Analysis
- max time kernel
144s - max time network
140s - platform
windows10_x64 - resource
win10v20210410 - submitted
23/07/2021, 16:11
General
- Target Client_documents_access_1793-1029.xlsm
- Size 85KB
- Sample210723-e7xcd967t2
- SHA256 6cb9eff2c03a7064a655a6117cb62d4bf8694a6fab10588cac60b0781d60ca4d
Score
10/10
Malware Config
Extracted
Language
-
xlm4.0
Source
URLs
-
xlm40.dropper
http://162.248.227.39/first.php
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Client_documents_access_1793-1029.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32 -silent ..\yeieowur.dll2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3912-114-0x00007FF6158B0000-0x00007FF618E66000-memory.dmp
memory/3912-115-0x00007FF8CDBE0000-0x00007FF8CDBF0000-memory.dmp
memory/3912-116-0x00007FF8CDBE0000-0x00007FF8CDBF0000-memory.dmp
memory/3912-117-0x00007FF8CDBE0000-0x00007FF8CDBF0000-memory.dmp
memory/3912-118-0x00007FF8CDBE0000-0x00007FF8CDBF0000-memory.dmp
memory/3912-122-0x00007FF8CDBE0000-0x00007FF8CDBF0000-memory.dmp
memory/3912-121-0x00007FF8EE870000-0x00007FF8EF95E000-memory.dmp
memory/3912-123-0x000001CDA6F70000-0x000001CDA8E65000-memory.dmp