Overview
overview
10Static
static
8BANK RECEIPT.exe
windows7_x64
10BANK RECEIPT.exe
windows10_x64
10BOL.xlsm
windows7_x64
10BOL.xlsm
windows10_x64
10Inv_399139_86191.xlsm
windows7_x64
10Inv_399139_86191.xlsm
windows10_x64
10Ordine 400...xs.exe
windows7_x64
10Ordine 400...xs.exe
windows10_x64
10PO.exe
windows7_x64
10PO.exe
windows10_x64
10STATEMENT ...NT.exe
windows7_x64
10STATEMENT ...NT.exe
windows10_x64
10SWIFT-MT10...df.exe
windows7_x64
10SWIFT-MT10...df.exe
windows10_x64
10inquiries ...B .exe
windows7_x64
10inquiries ...B .exe
windows10_x64
10Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 22:02
Static task
static1
Behavioral task
behavioral1
Sample
BANK RECEIPT.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
BANK RECEIPT.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
BOL.xlsm
Resource
win7v20210408
Behavioral task
behavioral4
Sample
BOL.xlsm
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Inv_399139_86191.xlsm
Resource
win7v20210408
Behavioral task
behavioral6
Sample
Inv_399139_86191.xlsm
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Ordine 400225.xlxs.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Ordine 400225.xlxs.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
PO.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
PO.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
STATEMENT OF ACCOUNT.exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
STATEMENT OF ACCOUNT.exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
SWIFT-MT103_10262020.pdf.exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
SWIFT-MT103_10262020.pdf.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
inquiries for WCB .exe
Resource
win7v20210408
General
-
Target
BOL.xlsm
-
Size
44KB
-
MD5
56d32b6823bf5fd7d2360f423b62e9f2
-
SHA1
cc45d98bea6687480fa5d35bbfafa3ca3b873304
-
SHA256
00777c86e585397754f0e73a927bcaa3e39a4948d9bb28e758f0f5bfdac1eef4
-
SHA512
49351436490b45c0935d2cc9ea53397e79748612f90c21c83d7f9082451eb0c3184929add7a4434b5bcbbc62cdbae219388d7326e562e502f11f33cbd75114cd
Malware Config
Extracted
https://spacekicker.com/l6g9ann.gif
https://arvacol.com/mm4rtgiv.rar
https://www.stameco.com/a1wnyve.zip
https://rowquinte.ca/ksx0l5.pdf
https://appmc.servertrack.co/tldv5s7.pdf
https://bohnke.nl/kh9vsgk.txt
https://auditionsuite.com/nwn2v21.gif
https://static.danfosterdesign.co.uk/lru8mnc.rar
https://schalke04rss.de/qgahx29.rar
https://www.club-bergwerk.de/aejibnslx.txt
https://blog.robi2.hu/jhls4938.gif
https://SiluetaSportsWear.com/xszw6zgx.txt
https://geocache.altosaxplayer.com/a5k6di.gif
https://stroimdomsami.pp.ua/a9jlwkg.zip
https://m2.gameonlinefx31.com/aw57lpq.pdf
https://gramosindia.com/hqhln1pg.txt
https://arrowbo.com/u6hgcy.zip
https://mail.izmirfujitsuklimaservisi.com/e7fmruu.txt
https://mashroo3i.bh/fvvguy.zip
https://cron.altosaxplayer.com/lp7smh.pdf
https://custom.robi2.hu/d1vacq85z.zip
https://b15.robi2.hu/np2g0k1qb.jpg
https://oze-opole.pl/rp7dk89w.txt
https://mayhutchankhong.tv/b6bgoms.txt
https://m1.gameonlinefx2.com/xe11k5q1a.zip
https://instavcard.com/gmiwm3n.zip
https://mu-8.com/uknxaht7.gif
https://seaplanescenics.net/zxqzf1v.gif
https://beta.auditionsuite.com/guxjy8z.rar
https://isastyles.com/v8943vc4k.pdf
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
WerFault.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2296 3992 WerFault.exe EXCEL.EXE -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2296 created 3992 2296 WerFault.exe EXCEL.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2296 3992 WerFault.exe EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3992 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
WerFault.exepid process 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 2296 WerFault.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE 3992 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\BOL.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3992 -s 21162⤵
- Process spawned unexpected child process
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3992-114-0x00007FF754080000-0x00007FF757636000-memory.dmpFilesize
53.7MB
-
memory/3992-115-0x00007FFDCA390000-0x00007FFDCA3A0000-memory.dmpFilesize
64KB
-
memory/3992-116-0x00007FFDCA390000-0x00007FFDCA3A0000-memory.dmpFilesize
64KB
-
memory/3992-117-0x00007FFDCA390000-0x00007FFDCA3A0000-memory.dmpFilesize
64KB
-
memory/3992-118-0x00007FFDCA390000-0x00007FFDCA3A0000-memory.dmpFilesize
64KB
-
memory/3992-122-0x00007FFDCA390000-0x00007FFDCA3A0000-memory.dmpFilesize
64KB
-
memory/3992-121-0x00007FFDEAD10000-0x00007FFDEBDFE000-memory.dmpFilesize
16.9MB
-
memory/3992-123-0x000001B5AB6D0000-0x000001B5AD5C5000-memory.dmpFilesize
31.0MB
-
memory/3992-179-0x000001B5BF130000-0x000001B5BF134000-memory.dmpFilesize
16KB