Analysis

  • max time kernel
    152s
  • max time network
    93s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    18-05-2021 19:14

General

  • Target

    cancel_sub_JPL12345678901234.xlsb

  • Size

    241KB

  • MD5

    b4a0b38ff2bd7619e42c0f1d1fb0171b

  • SHA1

    c0e61bcc7139bc2342e5a9eb9a2bc056c475624d

  • SHA256

    3cc4948d4d3cac89a74284ae4dc49d177b834f295e9f767a46dcd73726b7239d

  • SHA512

    8830468a4f8ee1032abe7ede05fdc11fb592355c81447bf0d65b995a6d6a55fc399025084bb74bb7f4b52a14ee7a2ea79a2100480222c1da95e19b3b4a59cff5

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source

Signatures

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\cancel_sub_JPL12345678901234.xlsb
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:784
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c certutil -decode C:\Users\Public\4802545.xs1 C:\Users\Public\4802545.xs2 && rundll32 C:\Users\Public\4802545.xs2,DF1
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:400
        • C:\Windows\SysWOW64\certutil.exe
          certutil -decode C:\Users\Public\4802545.xs1 C:\Users\Public\4802545.xs2
          3⤵
            PID:2000
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 C:\Users\Public\4802545.xs2,DF1
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1596
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1596 -s 436
              4⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:316

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Public\4802545.xs1

        MD5

        e3c91eeeec07ed08ff35991cd1f8926d

        SHA1

        7f4b8b7a2968977de612be4938e4d2563b388884

        SHA256

        975509717b69e7c6dc7e20ac3421f710591df6b8b08f1fd93b042e44403db0b9

        SHA512

        389f20e6f01a0a6707ad2aadce542612b3fbefeb7a586d140a471f765c84a1ec55ae19f1c4bef8d353881e1fdb16f2ae33cd9cfb3aae342f10628e54b51246da

      • C:\Users\Public\4802545.xs2

        MD5

        cfb94c893280fd1edd40a4c74031727a

        SHA1

        9bf1f365e14842621854282f976b890478816a77

        SHA256

        3205ebcea1f138f0171ff3815d594883805b4af48a24bc0d6228d0b0ee12ddb4

        SHA512

        31b573054e5963c939cab24b48a8610f757ea94eba21c5101f2df3ffd8fc3120327795692feda7d448091a93b4befb389eed48e17662d7f2e3b19cc441a56988

      • \Users\Public\4802545.xs2

        MD5

        cfb94c893280fd1edd40a4c74031727a

        SHA1

        9bf1f365e14842621854282f976b890478816a77

        SHA256

        3205ebcea1f138f0171ff3815d594883805b4af48a24bc0d6228d0b0ee12ddb4

        SHA512

        31b573054e5963c939cab24b48a8610f757ea94eba21c5101f2df3ffd8fc3120327795692feda7d448091a93b4befb389eed48e17662d7f2e3b19cc441a56988

      • memory/316-76-0x0000000000260000-0x00000000002C0000-memory.dmp

        Filesize

        384KB

      • memory/316-75-0x0000000000000000-mapping.dmp

      • memory/400-65-0x0000000000000000-mapping.dmp

      • memory/784-64-0x000007FEFBAA1000-0x000007FEFBAA3000-memory.dmp

        Filesize

        8KB

      • memory/784-63-0x0000000000000000-mapping.dmp

      • memory/1080-60-0x000000002F781000-0x000000002F784000-memory.dmp

        Filesize

        12KB

      • memory/1080-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1080-61-0x0000000071351000-0x0000000071353000-memory.dmp

        Filesize

        8KB

      • memory/1080-77-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1596-69-0x0000000000000000-mapping.dmp

      • memory/1596-73-0x00000000001A0000-0x00000000001A5000-memory.dmp

        Filesize

        20KB

      • memory/2000-67-0x0000000075AF1000-0x0000000075AF3000-memory.dmp

        Filesize

        8KB

      • memory/2000-66-0x0000000000000000-mapping.dmp