Analysis

  • max time kernel
    137s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09-04-2021 09:42

General

  • Target

    82025721897_03192021.xlsm

  • Size

    185KB

  • MD5

    e7ab02fc9cf04da25eeb7e7263aefe0d

  • SHA1

    12cdeed8f2c7605ebcb3c7b384b4bad1fd82dbbe

  • SHA256

    dcc45c82a484a420888aabe66588cbb1658cb2a7a5cc833b0438fa06ca84a991

  • SHA512

    06b93502819f0bb0877cbf26108f7aa3261ce192c4bd5e6ac19b0cd956e92f78ca53da0fedd3857426ed9664390d7db5616c92b64a1c6a034e3a4ad94cac64ab

Score
10/10

Malware Config

Extracted

Language xlm4.0
Source
URLs
xlm40.dropper

http://188.127.237.152/44295.4021160879.dat

xlm40.dropper

http://45.150.67.13/44295.4021160879.dat

xlm40.dropper

http://185.82.219.225/44295.4021160879.dat

Signatures

  • Process spawned unexpected child process ⋅ 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates system info in registry ⋅ 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings ⋅ 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 3 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 21 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\82025721897_03192021.xlsm
    Enumerates system info in registry
    Modifies Internet Explorer settings
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Windows\SysWOW64\Rundll32.exe
      Rundll32 ..\Kiod.hod,DllRegisterServer
      Process spawned unexpected child process
      PID:588
    • C:\Windows\SysWOW64\Rundll32.exe
      Rundll32 ..\Kiod.hod1,DllRegisterServer
      Process spawned unexpected child process
      PID:304
    • C:\Windows\SysWOW64\Rundll32.exe
      Rundll32 ..\Kiod.hod2,DllRegisterServer
      Process spawned unexpected child process
      PID:1196

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • memory/304-65-0x0000000000000000-mapping.dmp
                      • memory/588-63-0x0000000000000000-mapping.dmp
                      • memory/588-64-0x00000000760C1000-0x00000000760C3000-memory.dmp
                      • memory/1100-60-0x000000002F501000-0x000000002F504000-memory.dmp
                      • memory/1100-61-0x0000000071191000-0x0000000071193000-memory.dmp
                      • memory/1100-62-0x000000005FFF0000-0x0000000060000000-memory.dmp
                      • memory/1196-67-0x0000000000000000-mapping.dmp