nloader | 5aab7a71287ccd1bb7c20829709eaae67beb0092ee9e8d8ce60d8870e7775fda

General

Target

subscription_1618245993.xlsb
Size

312KB
MD5

a025ee5205f9a2af4ec332478dee53eb
SHA1

a4777e075e2895f65b38cea4fd4fa0b031587647
SHA256

5aab7a71287ccd1bb7c20829709eaae67beb0092ee9e8d8ce60d8870e7775fda
SHA512

28f8f9fd9d48843f529c2d9b1498e984fbb382adc8e8bea9e5635d03293b48f3d142374f30527b985096183aa7c66e48202bb6ca0f5a617abf97064148cf46c7

Score

10^/10

nloader loader

Malware Config

Extracted

Language

xlm4.0

Source

Signatures

Nloader
Simple loader that includes the keyword 'cambo' in the URL used to download other families.
loader nloader

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1476	1652	cmd.exe	EXCEL.EXE

Nloader Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1796-71-0x0000000010000000-0x0000000010005000-memory.dmp	nloader

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

5 1796 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1796 rundll32.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

flow	pid	process
5	1796	rundll32.exe

pid	process
1796	rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1652 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1652 EXCEL.EXE
1652 EXCEL.EXE
1652 EXCEL.EXE

pid	process
1652	EXCEL.EXE

pid	process
1652	EXCEL.EXE
1652	EXCEL.EXE
1652	EXCEL.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

EXCEL.EXEcmd.exe

description	pid	process	target process
PID 1652 wrote to memory of 1476	1652	EXCEL.EXE	cmd.exe
PID 1652 wrote to memory of 1476	1652	EXCEL.EXE	cmd.exe
PID 1652 wrote to memory of 1476	1652	EXCEL.EXE	cmd.exe
PID 1652 wrote to memory of 1476	1652	EXCEL.EXE	cmd.exe
PID 1476 wrote to memory of 1792	1476	cmd.exe	certutil.exe
PID 1476 wrote to memory of 1792	1476	cmd.exe	certutil.exe
PID 1476 wrote to memory of 1792	1476	cmd.exe	certutil.exe
PID 1476 wrote to memory of 1792	1476	cmd.exe	certutil.exe
PID 1476 wrote to memory of 1796	1476	cmd.exe	rundll32.exe
PID 1476 wrote to memory of 1796	1476	cmd.exe	rundll32.exe
PID 1476 wrote to memory of 1796	1476	cmd.exe	rundll32.exe
PID 1476 wrote to memory of 1796	1476	cmd.exe	rundll32.exe
PID 1476 wrote to memory of 1796	1476	cmd.exe	rundll32.exe
PID 1476 wrote to memory of 1796	1476	cmd.exe	rundll32.exe
PID 1476 wrote to memory of 1796	1476	cmd.exe	rundll32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\subscription_1618245993.xlsb
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c certutil -decode %PUBLIC%\7335.dpi %PUBLIC%\7335.pdo && rundll32 %PUBLIC%\7335.pdo,DF1
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\certutil.exe
certutil -decode C:\Users\Public\7335.dpi C:\Users\Public\7335.pdo
3⤵
PID:1792

C:\Windows\SysWOW64\rundll32.exe
rundll32 C:\Users\Public\7335.pdo,DF1
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\7335.dpi

MD5
4262c7dd52c84323b73e1c0210be4790

SHA1
634892c91f5ddfab0891fe7e004e50e46fe60cef

SHA256
325cf6eb4048d7e571abdaaf83980bf4407f7b9343de2f412bb4201653460191

SHA512
ba936581abed07502c02bc5bd64358f6f3ec3bde7f995d165f1b97107ba5255f7f4f26cb3a8dc6497e9979d42b5074fa44c939197375a007012f6c64d4cf4661

Download Submit
C:\Users\Public\7335.pdo

MD5
078d12bdc207572f9972d393790ea90d

SHA1
e0aef96555318bac394065c9721c0310ca0df091

SHA256
a9d8ae5ac1ac15a440d8d5e61287eb352f9da7cca60ce88727d338e960d8d461

SHA512
e1680756b206b83b43f7ee99416baea00ae851062b1e8be3211349c5ece7af591b58d46bbed059b12728ac6a8fbff7b7006008780e7f70c86c4c95bc844e094f

Download Submit
\Users\Public\7335.pdo

MD5
078d12bdc207572f9972d393790ea90d

SHA1
e0aef96555318bac394065c9721c0310ca0df091

SHA256
a9d8ae5ac1ac15a440d8d5e61287eb352f9da7cca60ce88727d338e960d8d461

SHA512
e1680756b206b83b43f7ee99416baea00ae851062b1e8be3211349c5ece7af591b58d46bbed059b12728ac6a8fbff7b7006008780e7f70c86c4c95bc844e094f

Download Submit
memory/1476-63-0x0000000000000000-mapping.dmp

Download
memory/1652-60-0x000000002FDA1000-0x000000002FDA4000-memory.dmp

Filesize
12KB

Download
memory/1652-61-0x0000000070F81000-0x0000000070F83000-memory.dmp

Filesize
8KB

Download
memory/1652-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1792-64-0x0000000000000000-mapping.dmp

Download
memory/1792-65-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/1796-67-0x0000000000000000-mapping.dmp

Download
memory/1796-71-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads