nloader | 5aab7a71287ccd1bb7c20829709eaae67beb0092ee9e8d8ce60d8870e7775fda

General

Target

subscription_1618245993.xlsb
Size

312KB
MD5

a025ee5205f9a2af4ec332478dee53eb
SHA1

a4777e075e2895f65b38cea4fd4fa0b031587647
SHA256

5aab7a71287ccd1bb7c20829709eaae67beb0092ee9e8d8ce60d8870e7775fda
SHA512

28f8f9fd9d48843f529c2d9b1498e984fbb382adc8e8bea9e5635d03293b48f3d142374f30527b985096183aa7c66e48202bb6ca0f5a617abf97064148cf46c7

Score

10^/10

nloader loader

Malware Config

Signatures

Nloader
Simple loader that includes the keyword 'cambo' in the URL used to download other families.
loader nloader

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2620	4436	cmd.exe	EXCEL.EXE

Nloader Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/812-186-0x0000000010000000-0x0000000010005000-memory.dmp	nloader

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

26 812 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

812 rundll32.exe

flow	pid	process
26	812	rundll32.exe

pid	process
812	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4436 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
4436	EXCEL.EXE
4436	EXCEL.EXE
4436	EXCEL.EXE
4436	EXCEL.EXE
4436	EXCEL.EXE
4436	EXCEL.EXE
4436	EXCEL.EXE
4436	EXCEL.EXE
4436	EXCEL.EXE
4436	EXCEL.EXE
4436	EXCEL.EXE
4436	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

EXCEL.EXEcmd.exerundll32.exe

description	pid	process	target process
PID 4436 wrote to memory of 2620	4436	EXCEL.EXE	cmd.exe
PID 4436 wrote to memory of 2620	4436	EXCEL.EXE	cmd.exe
PID 2620 wrote to memory of 648	2620	cmd.exe	certutil.exe
PID 2620 wrote to memory of 648	2620	cmd.exe	certutil.exe
PID 2620 wrote to memory of 1356	2620	cmd.exe	rundll32.exe
PID 2620 wrote to memory of 1356	2620	cmd.exe	rundll32.exe
PID 1356 wrote to memory of 812	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 812	1356	rundll32.exe	rundll32.exe
PID 1356 wrote to memory of 812	1356	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\subscription_1618245993.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4436

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c certutil -decode %PUBLIC%\7335.dpi %PUBLIC%\7335.pdo && rundll32 %PUBLIC%\7335.pdo,DF1
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\system32\certutil.exe
certutil -decode C:\Users\Public\7335.dpi C:\Users\Public\7335.pdo
3⤵
PID:648

C:\Windows\system32\rundll32.exe
rundll32 C:\Users\Public\7335.pdo,DF1
3⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\rundll32.exe
rundll32 C:\Users\Public\7335.pdo,DF1
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\7335.dpi

MD5
4262c7dd52c84323b73e1c0210be4790

SHA1
634892c91f5ddfab0891fe7e004e50e46fe60cef

SHA256
325cf6eb4048d7e571abdaaf83980bf4407f7b9343de2f412bb4201653460191

SHA512
ba936581abed07502c02bc5bd64358f6f3ec3bde7f995d165f1b97107ba5255f7f4f26cb3a8dc6497e9979d42b5074fa44c939197375a007012f6c64d4cf4661

Download Submit
C:\Users\Public\7335.pdo

MD5
078d12bdc207572f9972d393790ea90d

SHA1
e0aef96555318bac394065c9721c0310ca0df091

SHA256
a9d8ae5ac1ac15a440d8d5e61287eb352f9da7cca60ce88727d338e960d8d461

SHA512
e1680756b206b83b43f7ee99416baea00ae851062b1e8be3211349c5ece7af591b58d46bbed059b12728ac6a8fbff7b7006008780e7f70c86c4c95bc844e094f

Download Submit
\Users\Public\7335.pdo

MD5
078d12bdc207572f9972d393790ea90d

SHA1
e0aef96555318bac394065c9721c0310ca0df091

SHA256
a9d8ae5ac1ac15a440d8d5e61287eb352f9da7cca60ce88727d338e960d8d461

SHA512
e1680756b206b83b43f7ee99416baea00ae851062b1e8be3211349c5ece7af591b58d46bbed059b12728ac6a8fbff7b7006008780e7f70c86c4c95bc844e094f

Download Submit
memory/648-180-0x0000000000000000-mapping.dmp

Download
memory/812-186-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/812-184-0x0000000000000000-mapping.dmp

Download
memory/1356-182-0x0000000000000000-mapping.dmp

Download
memory/2620-179-0x0000000000000000-mapping.dmp

Download
memory/4436-114-0x00007FF774220000-0x00007FF7777D6000-memory.dmp

Filesize
53.7MB

Download
memory/4436-123-0x00007FF9D30C0000-0x00007FF9D4FB5000-memory.dmp

Filesize
31.0MB

Download
memory/4436-122-0x00007FF9D4FC0000-0x00007FF9D60AE000-memory.dmp

Filesize
16.9MB

Download
memory/4436-121-0x00007FF9B4570000-0x00007FF9B4580000-memory.dmp

Filesize
64KB

Download
memory/4436-118-0x00007FF9B4570000-0x00007FF9B4580000-memory.dmp

Filesize
64KB

Download
memory/4436-117-0x00007FF9B4570000-0x00007FF9B4580000-memory.dmp

Filesize
64KB

Download
memory/4436-116-0x00007FF9B4570000-0x00007FF9B4580000-memory.dmp

Filesize
64KB

Download
memory/4436-115-0x00007FF9B4570000-0x00007FF9B4580000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads