Analysis
- max time kernel
101s - max time network
128s - platform
windows7_x64 - resource
win7v20210410 - submitted
16/08/2021, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_74317.xlsm
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_74317.xlsm
- Size 258KB
- Sample210816-c2fqt9lean
- SHA256 7a6e7bd25e49ab0c5fdeae608fc79ae61a24f9d6048a8dc2e4cc48cf212acdf8
- MD5 576fac94cc5f39cebf281fb795c928a5
- SHA1 0dca05a624d075f64efe79578a63040492815e97
- SHA512 d7cab1ef40051f45c30b09c56c137ee0503f5d6c73106243bdcfde7bf6176d8b8ef04058c52490876127c235ffcd0f16959bb1767651641431f4d699899354bd
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
dridex
Botnet
-
22202
C2
-
134.209.182.12:443
-
188.40.100.254:4664
-
103.109.247.9:10443
rc4.plain
rc4.plain
Signatures
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1080 2040 MSHTA.exe 24 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1096 1784 rundll32.exe 35 -
resource yara_rule behavioral1/memory/1592-74-0x000000006AA70000-0x000000006AAA0000-memory.dmp dridex_ldr - Blocklisted process makes network request 3 IoCs
flow pid Process 6 1080 MSHTA.exe 8 1080 MSHTA.exe 10 1080 MSHTA.exe - Downloads MZ/PE file
- Loads dropped DLL 4 IoCs
pid Process 1592 rundll32.exe 1592 rundll32.exe 1592 rundll32.exe 1592 rundll32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe - Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main MSHTA.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2040 EXCEL.EXE - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 688 wmic.exe Token: SeSecurityPrivilege 688 wmic.exe Token: SeTakeOwnershipPrivilege 688 wmic.exe Token: SeLoadDriverPrivilege 688 wmic.exe Token: SeSystemProfilePrivilege 688 wmic.exe Token: SeSystemtimePrivilege 688 wmic.exe Token: SeProfSingleProcessPrivilege 688 wmic.exe Token: SeIncBasePriorityPrivilege 688 wmic.exe Token: SeCreatePagefilePrivilege 688 wmic.exe Token: SeBackupPrivilege 688 wmic.exe Token: SeRestorePrivilege 688 wmic.exe Token: SeShutdownPrivilege 688 wmic.exe Token: SeDebugPrivilege 688 wmic.exe Token: SeSystemEnvironmentPrivilege 688 wmic.exe Token: SeRemoteShutdownPrivilege 688 wmic.exe Token: SeUndockPrivilege 688 wmic.exe Token: SeManageVolumePrivilege 688 wmic.exe Token: 33 688 wmic.exe Token: 34 688 wmic.exe Token: 35 688 wmic.exe Token: SeIncreaseQuotaPrivilege 688 wmic.exe Token: SeSecurityPrivilege 688 wmic.exe Token: SeTakeOwnershipPrivilege 688 wmic.exe Token: SeLoadDriverPrivilege 688 wmic.exe Token: SeSystemProfilePrivilege 688 wmic.exe Token: SeSystemtimePrivilege 688 wmic.exe Token: SeProfSingleProcessPrivilege 688 wmic.exe Token: SeIncBasePriorityPrivilege 688 wmic.exe Token: SeCreatePagefilePrivilege 688 wmic.exe Token: SeBackupPrivilege 688 wmic.exe Token: SeRestorePrivilege 688 wmic.exe Token: SeShutdownPrivilege 688 wmic.exe Token: SeDebugPrivilege 688 wmic.exe Token: SeSystemEnvironmentPrivilege 688 wmic.exe Token: SeRemoteShutdownPrivilege 688 wmic.exe Token: SeUndockPrivilege 688 wmic.exe Token: SeManageVolumePrivilege 688 wmic.exe Token: 33 688 wmic.exe Token: 34 688 wmic.exe Token: 35 688 wmic.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE 2040 EXCEL.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1080 2040 EXCEL.EXE 29 PID 2040 wrote to memory of 1080 2040 EXCEL.EXE 29 PID 2040 wrote to memory of 1080 2040 EXCEL.EXE 29 PID 2040 wrote to memory of 1080 2040 EXCEL.EXE 29 PID 1080 wrote to memory of 688 1080 MSHTA.exe 33 PID 1080 wrote to memory of 688 1080 MSHTA.exe 33 PID 1080 wrote to memory of 688 1080 MSHTA.exe 33 PID 1080 wrote to memory of 688 1080 MSHTA.exe 33 PID 1096 wrote to memory of 1592 1096 rundll32.exe 37 PID 1096 wrote to memory of 1592 1096 rundll32.exe 37 PID 1096 wrote to memory of 1592 1096 rundll32.exe 37 PID 1096 wrote to memory of 1592 1096 rundll32.exe 37 PID 1096 wrote to memory of 1592 1096 rundll32.exe 37 PID 1096 wrote to memory of 1592 1096 rundll32.exe 37 PID 1096 wrote to memory of 1592 1096 rundll32.exe 37
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_74317.xlsm1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\MSHTA.exeMSHTA C:\ProgramData\RBoUIwECkRqh.sct2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic process call create "rundll32.exe C:\ProgramData\OInHqqJQXuiTVZxncpUb.dll FindSheet"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:688
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\ProgramData\OInHqqJQXuiTVZxncpUb.dll FindSheet1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\ProgramData\OInHqqJQXuiTVZxncpUb.dll FindSheet2⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1592
-