Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
11-05-2021 12:14
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE ORDER 5112101.xlsx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
PURCHASE ORDER 5112101.xlsx
Resource
win10v20210410
General
-
Target
PURCHASE ORDER 5112101.xlsx
-
Size
1.4MB
-
MD5
5c28a20ff81428e4038d11a4eca86729
-
SHA1
8dd4efc4906f1227589515da1ce37f1a12f09e37
-
SHA256
fdf00af2636a0e8756bb4f8eece1dfe360127c96030ce3f4bbb1484909333de0
-
SHA512
ff727aab96c571b44d280b02b08bbe795d2623afd27982c7a3df2fb5c2b0d1edf7b84a8b69f365776e442cf58099beab879da532136fd7fd24033d7b7ee909e5
Malware Config
Extracted
xloader
2.3
http://www.drpratimakanade.com/bucw/
cypresscommonsmesa.com
xunzetec.com
remotelearningteaching.com
leftofcrypto.com
netoscarlocadora.com
christinahsmith.com
dentalimplantsrulerun.info
lovelutionsolutions.com
incintlservicesus.com
elktcg.com
spahnmovieranch.com
deaf-noise.xyz
shopanilora.com
mianmozx.com
brlnathletics.com
cornishway.com
landscapingdracut.com
herusageseesee.com
funimationapp.com
jflowllc.com
sorted-parts.com
mixterfee.com
epfinances.com
dgjincaiyanghua.com
topsych.com
tiga-roda.com
joewylie.com
ytlongfeng.com
rossehomemade.com
stallwell.com
bcmtx.com
z32gc-qgb.net
miceray.net
jasmine-yab.com
lionshield-services.com
trapcommander.com
clearidealsituation.info
multiassetchoice.net
myrootsandtrees.com
beardanceproperties.com
resaquina.com
hoatzinold.com
airmax90shoes.com
no-dietdiet.com
lanezexpress.com
kingsofmoisture.com
gardenremediesshop.com
lanmotoramin.com
surgery-instruments.com
useschoolkinder.com
onlinecannabisclass.com
americanwindowcoveringgroup.com
equiply.world
kings567.info
queenice.com
strippers4hire.com
peerhits.com
kickingbooks.com
tomrings.com
nataliagrigolierafaeltorres.com
108-bet.com
nasosd.com
beautypowere.xyz
jcpssocialstudies.net
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1204-79-0x000000000041D0D0-mapping.dmp xloader behavioral1/memory/1204-78-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1852-89-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 6 1996 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1776 vbc.exe 1204 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEpid process 1996 EQNEDT32.EXE 1996 EQNEDT32.EXE 1996 EQNEDT32.EXE 1996 EQNEDT32.EXE -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exeipconfig.exedescription pid process target process PID 1776 set thread context of 1204 1776 vbc.exe vbc.exe PID 1204 set thread context of 1212 1204 vbc.exe Explorer.EXE PID 1852 set thread context of 1212 1852 ipconfig.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1852 ipconfig.exe -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1080 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
vbc.exeipconfig.exepid process 1204 vbc.exe 1204 vbc.exe 1852 ipconfig.exe 1852 ipconfig.exe 1852 ipconfig.exe 1852 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exeipconfig.exepid process 1204 vbc.exe 1204 vbc.exe 1204 vbc.exe 1852 ipconfig.exe 1852 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1204 vbc.exe Token: SeDebugPrivilege 1852 ipconfig.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
EXCEL.EXEpid process 1080 EXCEL.EXE 1080 EXCEL.EXE 1080 EXCEL.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXEipconfig.exedescription pid process target process PID 1996 wrote to memory of 1776 1996 EQNEDT32.EXE vbc.exe PID 1996 wrote to memory of 1776 1996 EQNEDT32.EXE vbc.exe PID 1996 wrote to memory of 1776 1996 EQNEDT32.EXE vbc.exe PID 1996 wrote to memory of 1776 1996 EQNEDT32.EXE vbc.exe PID 1776 wrote to memory of 1204 1776 vbc.exe vbc.exe PID 1776 wrote to memory of 1204 1776 vbc.exe vbc.exe PID 1776 wrote to memory of 1204 1776 vbc.exe vbc.exe PID 1776 wrote to memory of 1204 1776 vbc.exe vbc.exe PID 1776 wrote to memory of 1204 1776 vbc.exe vbc.exe PID 1776 wrote to memory of 1204 1776 vbc.exe vbc.exe PID 1776 wrote to memory of 1204 1776 vbc.exe vbc.exe PID 1212 wrote to memory of 1852 1212 Explorer.EXE ipconfig.exe PID 1212 wrote to memory of 1852 1212 Explorer.EXE ipconfig.exe PID 1212 wrote to memory of 1852 1212 Explorer.EXE ipconfig.exe PID 1212 wrote to memory of 1852 1212 Explorer.EXE ipconfig.exe PID 1852 wrote to memory of 1292 1852 ipconfig.exe cmd.exe PID 1852 wrote to memory of 1292 1852 ipconfig.exe cmd.exe PID 1852 wrote to memory of 1292 1852 ipconfig.exe cmd.exe PID 1852 wrote to memory of 1292 1852 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 5112101.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
b0053ddc80b4aa7b07029f94c4d3f063
SHA11e77172b6474bed24831b97e4bd42828f0cce91e
SHA2564917a12fce46a55c99e102daf9b78b0a121dfad821abfe6a43d60e6dfde4c488
SHA512fd68bf311ef35ce444a6ad300de0180ba4f75f8233db5412db1788c38a6454383f460e8c03f15d3803296d7bdeb48da527f83f88b8c3679e28af543b10de2a16
-
C:\Users\Public\vbc.exeMD5
b0053ddc80b4aa7b07029f94c4d3f063
SHA11e77172b6474bed24831b97e4bd42828f0cce91e
SHA2564917a12fce46a55c99e102daf9b78b0a121dfad821abfe6a43d60e6dfde4c488
SHA512fd68bf311ef35ce444a6ad300de0180ba4f75f8233db5412db1788c38a6454383f460e8c03f15d3803296d7bdeb48da527f83f88b8c3679e28af543b10de2a16
-
C:\Users\Public\vbc.exeMD5
b0053ddc80b4aa7b07029f94c4d3f063
SHA11e77172b6474bed24831b97e4bd42828f0cce91e
SHA2564917a12fce46a55c99e102daf9b78b0a121dfad821abfe6a43d60e6dfde4c488
SHA512fd68bf311ef35ce444a6ad300de0180ba4f75f8233db5412db1788c38a6454383f460e8c03f15d3803296d7bdeb48da527f83f88b8c3679e28af543b10de2a16
-
\Users\Public\vbc.exeMD5
b0053ddc80b4aa7b07029f94c4d3f063
SHA11e77172b6474bed24831b97e4bd42828f0cce91e
SHA2564917a12fce46a55c99e102daf9b78b0a121dfad821abfe6a43d60e6dfde4c488
SHA512fd68bf311ef35ce444a6ad300de0180ba4f75f8233db5412db1788c38a6454383f460e8c03f15d3803296d7bdeb48da527f83f88b8c3679e28af543b10de2a16
-
\Users\Public\vbc.exeMD5
b0053ddc80b4aa7b07029f94c4d3f063
SHA11e77172b6474bed24831b97e4bd42828f0cce91e
SHA2564917a12fce46a55c99e102daf9b78b0a121dfad821abfe6a43d60e6dfde4c488
SHA512fd68bf311ef35ce444a6ad300de0180ba4f75f8233db5412db1788c38a6454383f460e8c03f15d3803296d7bdeb48da527f83f88b8c3679e28af543b10de2a16
-
\Users\Public\vbc.exeMD5
b0053ddc80b4aa7b07029f94c4d3f063
SHA11e77172b6474bed24831b97e4bd42828f0cce91e
SHA2564917a12fce46a55c99e102daf9b78b0a121dfad821abfe6a43d60e6dfde4c488
SHA512fd68bf311ef35ce444a6ad300de0180ba4f75f8233db5412db1788c38a6454383f460e8c03f15d3803296d7bdeb48da527f83f88b8c3679e28af543b10de2a16
-
\Users\Public\vbc.exeMD5
b0053ddc80b4aa7b07029f94c4d3f063
SHA11e77172b6474bed24831b97e4bd42828f0cce91e
SHA2564917a12fce46a55c99e102daf9b78b0a121dfad821abfe6a43d60e6dfde4c488
SHA512fd68bf311ef35ce444a6ad300de0180ba4f75f8233db5412db1788c38a6454383f460e8c03f15d3803296d7bdeb48da527f83f88b8c3679e28af543b10de2a16
-
memory/1080-75-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1080-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1080-60-0x000000002F7E1000-0x000000002F7E4000-memory.dmpFilesize
12KB
-
memory/1080-61-0x0000000070E31000-0x0000000070E33000-memory.dmpFilesize
8KB
-
memory/1204-78-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1204-83-0x0000000000120000-0x0000000000130000-memory.dmpFilesize
64KB
-
memory/1204-82-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/1204-79-0x000000000041D0D0-mapping.dmp
-
memory/1212-92-0x0000000003E20000-0x0000000003EEB000-memory.dmpFilesize
812KB
-
memory/1212-84-0x0000000004E80000-0x0000000004F9C000-memory.dmpFilesize
1.1MB
-
memory/1292-87-0x0000000000000000-mapping.dmp
-
memory/1776-74-0x00000000004B0000-0x00000000004B4000-memory.dmpFilesize
16KB
-
memory/1776-77-0x0000000005350000-0x00000000053CF000-memory.dmpFilesize
508KB
-
memory/1776-76-0x0000000005280000-0x0000000005342000-memory.dmpFilesize
776KB
-
memory/1776-68-0x0000000000000000-mapping.dmp
-
memory/1776-73-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/1776-71-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/1852-85-0x0000000000000000-mapping.dmp
-
memory/1852-89-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1852-90-0x0000000002400000-0x0000000002703000-memory.dmpFilesize
3.0MB
-
memory/1852-88-0x0000000000790000-0x000000000079A000-memory.dmpFilesize
40KB
-
memory/1852-91-0x00000000005E0000-0x000000000066F000-memory.dmpFilesize
572KB
-
memory/1996-63-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB