Analysis

  • max time kernel
    130s
  • max time network
    12s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    12-03-2021 05:32

General

  • Target

    _____.xls

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source

Signatures

  • Nloader

    Simple loader that includes the keyword 'cambo' in the URL used to download other families.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\_____.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Windows\SysWOW64\certutil.exe
      "C:\Windows\System32\certutil.exe" -decode C:\Users\Public\jahi1088.png C:\Users\Public\jahi1088.pn
      2⤵
      • Process spawned unexpected child process
      PID:1056
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Public\jahi1088.pn,DF j1
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:568
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 332
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\jahi1088.pn
    MD5

    8a9a8739404210e7e454dc2466872f23

    SHA1

    a3dbb6cb1eed87147f734c933e087bd66954ca18

    SHA256

    8229a6d0339c001fd0ce51db1b10748d37c838baee130afea2488f2ad0e05ac4

    SHA512

    2479c99ffc4002c909a1e6acf66ed2b6dc32efeea0b6182eb2ca8bb5cbe65bd85e507a0bab5f1e38232918cf59f29b592dc1f83b4d9684106ebf5707e057726e

  • C:\Users\Public\jahi1088.png
    MD5

    a72d21e3af2cefc6ce364953a8e2d8b5

    SHA1

    34ed7ede30fee07b0bf64b56404bd5d43dad0be9

    SHA256

    0bd28eb6cbff3d7344f3e5718729ada8317edcf16e231f925dafd964cc44dcad

    SHA512

    606b0694680d5c4b350bc2c48b3e15399fcd94ced1977f5d423a58af2c789d72dc19e9371f1db0b7d0c953b211785851e19666dcd347d8a6a03b325eddbc4ec1

  • \Users\Public\jahi1088.pn
    MD5

    8a9a8739404210e7e454dc2466872f23

    SHA1

    a3dbb6cb1eed87147f734c933e087bd66954ca18

    SHA256

    8229a6d0339c001fd0ce51db1b10748d37c838baee130afea2488f2ad0e05ac4

    SHA512

    2479c99ffc4002c909a1e6acf66ed2b6dc32efeea0b6182eb2ca8bb5cbe65bd85e507a0bab5f1e38232918cf59f29b592dc1f83b4d9684106ebf5707e057726e

  • memory/568-17-0x00000000000C0000-0x00000000000C7000-memory.dmp
    Filesize

    28KB

  • memory/568-14-0x0000000010000000-0x0000000010007000-memory.dmp
    Filesize

    28KB

  • memory/568-13-0x0000000000180000-0x0000000000189000-memory.dmp
    Filesize

    36KB

  • memory/568-9-0x0000000000000000-mapping.dmp
  • memory/908-5-0x000007FEF68D0000-0x000007FEF6B4A000-memory.dmp
    Filesize

    2.5MB

  • memory/1056-6-0x0000000000000000-mapping.dmp
  • memory/1056-7-0x00000000756A1000-0x00000000756A3000-memory.dmp
    Filesize

    8KB

  • memory/1084-15-0x0000000000000000-mapping.dmp
  • memory/1084-16-0x0000000001DE0000-0x0000000001DF1000-memory.dmp
    Filesize

    68KB

  • memory/1084-18-0x0000000000360000-0x0000000000361000-memory.dmp
    Filesize

    4KB

  • memory/1684-2-0x000000002FED1000-0x000000002FED4000-memory.dmp
    Filesize

    12KB

  • memory/1684-4-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/1684-3-0x0000000071AC1000-0x0000000071AC3000-memory.dmp
    Filesize

    8KB