Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 08:50
Static task
static1
Behavioral task
behavioral1
Sample
Invoice_2457619.xlsm
Resource
win7v20210410
General
-
Target
Invoice_2457619.xlsm
-
Size
329KB
-
MD5
6cb632b4c2e9244c36ad740ef8cbfda5
-
SHA1
5c90034815dc6faf9d14da1536f05a8a9a1d0f73
-
SHA256
71fb5ec5a1424b9965bf487a41e24e04e6cd20fb256b283b8262a6592aa90114
-
SHA512
ec56dc8b6282de9ce3bf865263fbc74741ab98a70ac517f4d1637f025255c06247b11edd95edb9756032e93f7d0cdef93e639088cdd88732c3ccc060e85cc636
Malware Config
Extracted
dridex
22202
45.79.33.48:443
139.162.202.74:5007
68.183.216.174:7443
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
mshta.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1212 3212 mshta.exe EXCEL.EXE -
Processes:
resource yara_rule behavioral2/memory/4020-275-0x0000000074420000-0x0000000074450000-memory.dmp dridex_ldr -
Blocklisted process makes network request 1 IoCs
Processes:
mshta.exeflow pid process 19 1212 mshta.exe -
Downloads MZ/PE file
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4020 rundll32.exe -
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3212 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
EXCEL.EXEpid process 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE 3212 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEmshta.exerundll32.exedescription pid process target process PID 3212 wrote to memory of 1212 3212 EXCEL.EXE mshta.exe PID 3212 wrote to memory of 1212 3212 EXCEL.EXE mshta.exe PID 1212 wrote to memory of 1936 1212 mshta.exe rundll32.exe PID 1212 wrote to memory of 1936 1212 mshta.exe rundll32.exe PID 1936 wrote to memory of 4020 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 4020 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 4020 1936 rundll32.exe rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice_2457619.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\mshta.exemshta C:\ProgramData//theSmartTagControlLink.sct2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32.exe C:\ProgramData\qDialogSummaryInfo.dll,AddLookaside3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\ProgramData\qDialogSummaryInfo.dll,AddLookaside4⤵
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\qDialogSummaryInfo.dllMD5
d0a9777d063838dbf9d566a8ae327c4e
SHA16f92815c9209e5d1e1bc1100b5f6c59502ab32d8
SHA256cbe76441844bd0b28afb2b183f52ef3bec4c2a4b26884219049ba2618a823989
SHA512174082c78d9ea76724cee9736a07400e3cb24b1d4ba0d6f4e4e4ab2b89043633af5f67cb853edd6af33f894149c66787a4eecf69dfe35abea50c1b283fdceefb
-
C:\ProgramData\theSmartTagControlLink.sctMD5
e44dbd3ba1cd50d95a143234af5426e8
SHA1c4bc233d71ad3fc0a4fd86b31180df6e5f37aab5
SHA2562d77a15c23fe7cb627e494f4aa841fb43a4921c690dcd9bd5484f0ea344c1ae2
SHA5124c696d5b8469ba018c7663da584460cb2fabf6b7ca092ee3d78d27eae43999ca1a8bcf30a4701e285c610fffd43ea8efe29615fbd308f6e11550773927b2780a
-
\ProgramData\qDialogSummaryInfo.dllMD5
d0a9777d063838dbf9d566a8ae327c4e
SHA16f92815c9209e5d1e1bc1100b5f6c59502ab32d8
SHA256cbe76441844bd0b28afb2b183f52ef3bec4c2a4b26884219049ba2618a823989
SHA512174082c78d9ea76724cee9736a07400e3cb24b1d4ba0d6f4e4e4ab2b89043633af5f67cb853edd6af33f894149c66787a4eecf69dfe35abea50c1b283fdceefb
-
memory/1212-260-0x0000000000000000-mapping.dmp
-
memory/1936-271-0x0000000000000000-mapping.dmp
-
memory/3212-121-0x00007FF858F10000-0x00007FF859FFE000-memory.dmpFilesize
16.9MB
-
memory/3212-105583-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-123-0x0000016496AB0000-0x00000164989A5000-memory.dmpFilesize
31.0MB
-
memory/3212-114-0x00007FF668F00000-0x00007FF66C4B6000-memory.dmpFilesize
53.7MB
-
memory/3212-118-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-117-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-116-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-122-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-115-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-105587-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-105585-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/3212-105581-0x00007FF8383E0000-0x00007FF8383F0000-memory.dmpFilesize
64KB
-
memory/4020-273-0x0000000000000000-mapping.dmp
-
memory/4020-277-0x0000000000710000-0x000000000085A000-memory.dmpFilesize
1.3MB
-
memory/4020-275-0x0000000074420000-0x0000000074450000-memory.dmpFilesize
192KB