Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-03-2021 08:53
Behavioral task
behavioral1
Sample
Inv5180494049.xlsm
Resource
win7v20201028
General
-
Target
Inv5180494049.xlsm
-
Size
33KB
-
MD5
f685aa869cf29499b615dff5c4b5f9f8
-
SHA1
2d461fa264897b3edb0e5d79b5e7d76c2c5b62c6
-
SHA256
7c2dce53d23d62b45470c002311761fc35f78d2af8b0052dcdd0362206d986fa
-
SHA512
cdd8b60b0677fb024a546a0739e30c479ba0a58f8a48e47dc4103e24d8e835c99275230fabab3e1e921f83caf39afc305b998120c936d474a9789fd1e55c6868
Malware Config
Extracted
dridex
10444
210.65.244.166:443
178.33.183.53:7443
157.7.139.198:6601
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2652 3300 regsvr32.exe EXCEL.EXE -
Processes:
resource yara_rule behavioral2/memory/3972-12-0x0000000004CB1000-0x0000000004D0B000-memory.dmp dridex_ldr behavioral2/memory/3972-13-0x0000000004CB0000-0x0000000004CED000-memory.dmp dridex_ldr -
Loads dropped DLL 2 IoCs
Processes:
regsvr32.exepid process 3972 regsvr32.exe 3972 regsvr32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3300 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE 3300 EXCEL.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
EXCEL.EXEregsvr32.exedescription pid process target process PID 3300 wrote to memory of 2652 3300 EXCEL.EXE regsvr32.exe PID 3300 wrote to memory of 2652 3300 EXCEL.EXE regsvr32.exe PID 2652 wrote to memory of 3972 2652 regsvr32.exe regsvr32.exe PID 2652 wrote to memory of 3972 2652 regsvr32.exe regsvr32.exe PID 2652 wrote to memory of 3972 2652 regsvr32.exe regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Inv5180494049.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\lvrabb.dll2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\lvrabb.dll3⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lvrabb.dllMD5
c033932c15f002e82005af6207370743
SHA168603ee11cb648b29fbf9ac789f16c3c20ab5fb2
SHA256fed976ccb46e9a6679c1c8e141c3f81bce21cf627def54d2d00c3ba56bffa090
SHA512b7bd61d8c6154c9b1fb69349c582f11c3d33430523490813edd1b8c7bc1d8c2b84f26528a63c1780198bc6442c584d687917027ab3add174db343e5728d749bf
-
\Users\Admin\AppData\Local\Temp\lvrabb.dllMD5
c033932c15f002e82005af6207370743
SHA168603ee11cb648b29fbf9ac789f16c3c20ab5fb2
SHA256fed976ccb46e9a6679c1c8e141c3f81bce21cf627def54d2d00c3ba56bffa090
SHA512b7bd61d8c6154c9b1fb69349c582f11c3d33430523490813edd1b8c7bc1d8c2b84f26528a63c1780198bc6442c584d687917027ab3add174db343e5728d749bf
-
\Users\Admin\AppData\Local\Temp\lvrabb.dllMD5
c033932c15f002e82005af6207370743
SHA168603ee11cb648b29fbf9ac789f16c3c20ab5fb2
SHA256fed976ccb46e9a6679c1c8e141c3f81bce21cf627def54d2d00c3ba56bffa090
SHA512b7bd61d8c6154c9b1fb69349c582f11c3d33430523490813edd1b8c7bc1d8c2b84f26528a63c1780198bc6442c584d687917027ab3add174db343e5728d749bf
-
memory/2652-7-0x0000000000000000-mapping.dmp
-
memory/3300-4-0x00007FF8A2B20000-0x00007FF8A2B30000-memory.dmpFilesize
64KB
-
memory/3300-5-0x00007FF8C5C40000-0x00007FF8C6277000-memory.dmpFilesize
6.2MB
-
memory/3300-6-0x00007FF8A2B20000-0x00007FF8A2B30000-memory.dmpFilesize
64KB
-
memory/3300-3-0x00007FF8A2B20000-0x00007FF8A2B30000-memory.dmpFilesize
64KB
-
memory/3300-2-0x00007FF8A2B20000-0x00007FF8A2B30000-memory.dmpFilesize
64KB
-
memory/3972-9-0x0000000000000000-mapping.dmp
-
memory/3972-12-0x0000000004CB1000-0x0000000004D0B000-memory.dmpFilesize
360KB
-
memory/3972-13-0x0000000004CB0000-0x0000000004CED000-memory.dmpFilesize
244KB
-
memory/3972-14-0x0000000001320000-0x0000000001321000-memory.dmpFilesize
4KB