Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
21-07-2021 18:01
Static task
static1
Behavioral task
behavioral1
Sample
bd59e42a9ee00ba415448c31190e57d7.xls
Resource
win7v20210410
General
-
Target
bd59e42a9ee00ba415448c31190e57d7.xls
-
Size
317KB
-
MD5
bd59e42a9ee00ba415448c31190e57d7
-
SHA1
95bc249a25513514f1859b690fdcc41f7fb78bac
-
SHA256
f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d
-
SHA512
aad6ecac040ef20c61aee790155adc1937e426c3ef2240334516ed6be26c4688f764cec8cd0c051710ef35d261fc6b789d408bf6755e0714affce101603bfdca
Malware Config
Extracted
dridex
22202
178.238.236.59:443
104.245.52.73:5007
81.0.236.93:13786
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2840 860 mshta.exe EXCEL.EXE -
Processes:
resource yara_rule behavioral2/memory/4084-278-0x0000000074150000-0x0000000074181000-memory.dmp dridex_ldr -
Blocklisted process makes network request 1 IoCs
Processes:
mshta.exeflow pid process 24 2840 mshta.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4084 rundll32.exe -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 860 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEmshta.exerundll32.exedescription pid process target process PID 860 wrote to memory of 2840 860 EXCEL.EXE mshta.exe PID 860 wrote to memory of 2840 860 EXCEL.EXE mshta.exe PID 2840 wrote to memory of 3876 2840 mshta.exe rundll32.exe PID 2840 wrote to memory of 3876 2840 mshta.exe rundll32.exe PID 3876 wrote to memory of 4084 3876 rundll32.exe rundll32.exe PID 3876 wrote to memory of 4084 3876 rundll32.exe rundll32.exe PID 3876 wrote to memory of 4084 3876 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\bd59e42a9ee00ba415448c31190e57d7.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\mshta.exemshta C:\ProgramData//klClipboardFormatDspText.sct2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe C:\ProgramData\qDialogFormatText.dll,SetRealTimeUsage3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\ProgramData\qDialogFormatText.dll,SetRealTimeUsage4⤵
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\klClipboardFormatDspText.sctMD5
789795198ddaef132386abf0ec508385
SHA1c6234646a72ec562d7e50125a77ed89d517b2cad
SHA256aa959296837f992fec1a69463bc5c14e9a7dfcb844106208b4fba5b7a2722d47
SHA5120fbdec930aa3f4ed791ceb4f59ff4d5e9b537fb68ebed7761d2503d99e36884e92394c3faef9da079a2c5e023af280acb0a759650cd3c533160d2d16105dfd07
-
C:\ProgramData\qDialogFormatText.dllMD5
aae1e725e2dbfd91213be22e857f9d02
SHA17a2c52b1185e6024787eadaf18bd7f7ccfaa0f14
SHA2563cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
SHA5126f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930
-
\ProgramData\qDialogFormatText.dllMD5
aae1e725e2dbfd91213be22e857f9d02
SHA17a2c52b1185e6024787eadaf18bd7f7ccfaa0f14
SHA2563cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2
SHA5126f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930
-
memory/860-66021-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmpFilesize
64KB
-
memory/860-118-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmpFilesize
64KB
-
memory/860-119-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmpFilesize
64KB
-
memory/860-122-0x00007FFAD81C0000-0x00007FFAD92AE000-memory.dmpFilesize
16.9MB
-
memory/860-123-0x000001E83FB00000-0x000001E8419F5000-memory.dmpFilesize
31.0MB
-
memory/860-117-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmpFilesize
64KB
-
memory/860-114-0x00007FF7C1DC0000-0x00007FF7C5376000-memory.dmpFilesize
53.7MB
-
memory/860-116-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmpFilesize
64KB
-
memory/860-66019-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmpFilesize
64KB
-
memory/860-115-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmpFilesize
64KB
-
memory/860-66022-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmpFilesize
64KB
-
memory/860-66017-0x00007FFAB7550000-0x00007FFAB7560000-memory.dmpFilesize
64KB
-
memory/2840-264-0x0000000000000000-mapping.dmp
-
memory/3876-274-0x0000000000000000-mapping.dmp
-
memory/4084-280-0x0000000004370000-0x0000000004376000-memory.dmpFilesize
24KB
-
memory/4084-278-0x0000000074150000-0x0000000074181000-memory.dmpFilesize
196KB
-
memory/4084-276-0x0000000000000000-mapping.dmp