Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 07:58
Static task
static1
Behavioral task
behavioral1
Sample
Invoice_94145565.xlsm
Resource
win7v20210410
General
-
Target
Invoice_94145565.xlsm
-
Size
334KB
-
MD5
84dfcbf8006b609714e14ae85d94baa4
-
SHA1
3cbd6c0a05e587d0ebcb46c125bcb9a31814865c
-
SHA256
c6ec076b4821de409d2fa1416b8419635421b732960a62e62bac6161040ab342
-
SHA512
d9fec51e549006a400d1822445833651dc99055478d637630885ec54a93608f0417a0b49056008d18fbdc5af1c8c9c760ae4bb4b50cbb9a30a2e02f67b92b920
Malware Config
Extracted
dridex
22201
45.79.33.48:443
139.162.202.74:5007
68.183.216.174:7443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3636 3716 mshta.exe EXCEL.EXE -
Processes:
resource yara_rule behavioral2/memory/3148-277-0x0000000073560000-0x0000000073590000-memory.dmp dridex_ldr -
Blocklisted process makes network request 1 IoCs
Processes:
mshta.exeflow pid process 25 3636 mshta.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3148 rundll32.exe -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3716 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE 3716 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEmshta.exerundll32.exedescription pid process target process PID 3716 wrote to memory of 3636 3716 EXCEL.EXE mshta.exe PID 3716 wrote to memory of 3636 3716 EXCEL.EXE mshta.exe PID 3636 wrote to memory of 1988 3636 mshta.exe rundll32.exe PID 3636 wrote to memory of 1988 3636 mshta.exe rundll32.exe PID 1988 wrote to memory of 3148 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 3148 1988 rundll32.exe rundll32.exe PID 1988 wrote to memory of 3148 1988 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice_94145565.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\mshta.exemshta C:\ProgramData//theChartTitle.sct2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe C:\ProgramData\qSmartTagControlHelp.dll,AddLookaside3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\ProgramData\qSmartTagControlHelp.dll,AddLookaside4⤵
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\qSmartTagControlHelp.dllMD5
58bf730c02fb67e6de279877eb281925
SHA1db2380c9d4e6ff9cd7dae6394f315753604adf6b
SHA256fbd108648a43add9a2e400640f3e60a7f31971d748ad0e3f8531a17fa328e7c6
SHA512b56283bc1a3f440d118e3c07b33dae78b4aca822fb18d195ed6754934cc210314a770cfede8d05b64357d785e75314c19f52a0e5c3841a69ca114e7936fd395f
-
C:\ProgramData\theChartTitle.sctMD5
17554e4f20c91f8ba5810f4ac2ac24a8
SHA162faf509ab7acadf5ba052e8bd36370a65ea9629
SHA2566553dd838a05151eb7ba9d84336187b165f12c7003e5e4b2b32a04979f42e1ab
SHA51245f57db4500538e573c0dcbcac4472711a0f165dff3c6be616959d82ae3cea38cbfad567580ab0cd89e31da4378e5fee5bcb94cad24257175961e59f200f252f
-
\ProgramData\qSmartTagControlHelp.dllMD5
58bf730c02fb67e6de279877eb281925
SHA1db2380c9d4e6ff9cd7dae6394f315753604adf6b
SHA256fbd108648a43add9a2e400640f3e60a7f31971d748ad0e3f8531a17fa328e7c6
SHA512b56283bc1a3f440d118e3c07b33dae78b4aca822fb18d195ed6754934cc210314a770cfede8d05b64357d785e75314c19f52a0e5c3841a69ca114e7936fd395f
-
memory/1988-273-0x0000000000000000-mapping.dmp
-
memory/3148-279-0x00000000006E0000-0x000000000082A000-memory.dmpFilesize
1.3MB
-
memory/3148-275-0x0000000000000000-mapping.dmp
-
memory/3148-277-0x0000000073560000-0x0000000073590000-memory.dmpFilesize
192KB
-
memory/3636-264-0x0000000000000000-mapping.dmp
-
memory/3716-121-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmpFilesize
64KB
-
memory/3716-118-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmpFilesize
64KB
-
memory/3716-117-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmpFilesize
64KB
-
memory/3716-116-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmpFilesize
64KB
-
memory/3716-123-0x000001994AB40000-0x000001994CA35000-memory.dmpFilesize
31.0MB
-
memory/3716-115-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmpFilesize
64KB
-
memory/3716-122-0x00007FF9EFDA0000-0x00007FF9F0E8E000-memory.dmpFilesize
16.9MB
-
memory/3716-114-0x00007FF627E60000-0x00007FF62B416000-memory.dmpFilesize
53.7MB
-
memory/3716-93015-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmpFilesize
64KB
-
memory/3716-93017-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmpFilesize
64KB
-
memory/3716-93019-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmpFilesize
64KB
-
memory/3716-93021-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmpFilesize
64KB