nloader | b531240b028bf80d1b244e5750804f5f90affbd740e04fe2674a58eb729e085a

General

Target

subscription_1618246083.xlsb
Size

312KB
MD5

57aa3c80903144a5756e0483b75c8803
SHA1

d67e66ba33973ce5785194c6fbd7c4aed51dc38d
SHA256

b531240b028bf80d1b244e5750804f5f90affbd740e04fe2674a58eb729e085a
SHA512

0c3edc91c68a27b30c53ddc2da4e02af001bf5d35b92dfddc04208658998a0b3763a3ab8015d17ee8d478b299baf89be565f83cca2ccf0054ad51a7e72f65c74

Score

10^/10

nloader loader

Malware Config

Signatures

Nloader
Simple loader that includes the keyword 'cambo' in the URL used to download other families.
loader nloader

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2696	3680	cmd.exe	EXCEL.EXE

Nloader Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3348-186-0x0000000010000000-0x0000000010005000-memory.dmp	nloader

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

23 3348 rundll32.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3348 rundll32.exe

flow	pid	process
23	3348	rundll32.exe

pid	process
3348	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3680 EXCEL.EXE

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE
3680	EXCEL.EXE

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

EXCEL.EXEcmd.exerundll32.exe

description	pid	process	target process
PID 3680 wrote to memory of 2696	3680	EXCEL.EXE	cmd.exe
PID 3680 wrote to memory of 2696	3680	EXCEL.EXE	cmd.exe
PID 2696 wrote to memory of 1768	2696	cmd.exe	certutil.exe
PID 2696 wrote to memory of 1768	2696	cmd.exe	certutil.exe
PID 2696 wrote to memory of 4040	2696	cmd.exe	rundll32.exe
PID 2696 wrote to memory of 4040	2696	cmd.exe	rundll32.exe
PID 4040 wrote to memory of 3348	4040	rundll32.exe	rundll32.exe
PID 4040 wrote to memory of 3348	4040	rundll32.exe	rundll32.exe
PID 4040 wrote to memory of 3348	4040	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\subscription_1618246083.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680

C:\Windows\SYSTEM32\cmd.exe
cmd.exe /c certutil -decode %PUBLIC%\7335.dpi %PUBLIC%\7335.pdo && rundll32 %PUBLIC%\7335.pdo,DF1
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2696

C:\Windows\system32\certutil.exe
certutil -decode C:\Users\Public\7335.dpi C:\Users\Public\7335.pdo
3⤵
PID:1768

C:\Windows\system32\rundll32.exe
rundll32 C:\Users\Public\7335.pdo,DF1
3⤵
- Suspicious use of WriteProcessMemory
PID:4040

C:\Windows\SysWOW64\rundll32.exe
rundll32 C:\Users\Public\7335.pdo,DF1
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\7335.dpi

MD5
4262c7dd52c84323b73e1c0210be4790

SHA1
634892c91f5ddfab0891fe7e004e50e46fe60cef

SHA256
325cf6eb4048d7e571abdaaf83980bf4407f7b9343de2f412bb4201653460191

SHA512
ba936581abed07502c02bc5bd64358f6f3ec3bde7f995d165f1b97107ba5255f7f4f26cb3a8dc6497e9979d42b5074fa44c939197375a007012f6c64d4cf4661

Download Submit
C:\Users\Public\7335.pdo

MD5
078d12bdc207572f9972d393790ea90d

SHA1
e0aef96555318bac394065c9721c0310ca0df091

SHA256
a9d8ae5ac1ac15a440d8d5e61287eb352f9da7cca60ce88727d338e960d8d461

SHA512
e1680756b206b83b43f7ee99416baea00ae851062b1e8be3211349c5ece7af591b58d46bbed059b12728ac6a8fbff7b7006008780e7f70c86c4c95bc844e094f

Download Submit
\Users\Public\7335.pdo

MD5
078d12bdc207572f9972d393790ea90d

SHA1
e0aef96555318bac394065c9721c0310ca0df091

SHA256
a9d8ae5ac1ac15a440d8d5e61287eb352f9da7cca60ce88727d338e960d8d461

SHA512
e1680756b206b83b43f7ee99416baea00ae851062b1e8be3211349c5ece7af591b58d46bbed059b12728ac6a8fbff7b7006008780e7f70c86c4c95bc844e094f

Download Submit
memory/1768-180-0x0000000000000000-mapping.dmp

Download
memory/2696-179-0x0000000000000000-mapping.dmp

Download
memory/3348-184-0x0000000000000000-mapping.dmp

Download
memory/3348-186-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/3680-122-0x00007FF85A170000-0x00007FF85A180000-memory.dmp

Filesize
64KB

Download
memory/3680-121-0x00007FF87AD70000-0x00007FF87BE5E000-memory.dmp

Filesize
16.9MB

Download
memory/3680-123-0x00007FF878D90000-0x00007FF87AC85000-memory.dmp

Filesize
31.0MB

Download
memory/3680-114-0x00007FF708AA0000-0x00007FF70C056000-memory.dmp

Filesize
53.7MB

Download
memory/3680-118-0x00007FF85A170000-0x00007FF85A180000-memory.dmp

Filesize
64KB

Download
memory/3680-117-0x00007FF85A170000-0x00007FF85A180000-memory.dmp

Filesize
64KB

Download
memory/3680-116-0x00007FF85A170000-0x00007FF85A180000-memory.dmp

Filesize
64KB

Download
memory/3680-115-0x00007FF85A170000-0x00007FF85A180000-memory.dmp

Filesize
64KB

Download
memory/4040-182-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads