Analysis

  • max time kernel
    89s
  • max time network
    137s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    14-07-2021 02:36

General

  • Target

    subscription_1617291613.xlsb

  • Size

    228KB

  • MD5

    8a3364bafa63166394862068b05f5469

  • SHA1

    b039cb7a479cf118d53c61e113ad74015caadd22

  • SHA256

    3d0b681046147d8008b70bab97c41e3a21a283559874ac2ce0c518b6965312da

  • SHA512

    27c70c7fd278222a17112c0e3deb16a84f36f080a6fd933d51c4cc73392654414991ae0ba99e9760008c40a865572380c03a3b3af9297cb1a3678c630ca18111

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source

Signatures

  • Nloader

    Simple loader that includes the keyword 'campo' in the URL used to download other families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Nloader Payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\subscription_1617291613.xlsb"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4036
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c certutil -decode %PUBLIC%\569390.pdi %PUBLIC%\569390.ui && rundll32 %PUBLIC%\569390.ui,DF1
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Windows\system32\certutil.exe
        certutil -decode C:\Users\Public\569390.pdi C:\Users\Public\569390.ui
        3⤵
          PID:2020
        • C:\Windows\system32\rundll32.exe
          rundll32 C:\Users\Public\569390.ui,DF1
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3808
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32 C:\Users\Public\569390.ui,DF1
            4⤵
            • Loads dropped DLL
            PID:1304
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 808
              5⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2344

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\569390.pdi

      MD5

      5cc5f895b91ab4c1835ac9b83e86663b

      SHA1

      b51565a65b167172b71516435f4118ec9a278673

      SHA256

      81a75221faf7f28e2b2ce76471499d72b94da9ae48e0e1dc5bf01060e9195065

      SHA512

      3a4289acdc392d999f4edde46c4261956b9be0aba355dc730a7bee08b9b00dff8733f84c97365aa773fad8bde29aa8dc040aac3067e7af3e7f75049c897e08f0

    • C:\Users\Public\569390.ui

      MD5

      f4dc5b1151ed77bfcfae8b73147d93c2

      SHA1

      e53166ca0f09ad46795cd8f5a1c9a4a2d5b21415

      SHA256

      71cd6cb93fcf508761b72fac05bc96a07697718eb928c72fc7731dab457b3606

      SHA512

      077b54dc49c0596ead6b5f754c77deecbda5d7dfee34c21b3d5faab727c8a83804c7da4652597905f5428ab52f2cd10eabbbaae12e30d3a5ccebba0b4ce479eb

    • \Users\Public\569390.ui

      MD5

      f4dc5b1151ed77bfcfae8b73147d93c2

      SHA1

      e53166ca0f09ad46795cd8f5a1c9a4a2d5b21415

      SHA256

      71cd6cb93fcf508761b72fac05bc96a07697718eb928c72fc7731dab457b3606

      SHA512

      077b54dc49c0596ead6b5f754c77deecbda5d7dfee34c21b3d5faab727c8a83804c7da4652597905f5428ab52f2cd10eabbbaae12e30d3a5ccebba0b4ce479eb

    • memory/1304-277-0x0000000003250000-0x0000000003255000-memory.dmp

      Filesize

      20KB

    • memory/1304-275-0x0000000000000000-mapping.dmp

    • memory/2020-271-0x0000000000000000-mapping.dmp

    • memory/2304-270-0x0000000000000000-mapping.dmp

    • memory/3808-273-0x0000000000000000-mapping.dmp

    • memory/4036-116-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

      Filesize

      64KB

    • memory/4036-123-0x00007FF94B280000-0x00007FF94D175000-memory.dmp

      Filesize

      31.0MB

    • memory/4036-117-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

      Filesize

      64KB

    • memory/4036-122-0x00007FF94D180000-0x00007FF94E26E000-memory.dmp

      Filesize

      16.9MB

    • memory/4036-118-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

      Filesize

      64KB

    • memory/4036-119-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

      Filesize

      64KB

    • memory/4036-115-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

      Filesize

      64KB

    • memory/4036-114-0x00007FF661D00000-0x00007FF6652B6000-memory.dmp

      Filesize

      53.7MB

    • memory/4036-303-0x00007FF946B60000-0x00007FF947A2D000-memory.dmp

      Filesize

      14.8MB

    • memory/4036-332-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

      Filesize

      64KB

    • memory/4036-333-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

      Filesize

      64KB

    • memory/4036-334-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

      Filesize

      64KB

    • memory/4036-335-0x00007FF92CFA0000-0x00007FF92CFB0000-memory.dmp

      Filesize

      64KB