Analysis
-
max time kernel
149s -
max time network
130s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-04-2021 22:38
Behavioral task
behavioral1
Sample
catalog-1019606821.xlsm
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
catalog-1019606821.xlsm
-
Size
109KB
-
MD5
6752952c0f925510237749391e2a19b9
-
SHA1
73517b8a4db9f844dfb23d2dc4112787381007f7
-
SHA256
1dbf2fb41819380571659fe6b7346c95b20c531c269722646a897c1dd4e54b41
-
SHA512
2be935f8ca72ec79af17154c661c88040d0151e52c46865d040a44180d7de9682c376e238ebeb1efec0f3793c2408c7be36d3ac8eaa6228492f2843ae7fd070c
Score
10/10
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
https://immobiliareneri.casa/drms/ind.html
xlm40.dropper
https://gidbasket.com/drms/ind.html
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1648 772 rundll32.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1532 772 rundll32.exe EXCEL.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 772 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 772 EXCEL.EXE 772 EXCEL.EXE 772 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 772 wrote to memory of 1648 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1648 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1648 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1648 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1648 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1648 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1648 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1532 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1532 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1532 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1532 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1532 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1532 772 EXCEL.EXE rundll32.exe PID 772 wrote to memory of 1532 772 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\catalog-1019606821.xlsm1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\rundll32.exerundll32 ..\duron.bnm1,DllRegisterServer2⤵
- Process spawned unexpected child process
PID:1648 -
C:\Windows\SysWOW64\rundll32.exerundll32 ..\duron.bnm2,DllRegisterServer2⤵
- Process spawned unexpected child process
PID:1532
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/772-60-0x000000002FC31000-0x000000002FC34000-memory.dmpFilesize
12KB
-
memory/772-61-0x0000000071981000-0x0000000071983000-memory.dmpFilesize
8KB
-
memory/772-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1532-65-0x0000000000000000-mapping.dmp
-
memory/1648-63-0x0000000000000000-mapping.dmp
-
memory/1648-64-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB