 wmic.exe Token: SeDebugPrivilege 816 wmic.exe Token: SeSystemEnvironmentPrivilege 816 wmic.exe Token: SeRemoteShutdownPrivilege 816 wmic.exe Token: SeUndockPrivilege 816 wmic.exe Token: SeManageVolumePrivilege 816 wmic.exe Token: 33 816 wmic.exe Token: 34 816 wmic.exe Token: 35 816 wmic.exe Token: SeIncreaseQuotaPrivilege 816 wmic.exe Token: SeSecurityPrivilege 816 wmic.exe Token: SeTakeOwnershipPrivilege 816 wmic.exe Token: SeLoadDriverPrivilege 816 wmic.exe Token: SeSystemProfilePrivilege 816 wmic.exe Token: SeSystemtimePrivilege 816 wmic.exe Token: SeProfSingleProcessPrivilege 816 wmic.exe Token: SeIncBasePriorityPrivilege 816 wmic.exe Token: SeCreatePagefilePrivilege 816 wmic.exe Token: SeBackupPrivilege 816 wmic.exe Token: SeRestorePrivilege 816 wmic.exe Token: SeShutdownPrivilege 816 wmic.exe Token: SeDebugPrivilege 816 wmic.exe Token: SeSystemEnvironmentPrivilege 816 wmic.exe Token: SeRemoteShutdownPrivilege 816 wmic.exe Token: SeUndockPrivilege 816 wmic.exe Token: SeManageVolumePrivilege 816 wmic.exe Token: 33 816 wmic.exe Token: 34 816 wmic.exe Token: 35 816 wmic.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2028 wrote to memory of 816 2028 EXCEL.EXE 31 PID 2028 wrote to memory of 816 2028 EXCEL.EXE 31 PID 2028 wrote to memory of 816 2028 EXCEL.EXE 31 PID 2028 wrote to memory of 816 2028 EXCEL.EXE 31 PID 1740 wrote to memory of 1332 1740 neiq.auw 36 PID 1740 wrote to memory of 1332 1740 neiq.auw 36 PID 1740 wrote to memory of 1332 1740 neiq.auw 36 PID 1740 wrote to memory of 1332 1740 neiq.auw 36 PID 1740 wrote to memory of 1332 1740 neiq.auw 36 PID 1740 wrote to memory of 1332 1740 neiq.auw 36 PID 1740 wrote to memory of 1332 1740 neiq.auw 36 PID 1740 wrote to memory of 1332 1740 neiq.auw 36
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Private file #3741119.xls"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe process call create C:\Users\Public\neiq.auw2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:816
-
-
C:\Users\Public\neiq.auwC:\Users\Public\neiq.auw1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Public\neiq.auwC:\Users\Public\neiq.auw2⤵
- Executes dropped EXE
PID:1332
-