Analysis

  • max time kernel
    43s
  • max time network
    53s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    14-07-2021 02:36

General

  • Target

    subscription_1617291613.xlsb

  • Size

    228KB

  • MD5

    8a3364bafa63166394862068b05f5469

  • SHA1

    b039cb7a479cf118d53c61e113ad74015caadd22

  • SHA256

    3d0b681046147d8008b70bab97c41e3a21a283559874ac2ce0c518b6965312da

  • SHA512

    27c70c7fd278222a17112c0e3deb16a84f36f080a6fd933d51c4cc73392654414991ae0ba99e9760008c40a865572380c03a3b3af9297cb1a3678c630ca18111

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source

Signatures

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\subscription_1617291613.xlsb
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:760
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c certutil -decode %PUBLIC%\569390.pdi %PUBLIC%\569390.ui && rundll32 %PUBLIC%\569390.ui,DF1
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Windows\SysWOW64\certutil.exe
        certutil -decode C:\Users\Public\569390.pdi C:\Users\Public\569390.ui
        3⤵
          PID:1432
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32 C:\Users\Public\569390.ui,DF1
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1588
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 432
            4⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:436

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\569390.pdi

      MD5

      5cc5f895b91ab4c1835ac9b83e86663b

      SHA1

      b51565a65b167172b71516435f4118ec9a278673

      SHA256

      81a75221faf7f28e2b2ce76471499d72b94da9ae48e0e1dc5bf01060e9195065

      SHA512

      3a4289acdc392d999f4edde46c4261956b9be0aba355dc730a7bee08b9b00dff8733f84c97365aa773fad8bde29aa8dc040aac3067e7af3e7f75049c897e08f0

    • C:\Users\Public\569390.ui

      MD5

      f4dc5b1151ed77bfcfae8b73147d93c2

      SHA1

      e53166ca0f09ad46795cd8f5a1c9a4a2d5b21415

      SHA256

      71cd6cb93fcf508761b72fac05bc96a07697718eb928c72fc7731dab457b3606

      SHA512

      077b54dc49c0596ead6b5f754c77deecbda5d7dfee34c21b3d5faab727c8a83804c7da4652597905f5428ab52f2cd10eabbbaae12e30d3a5ccebba0b4ce479eb

    • \Users\Public\569390.ui

      MD5

      f4dc5b1151ed77bfcfae8b73147d93c2

      SHA1

      e53166ca0f09ad46795cd8f5a1c9a4a2d5b21415

      SHA256

      71cd6cb93fcf508761b72fac05bc96a07697718eb928c72fc7731dab457b3606

      SHA512

      077b54dc49c0596ead6b5f754c77deecbda5d7dfee34c21b3d5faab727c8a83804c7da4652597905f5428ab52f2cd10eabbbaae12e30d3a5ccebba0b4ce479eb

    • memory/436-71-0x0000000000000000-mapping.dmp

    • memory/436-72-0x0000000000590000-0x0000000000591000-memory.dmp

      Filesize

      4KB

    • memory/456-62-0x0000000000000000-mapping.dmp

    • memory/760-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/760-60-0x0000000070D41000-0x0000000070D43000-memory.dmp

      Filesize

      8KB

    • memory/760-59-0x000000002F391000-0x000000002F394000-memory.dmp

      Filesize

      12KB

    • memory/760-73-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1432-63-0x0000000000000000-mapping.dmp

    • memory/1432-64-0x0000000075051000-0x0000000075053000-memory.dmp

      Filesize

      8KB

    • memory/1588-66-0x0000000000000000-mapping.dmp

    • memory/1588-70-0x00000000000D0000-0x00000000000D5000-memory.dmp

      Filesize

      20KB