nloader | b531240b028bf80d1b244e5750804f5f90affbd740e04fe2674a58eb729e085a

General

Target

subscription_1618246083.xlsb
Size

312KB
MD5

57aa3c80903144a5756e0483b75c8803
SHA1

d67e66ba33973ce5785194c6fbd7c4aed51dc38d
SHA256

b531240b028bf80d1b244e5750804f5f90affbd740e04fe2674a58eb729e085a
SHA512

0c3edc91c68a27b30c53ddc2da4e02af001bf5d35b92dfddc04208658998a0b3763a3ab8015d17ee8d478b299baf89be565f83cca2ccf0054ad51a7e72f65c74

Score

10^/10

nloader loader

Malware Config

Extracted

Language

xlm4.0

Source

Signatures

Nloader
Simple loader that includes the keyword 'cambo' in the URL used to download other families.
loader nloader

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	688	1348	cmd.exe	EXCEL.EXE

Nloader Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/900-71-0x0000000010000000-0x0000000010005000-memory.dmp	nloader

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

6 900 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

900 rundll32.exe
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

flow	pid	process
6	900	rundll32.exe

pid	process
900	rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1348 EXCEL.EXE
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1348 EXCEL.EXE
1348 EXCEL.EXE
1348 EXCEL.EXE

pid	process
1348	EXCEL.EXE

pid	process
1348	EXCEL.EXE
1348	EXCEL.EXE
1348	EXCEL.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

EXCEL.EXEcmd.exe

description	pid	process	target process
PID 1348 wrote to memory of 688	1348	EXCEL.EXE	cmd.exe
PID 1348 wrote to memory of 688	1348	EXCEL.EXE	cmd.exe
PID 1348 wrote to memory of 688	1348	EXCEL.EXE	cmd.exe
PID 1348 wrote to memory of 688	1348	EXCEL.EXE	cmd.exe
PID 688 wrote to memory of 1524	688	cmd.exe	certutil.exe
PID 688 wrote to memory of 1524	688	cmd.exe	certutil.exe
PID 688 wrote to memory of 1524	688	cmd.exe	certutil.exe
PID 688 wrote to memory of 1524	688	cmd.exe	certutil.exe
PID 688 wrote to memory of 900	688	cmd.exe	rundll32.exe
PID 688 wrote to memory of 900	688	cmd.exe	rundll32.exe
PID 688 wrote to memory of 900	688	cmd.exe	rundll32.exe
PID 688 wrote to memory of 900	688	cmd.exe	rundll32.exe
PID 688 wrote to memory of 900	688	cmd.exe	rundll32.exe
PID 688 wrote to memory of 900	688	cmd.exe	rundll32.exe
PID 688 wrote to memory of 900	688	cmd.exe	rundll32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\subscription_1618246083.xlsb
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c certutil -decode %PUBLIC%\7335.dpi %PUBLIC%\7335.pdo && rundll32 %PUBLIC%\7335.pdo,DF1
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\SysWOW64\certutil.exe
certutil -decode C:\Users\Public\7335.dpi C:\Users\Public\7335.pdo
3⤵
PID:1524

C:\Windows\SysWOW64\rundll32.exe
rundll32 C:\Users\Public\7335.pdo,DF1
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\7335.dpi

MD5
4262c7dd52c84323b73e1c0210be4790

SHA1
634892c91f5ddfab0891fe7e004e50e46fe60cef

SHA256
325cf6eb4048d7e571abdaaf83980bf4407f7b9343de2f412bb4201653460191

SHA512
ba936581abed07502c02bc5bd64358f6f3ec3bde7f995d165f1b97107ba5255f7f4f26cb3a8dc6497e9979d42b5074fa44c939197375a007012f6c64d4cf4661

Download Submit
C:\Users\Public\7335.pdo

MD5
078d12bdc207572f9972d393790ea90d

SHA1
e0aef96555318bac394065c9721c0310ca0df091

SHA256
a9d8ae5ac1ac15a440d8d5e61287eb352f9da7cca60ce88727d338e960d8d461

SHA512
e1680756b206b83b43f7ee99416baea00ae851062b1e8be3211349c5ece7af591b58d46bbed059b12728ac6a8fbff7b7006008780e7f70c86c4c95bc844e094f

Download Submit
\Users\Public\7335.pdo

MD5
078d12bdc207572f9972d393790ea90d

SHA1
e0aef96555318bac394065c9721c0310ca0df091

SHA256
a9d8ae5ac1ac15a440d8d5e61287eb352f9da7cca60ce88727d338e960d8d461

SHA512
e1680756b206b83b43f7ee99416baea00ae851062b1e8be3211349c5ece7af591b58d46bbed059b12728ac6a8fbff7b7006008780e7f70c86c4c95bc844e094f

Download Submit
memory/688-63-0x0000000000000000-mapping.dmp

Download
memory/900-67-0x0000000000000000-mapping.dmp

Download
memory/900-71-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/1348-60-0x000000002F611000-0x000000002F614000-memory.dmp

Filesize
12KB

Download
memory/1348-61-0x0000000071CA1000-0x0000000071CA3000-memory.dmp

Filesize
8KB

Download
memory/1348-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1524-64-0x0000000000000000-mapping.dmp

Download
memory/1524-65-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads