Analysis
-
max time kernel
101s -
max time network
115s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
21-07-2021 18:01
Static task
static1
Behavioral task
behavioral1
Sample
bd59e42a9ee00ba415448c31190e57d7.xls
Resource
win7v20210410
General
-
Target
bd59e42a9ee00ba415448c31190e57d7.xls
-
Size
317KB
-
MD5
bd59e42a9ee00ba415448c31190e57d7
-
SHA1
95bc249a25513514f1859b690fdcc41f7fb78bac
-
SHA256
f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d
-
SHA512
aad6ecac040ef20c61aee790155adc1937e426c3ef2240334516ed6be26c4688f764cec8cd0c051710ef35d261fc6b789d408bf6755e0714affce101603bfdca
Malware Config
Extracted
dridex
22202
178.238.236.59:443
104.245.52.73:5007
81.0.236.93:13786
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1576 1080 mshta.exe EXCEL.EXE -
Processes:
resource yara_rule behavioral1/memory/1476-72-0x000000006AD50000-0x000000006AD81000-memory.dmp dridex_ldr -
Blocklisted process makes network request 1 IoCs
Processes:
mshta.exeflow pid process 4 1576 mshta.exe -
Downloads MZ/PE file
-
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 1476 rundll32.exe 1476 rundll32.exe 1476 rundll32.exe 1476 rundll32.exe -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEmshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1080 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 1080 EXCEL.EXE 1080 EXCEL.EXE 1080 EXCEL.EXE 1080 EXCEL.EXE 1080 EXCEL.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
EXCEL.EXEmshta.exedescription pid process target process PID 1080 wrote to memory of 1576 1080 EXCEL.EXE mshta.exe PID 1080 wrote to memory of 1576 1080 EXCEL.EXE mshta.exe PID 1080 wrote to memory of 1576 1080 EXCEL.EXE mshta.exe PID 1080 wrote to memory of 1576 1080 EXCEL.EXE mshta.exe PID 1576 wrote to memory of 1476 1576 mshta.exe rundll32.exe PID 1576 wrote to memory of 1476 1576 mshta.exe rundll32.exe PID 1576 wrote to memory of 1476 1576 mshta.exe rundll32.exe PID 1576 wrote to memory of 1476 1576 mshta.exe rundll32.exe PID 1576 wrote to memory of 1476 1576 mshta.exe rundll32.exe PID 1576 wrote to memory of 1476 1576 mshta.exe rundll32.exe PID 1576 wrote to memory of 1476 1576 mshta.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\bd59e42a9ee00ba415448c31190e57d7.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exemshta C:\ProgramData//klClipboardFormatDspText.sct2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\ProgramData\qDialogFormatText.dll,SetRealTimeUsage3⤵
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\klClipboardFormatDspText.sctMD5
789795198ddaef132386abf0ec508385
SHA1c6234646a72ec562d7e50125a77ed89d517b2cad
SHA256aa959296837f992fec1a69463bc5c14e9a7dfcb844106208b4fba5b7a2722d47
SHA5120fbdec930aa3f4ed791ceb4f59ff4d5e9b537fb68ebed7761d2503d99e36884e92394c3faef9da079a2c5e023af280acb0a759650cd3c533160d2d16105dfd07
-
C:\ProgramData\qDialogFormatText.dllMD5
aae1e725e2dbfd91213be22e857f9d02
SHA17a2c52b1185e6024787eadaf18bd7f7ccfaa0f14
SHA2563cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
SHA5126f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930
-
\ProgramData\qDialogFormatText.dllMD5
aae1e725e2dbfd91213be22e857f9d02
SHA17a2c52b1185e6024787eadaf18bd7f7ccfaa0f14
SHA2563cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
SHA5126f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930
-
\ProgramData\qDialogFormatText.dllMD5
aae1e725e2dbfd91213be22e857f9d02
SHA17a2c52b1185e6024787eadaf18bd7f7ccfaa0f14
SHA2563cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
SHA5126f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930
-
\ProgramData\qDialogFormatText.dllMD5
aae1e725e2dbfd91213be22e857f9d02
SHA17a2c52b1185e6024787eadaf18bd7f7ccfaa0f14
SHA2563cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
SHA5126f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930
-
\ProgramData\qDialogFormatText.dllMD5
aae1e725e2dbfd91213be22e857f9d02
SHA17a2c52b1185e6024787eadaf18bd7f7ccfaa0f14
SHA2563cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
SHA5126f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930
-
memory/1080-61-0x0000000071CC1000-0x0000000071CC3000-memory.dmpFilesize
8KB
-
memory/1080-62-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1080-75-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1080-60-0x000000002FD41000-0x000000002FD44000-memory.dmpFilesize
12KB
-
memory/1476-66-0x0000000075A31000-0x0000000075A33000-memory.dmpFilesize
8KB
-
memory/1476-65-0x0000000000000000-mapping.dmp
-
memory/1476-72-0x000000006AD50000-0x000000006AD81000-memory.dmpFilesize
196KB
-
memory/1476-74-0x0000000000110000-0x0000000000116000-memory.dmpFilesize
24KB
-
memory/1576-63-0x0000000000000000-mapping.dmp