Analysis

  • max time kernel
    145s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    10-03-2021 16:34

General

  • Target

    Complaint-Letter-1839904529-03102021.xls

  • Size

    276KB

  • MD5

    d1b22a745d5efffef5c52928b7f439d6

  • SHA1

    ba3a1a876978ebdb2a631f644a6b686fafc3c7a3

  • SHA256

    4ce84c7097fafe010daa73dda77ff17662086505e23b8d4bd11692c9d47896df

  • SHA512

    0cd10c652a13d1c73da064896e145a7fcc8773cad9e098678bfbe9be7543a81e7b616cd74826d78ebd36ec5842bd27c580c15d5a36109209a26402716a9242ff

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://lackenbauer.ru/bd/hhvqjrec/44265.6933299768.dat

xlm40.dropper

http://www.peacezoneacademy.com/dxsbonlv/44265.6933299768.dat

xlm40.dropper

http://jopo.com/gmaaxbro/44265.6933299768.dat

xlm40.dropper

http://www.thegivingwall.co.uk/jfgolx/44265.6933299768.dat

xlm40.dropper

http://baxtercode.com/qkhpnucmzts/44265.6933299768.dat

Signatures

  • Process spawned unexpected child process 5 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Complaint-Letter-1839904529-03102021.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:292
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 ..\Runtime.brok,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:616
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 ..\Runtime.brok1,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:1348
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 ..\Runtime.brok2,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:1664
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 ..\Runtime.brok3,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:844
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32 ..\Runtime.brok4,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      PID:520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/292-2-0x000000002F1B1000-0x000000002F1B4000-memory.dmp

    Filesize

    12KB

  • memory/292-3-0x0000000071CE1000-0x0000000071CE3000-memory.dmp

    Filesize

    8KB

  • memory/292-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/520-14-0x0000000000000000-mapping.dmp

  • memory/616-6-0x0000000000000000-mapping.dmp

  • memory/616-7-0x0000000076861000-0x0000000076863000-memory.dmp

    Filesize

    8KB

  • memory/844-12-0x0000000000000000-mapping.dmp

  • memory/1348-8-0x0000000000000000-mapping.dmp

  • memory/1664-10-0x0000000000000000-mapping.dmp

  • memory/1796-5-0x000007FEF6B80000-0x000007FEF6DFA000-memory.dmp

    Filesize

    2.5MB