6a75b37a3f47cf8b5237526528aad5ff12ba1f498773caac507448f282ce5cc9

Resubmissions

15-03-2021 19:15

210315-lysnggh31a 10

15-03-2021 19:11

210315-8dqehx1vwx 10

Analysis

max time kernel
136s
max time network
133s
platform
windows10_x64
resource
win10v20201028
submitted
15-03-2021 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

File_145565.xlsb
Size

233KB
MD5

99421c3f76ea8ef636173c6a3fc43e05
SHA1

439c69a29dc2f4d7b52658cc78053c6153e62582
SHA256

6a75b37a3f47cf8b5237526528aad5ff12ba1f498773caac507448f282ce5cc9
SHA512

90fc816e5645b1f72fda82d7d26e3d0f711a4ad588d6a6aa477d1f25545f00fbab400c954d2c5de69de63340bac6b8a6500f7c66197466d94f53879c2f87a5c3

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	676	3884	rundll32.exe	EXCEL.EXE

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3884 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

3884 EXCEL.EXE
3884 EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE
3884	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

EXCEL.EXE

description pid process target process

PID 3884 wrote to memory of 676 3884 EXCEL.EXE rundll32.exe
PID 3884 wrote to memory of 676 3884 EXCEL.EXE rundll32.exe

description	pid	process	target process
PID 3884 wrote to memory of 676	3884	EXCEL.EXE	rundll32.exe
PID 3884 wrote to memory of 676	3884	EXCEL.EXE	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\File_145565.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3884

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\ProgramData\flotsh\h4gf.dll,DllRegisterServer1
2⤵
- Process spawned unexpected child process
PID:676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\flotsh\h4gf.dll

MD5
c77254a2ed8b9e603ba4db71099b2d5e

SHA1
09ffecae9661a8a0ec629083abdafe502b0f5d0d

SHA256
ce8af8755a3ede16174c8ed68772c7fc7aa2cd09bbe6c4a9164edf31fc4b1cb8

SHA512
99aaecbdc5040e8f1c2a45df442aa61a908d6803da9e1d4e4ebb9195587ff7ce8685f8e69f2217307bf5938643920327debd8b77e88f1e99a6840e342665bb03

Download Submit
memory/676-7-0x0000000000000000-mapping.dmp

Download
memory/3884-2-0x00007FFF49320000-0x00007FFF49330000-memory.dmp

Filesize
64KB

Download
memory/3884-3-0x00007FFF49320000-0x00007FFF49330000-memory.dmp

Filesize
64KB

Download
memory/3884-4-0x00007FFF49320000-0x00007FFF49330000-memory.dmp

Filesize
64KB

Download
memory/3884-5-0x00007FFF6D370000-0x00007FFF6D9A7000-memory.dmp

Filesize
6.2MB

Download
memory/3884-6-0x00007FFF49320000-0x00007FFF49330000-memory.dmp

Filesize
64KB

Download