Analysis

  • max time kernel
    125s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    15-04-2021 06:27

General

  • Target

    subscription_1618420095.xlsb

Score
10/10

Malware Config

Signatures

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload 1 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\subscription_1618420095.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c certutil -decode %PUBLIC%\130486.dot %PUBLIC%\130486.pgj && rundll32 %PUBLIC%\130486.pgj,DF1
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Windows\system32\certutil.exe
        certutil -decode C:\Users\Public\130486.dot C:\Users\Public\130486.pgj
        3⤵
          PID:3044
        • C:\Windows\system32\rundll32.exe
          rundll32 C:\Users\Public\130486.pgj,DF1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1416
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 C:\Users\Public\130486.pgj,DF1
            4⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            PID:2840

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\130486.dot
      MD5

      5ad4845793b5dc3308172b39f3c3dbc7

      SHA1

      4285a93ec1a49f28cb2542af2a2bafc08e4f8a18

      SHA256

      2632c0cc222a6d436b50a418605a7bd4fa8f363ab8d93d10b831cdb28a2ac1bc

      SHA512

      4a1c88eb99d9d9713802f5f2c9b96d15bb4cab8af7360c62d3e1b614fe07ea33771b33075c15a0f400daad7a713edc684e2c0566cd9ab5805b00f05e3b58a5df

    • C:\Users\Public\130486.pgj
      MD5

      14089c2d5a4207dd80f71fb258200848

      SHA1

      80fa3d47f321108d7c956680ac1b1f5c611d6277

      SHA256

      f3b5cf1e40aed4567a8996cf107285907d432b4bc8cc3d0b46aae628813d82d4

      SHA512

      cbfcbcddb80749711853aa7d39525e299015d31451615cfce64e54f197d6a1e87deb60920723c7a90b30c0da05e469c4208a758e93ad2e49f9e78eefb231bfa6

    • \Users\Public\130486.pgj
      MD5

      14089c2d5a4207dd80f71fb258200848

      SHA1

      80fa3d47f321108d7c956680ac1b1f5c611d6277

      SHA256

      f3b5cf1e40aed4567a8996cf107285907d432b4bc8cc3d0b46aae628813d82d4

      SHA512

      cbfcbcddb80749711853aa7d39525e299015d31451615cfce64e54f197d6a1e87deb60920723c7a90b30c0da05e469c4208a758e93ad2e49f9e78eefb231bfa6

    • memory/736-118-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp
      Filesize

      64KB

    • memory/736-114-0x00007FF77CAE0000-0x00007FF780096000-memory.dmp
      Filesize

      53.7MB

    • memory/736-121-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp
      Filesize

      64KB

    • memory/736-122-0x00007FFD107A0000-0x00007FFD1188E000-memory.dmp
      Filesize

      16.9MB

    • memory/736-123-0x000001D5054F0000-0x000001D5073E5000-memory.dmp
      Filesize

      31.0MB

    • memory/736-117-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp
      Filesize

      64KB

    • memory/736-116-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp
      Filesize

      64KB

    • memory/736-115-0x00007FFCEFED0000-0x00007FFCEFEE0000-memory.dmp
      Filesize

      64KB

    • memory/1336-179-0x0000000000000000-mapping.dmp
    • memory/1416-182-0x0000000000000000-mapping.dmp
    • memory/2840-184-0x0000000000000000-mapping.dmp
    • memory/2840-186-0x0000000000960000-0x0000000000966000-memory.dmp
      Filesize

      24KB

    • memory/3044-180-0x0000000000000000-mapping.dmp