Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 12:40
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.VB.Trojan.Valyria.5105.29893.19434.xlsm
Resource
win7v20210410
General
-
Target
SecuriteInfo.com.VB.Trojan.Valyria.5105.29893.19434.xlsm
-
Size
334KB
-
MD5
1f196d875fd7d89ac57831926bbb9563
-
SHA1
3ed1e676f334ab3f82d3a056dad079f85458bfb4
-
SHA256
081618f7d9c6c92271f8d6bc65c8e13f33dfe9e5022f06aaec95664ee31fead4
-
SHA512
299011aff7cf8e9d2c2b74f0ffa64ea733516fb22f4aeed0400c5e3da9f548199024ce7317d849c4af27c3c9de95bc947eaa3f3ffc0e211d94cf60ec4c71f7b2
Malware Config
Extracted
dridex
22201
45.79.33.48:443
139.162.202.74:5007
68.183.216.174:7443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2360 808 mshta.exe EXCEL.EXE -
Processes:
resource yara_rule behavioral2/memory/1440-276-0x00000000738F0000-0x0000000073920000-memory.dmp dridex_ldr -
Blocklisted process makes network request 1 IoCs
Processes:
mshta.exeflow pid process 27 2360 mshta.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1440 rundll32.exe -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 808 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 808 EXCEL.EXE 808 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE 808 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEmshta.exerundll32.exedescription pid process target process PID 808 wrote to memory of 2360 808 EXCEL.EXE mshta.exe PID 808 wrote to memory of 2360 808 EXCEL.EXE mshta.exe PID 2360 wrote to memory of 2264 2360 mshta.exe rundll32.exe PID 2360 wrote to memory of 2264 2360 mshta.exe rundll32.exe PID 2264 wrote to memory of 1440 2264 rundll32.exe rundll32.exe PID 2264 wrote to memory of 1440 2264 rundll32.exe rundll32.exe PID 2264 wrote to memory of 1440 2264 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.VB.Trojan.Valyria.5105.29893.19434.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\mshta.exemshta C:\ProgramData//theExcel2FarEast.sct2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe C:\ProgramData\qRangeAutoFormatReport3.dll,AddLookaside3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\ProgramData\qRangeAutoFormatReport3.dll,AddLookaside4⤵
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\qRangeAutoFormatReport3.dllMD5
fde6b5be428ee0956ab4ef231ed21dd7
SHA1a223c73bdf81d1cee58b20bfaeab412c0b2a99d9
SHA256b60c01e98969144fc8d3229a9d3b82de13879444d91f558ea4483547141b85a5
SHA5129f5de9a37e2e61622d2d1c8e8c52d39f782c093d64feeffd5fc3b7f5a53f8258a80a274c58a4d15651c8e1c4f219a7856aa5f864b449ffc9d2c6566ad6a0209e
-
C:\ProgramData\theExcel2FarEast.sctMD5
d502793876b466c8d509f07f69dd6647
SHA1b4e10b05725012686f5ae04df9c29df280d8687c
SHA25617fa31bbdfae8ac22fca19c90c18e0a97e50400f889bdc73d1fa940d16a791f5
SHA512d135b0528e4e32f8a4b9508078385a1c2e95b8068d3dc771c0a5a51942278624ee9d0f730e77d3684c103ce422ebf923e9bfb62152e7c48db06251ec06a79856
-
\ProgramData\qRangeAutoFormatReport3.dllMD5
fde6b5be428ee0956ab4ef231ed21dd7
SHA1a223c73bdf81d1cee58b20bfaeab412c0b2a99d9
SHA256b60c01e98969144fc8d3229a9d3b82de13879444d91f558ea4483547141b85a5
SHA5129f5de9a37e2e61622d2d1c8e8c52d39f782c093d64feeffd5fc3b7f5a53f8258a80a274c58a4d15651c8e1c4f219a7856aa5f864b449ffc9d2c6566ad6a0209e
-
memory/808-117-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-118-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-122-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-121-0x00007FF9FD880000-0x00007FF9FE96E000-memory.dmpFilesize
16.9MB
-
memory/808-123-0x00007FF9FB980000-0x00007FF9FD875000-memory.dmpFilesize
31.0MB
-
memory/808-69389-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-114-0x00007FF76A4E0000-0x00007FF76DA96000-memory.dmpFilesize
53.7MB
-
memory/808-69391-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-116-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-69388-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-115-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/808-69387-0x00007FF9DCDF0000-0x00007FF9DCE00000-memory.dmpFilesize
64KB
-
memory/1440-278-0x0000000004B60000-0x0000000004B66000-memory.dmpFilesize
24KB
-
memory/1440-276-0x00000000738F0000-0x0000000073920000-memory.dmpFilesize
192KB
-
memory/1440-274-0x0000000000000000-mapping.dmp
-
memory/2264-272-0x0000000000000000-mapping.dmp
-
memory/2360-261-0x0000000000000000-mapping.dmp