Analysis
-
max time kernel
148s -
max time network
122s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-04-2021 22:36
Behavioral task
behavioral1
Sample
catalog-1005288061.xlsm
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
catalog-1005288061.xlsm
-
Size
109KB
-
MD5
fc37bfa1cfb3ba7096846d98b91d6b75
-
SHA1
714d99891d3f570eed053ae8aee0c215e470da94
-
SHA256
4aa1b8d61bdb6cf73b3986bec76d81dd03573b694b58372144dc85972dc9387f
-
SHA512
d97dc445f8c52b3c6059cd2bb643d5f5bb89a4371e5eddbf5031086d23053878339987a75121e376991838fea1d2ad451d687d45849269c4398ed8b32349565b
Score
10/10
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
https://immobiliareneri.casa/drms/ind.html
xlm40.dropper
https://gidbasket.com/drms/ind.html
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 620 788 rundll32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 732 788 rundll32.exe EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 788 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 788 EXCEL.EXE 788 EXCEL.EXE 788 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 788 wrote to memory of 620 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 620 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 620 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 620 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 620 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 620 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 620 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 732 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 732 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 732 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 732 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 732 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 732 788 EXCEL.EXE rundll32.exe PID 788 wrote to memory of 732 788 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\catalog-1005288061.xlsm1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\duron.bnm1,DllRegisterServer2⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32 ..\duron.bnm2,DllRegisterServer2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/620-62-0x0000000000000000-mapping.dmp
-
memory/620-63-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/732-64-0x0000000000000000-mapping.dmp
-
memory/788-59-0x000000002FB81000-0x000000002FB84000-memory.dmpFilesize
12KB
-
memory/788-60-0x0000000071391000-0x0000000071393000-memory.dmpFilesize
8KB
-
memory/788-61-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB