Analysis
-
max time kernel
139s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-03-2021 06:01
Behavioral task
behavioral1
Sample
Inv9948939619.xlsm
Resource
win7v20201028
General
-
Target
Inv9948939619.xlsm
-
Size
33KB
-
MD5
f685aa869cf29499b615dff5c4b5f9f8
-
SHA1
2d461fa264897b3edb0e5d79b5e7d76c2c5b62c6
-
SHA256
7c2dce53d23d62b45470c002311761fc35f78d2af8b0052dcdd0362206d986fa
-
SHA512
cdd8b60b0677fb024a546a0739e30c479ba0a58f8a48e47dc4103e24d8e835c99275230fabab3e1e921f83caf39afc305b998120c936d474a9789fd1e55c6868
Malware Config
Extracted
dridex
10444
210.65.244.166:443
178.33.183.53:7443
157.7.139.198:6601
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4008 644 regsvr32.exe EXCEL.EXE -
Processes:
resource yara_rule behavioral2/memory/2228-11-0x0000000074300000-0x000000007433D000-memory.dmp dridex_ldr behavioral2/memory/2228-12-0x0000000074300000-0x000000007433D000-memory.dmp dridex_ldr -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 2228 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 644 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE 644 EXCEL.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
EXCEL.EXEregsvr32.exedescription pid process target process PID 644 wrote to memory of 4008 644 EXCEL.EXE regsvr32.exe PID 644 wrote to memory of 4008 644 EXCEL.EXE regsvr32.exe PID 4008 wrote to memory of 2228 4008 regsvr32.exe regsvr32.exe PID 4008 wrote to memory of 2228 4008 regsvr32.exe regsvr32.exe PID 4008 wrote to memory of 2228 4008 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Inv9948939619.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\ucztadpi.dll2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\ucztadpi.dll3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ucztadpi.dllMD5
58d1d1119844c16122189ede908b825c
SHA10648dfecf6cf3c39c0be7cd5fde6c8cd7b8d5d57
SHA256a23bf302f0f10f7f53908a3661256d7b11ee31276e14b42447ec5f4c36b5355e
SHA512efed7aa5d84ce1ee1b327d101f565d27948b4dfee3a0b05c94cd6d04e71fe42b1e0864400077d9b526e9d51f394607da5c6b81588c939bcc02d21651850936ea
-
\Users\Admin\AppData\Local\Temp\ucztadpi.dllMD5
58d1d1119844c16122189ede908b825c
SHA10648dfecf6cf3c39c0be7cd5fde6c8cd7b8d5d57
SHA256a23bf302f0f10f7f53908a3661256d7b11ee31276e14b42447ec5f4c36b5355e
SHA512efed7aa5d84ce1ee1b327d101f565d27948b4dfee3a0b05c94cd6d04e71fe42b1e0864400077d9b526e9d51f394607da5c6b81588c939bcc02d21651850936ea
-
memory/644-2-0x00007FF8FADF0000-0x00007FF8FAE00000-memory.dmpFilesize
64KB
-
memory/644-3-0x00007FF8FADF0000-0x00007FF8FAE00000-memory.dmpFilesize
64KB
-
memory/644-4-0x00007FF8FADF0000-0x00007FF8FAE00000-memory.dmpFilesize
64KB
-
memory/644-6-0x00007FF8FADF0000-0x00007FF8FAE00000-memory.dmpFilesize
64KB
-
memory/644-5-0x00007FF91E620000-0x00007FF91EC57000-memory.dmpFilesize
6.2MB
-
memory/2228-9-0x0000000000000000-mapping.dmp
-
memory/2228-11-0x0000000074300000-0x000000007433D000-memory.dmpFilesize
244KB
-
memory/2228-12-0x0000000074300000-0x000000007433D000-memory.dmpFilesize
244KB
-
memory/2228-13-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/4008-7-0x0000000000000000-mapping.dmp