Analysis

  • max time kernel
    150s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    29-06-2021 22:04

General

  • Target

    plan-515372324.xlsb

  • Size

    155KB

  • MD5

    08e52afbefa423fb9f1ea0af88a4880e

  • SHA1

    2d688dfee28f75553bc1d3633f891d2e70e0408b

  • SHA256

    aaa32ff3e41c61fe828f0850e702f5ed7ffd6177c4bf80ed15324525537f44cd

  • SHA512

    7a5400ec826ecaa0fa6a8beb9022bd9e918f11cf97e57d747477720889f7203af983620e2f7b543fb1ff5cc5a9eff13447d6353506c862dfe2ebd23b7a63dee8

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://khangland.pro/v8gEDeSB/sun.html

xlm40.dropper

https://jaipurbynite.com/stLdQs9R53/sun.htm

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\plan-515372324.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3236
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3800
      • C:\Windows\SYSTEM32\regsvr32.exe
        regsvr32 ..\palpy1.dll
        2⤵
        • Process spawned unexpected child process
        PID:3148
      • C:\Windows\SYSTEM32\regsvr32.exe
        regsvr32 ..\palpy2.dll
        2⤵
        • Process spawned unexpected child process
        PID:2192

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2192-181-0x0000000000000000-mapping.dmp
    • memory/3148-180-0x0000000000000000-mapping.dmp
    • memory/3236-114-0x00007FF6FE240000-0x00007FF7017F6000-memory.dmp
      Filesize

      53MB

    • memory/3236-115-0x00007FFA08250000-0x00007FFA08260000-memory.dmp
      Filesize

      64KB

    • memory/3236-116-0x00007FFA08250000-0x00007FFA08260000-memory.dmp
      Filesize

      64KB

    • memory/3236-117-0x00007FFA08250000-0x00007FFA08260000-memory.dmp
      Filesize

      64KB

    • memory/3236-118-0x00007FFA08250000-0x00007FFA08260000-memory.dmp
      Filesize

      64KB

    • memory/3236-119-0x00007FFA08250000-0x00007FFA08260000-memory.dmp
      Filesize

      64KB

    • memory/3236-122-0x00007FFA28EA0000-0x00007FFA29F8E000-memory.dmp
      Filesize

      16MB

    • memory/3236-123-0x00007FFA26EE0000-0x00007FFA28DD5000-memory.dmp
      Filesize

      30MB

    • memory/3800-179-0x0000000000000000-mapping.dmp