Overview

overview

10

Static

static

8

BANK RECEIPT.exe

windows7_x64

10

BANK RECEIPT.exe

windows10_x64

10

BOL.xlsm

windows7_x64

10

BOL.xlsm

windows10_x64

10

Inv_399139_86191.xlsm

windows7_x64

10

Inv_399139_86191.xlsm

windows10_x64

10

Ordine 400...xs.exe

windows7_x64

10

Ordine 400...xs.exe

windows10_x64

10

PO.exe

windows7_x64

10

PO.exe

windows10_x64

10

STATEMENT ...NT.exe

windows7_x64

10

STATEMENT ...NT.exe

windows10_x64

10

SWIFT-MT10...df.exe

windows7_x64

10

SWIFT-MT10...df.exe

windows10_x64

10

inquiries ...B .exe

windows7_x64

10

inquiries ...B .exe

windows10_x64

10

Analysis

  • max time kernel
    102s
  • max time network
    55s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    06-05-2021 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BOL.xlsm

  • Size

    44KB

  • MD5

    56d32b6823bf5fd7d2360f423b62e9f2

  • SHA1

    cc45d98bea6687480fa5d35bbfafa3ca3b873304

  • SHA256

    00777c86e585397754f0e73a927bcaa3e39a4948d9bb28e758f0f5bfdac1eef4

  • SHA512

    49351436490b45c0935d2cc9ea53397e79748612f90c21c83d7f9082451eb0c3184929add7a4434b5bcbbc62cdbae219388d7326e562e502f11f33cbd75114cd

Score
10/10

Malware Config

Extracted

Language
vba
URLs
vba.dropper

https://spacekicker.com/l6g9ann.gif
vba.dropper

https://arvacol.com/mm4rtgiv.rar
vba.dropper

https://www.stameco.com/a1wnyve.zip
vba.dropper

https://rowquinte.ca/ksx0l5.pdf
vba.dropper

https://appmc.servertrack.co/tldv5s7.pdf
vba.dropper

https://bohnke.nl/kh9vsgk.txt
vba.dropper

https://auditionsuite.com/nwn2v21.gif
vba.dropper

https://static.danfosterdesign.co.uk/lru8mnc.rar
vba.dropper

https://schalke04rss.de/qgahx29.rar
vba.dropper

https://www.club-bergwerk.de/aejibnslx.txt
vba.dropper

https://blog.robi2.hu/jhls4938.gif
vba.dropper

https://SiluetaSportsWear.com/xszw6zgx.txt
vba.dropper

https://geocache.altosaxplayer.com/a5k6di.gif
vba.dropper

https://stroimdomsami.pp.ua/a9jlwkg.zip
vba.dropper

https://m2.gameonlinefx31.com/aw57lpq.pdf
vba.dropper

https://gramosindia.com/hqhln1pg.txt
vba.dropper

https://arrowbo.com/u6hgcy.zip
vba.dropper

https://mail.izmirfujitsuklimaservisi.com/e7fmruu.txt
vba.dropper

https://mashroo3i.bh/fvvguy.zip
vba.dropper

https://cron.altosaxplayer.com/lp7smh.pdf

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://mayhutchankhong.tv/b6bgoms.txt

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\BOL.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\vtcoz._VV
      2⤵
      • Process spawned unexpected child process
      PID:1880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1880-64-0x0000000000000000-mapping.dmp
    Download
  • memory/1880-65-0x0000000075B31000-0x0000000075B33000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2004-60-0x000000002FBA1000-0x000000002FBA4000-memory.dmp
    Filesize

    12KB

    Download
  • memory/2004-61-0x0000000071B91000-0x0000000071B93000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2004-62-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2004-63-0x0000000006420000-0x0000000006422000-memory.dmp
    Filesize

    8KB

    Download
  • memory/2004-66-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

    Download