Analysis
- max time kernel
149s - max time network
40s - platform
windows7_x64 - resource
win7v20210408 - submitted
02/09/2021, 18:45
General
- Target SecuriteInfo.com.Trojan.GenericKDZ.75982.20814.32565.xlsm
- Size 158KB
- Sample210902-xd334abdb5
- SHA256 cfa0fe012f82f993ed70fa3ddc9ff1e31501686b723107d4e3cd1de5794722ee
Score
10/10
Malware Config
Extracted
Language
-
xlm4.0
Source
URLs
-
xlm40.dropper
https://biopaten.no/xeBP8Oj5/gg.html
-
xlm40.dropper
https://beartoothkawasaki.com/QJT19jhtwHt/gg.html
Signatures
- Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 9 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKDZ.75982.20814.32565.xlsm1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 ..\cexyz1.dll2⤵
- Process spawned unexpected child process
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 ..\cexyz2.dll2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/544-66-0x00000000760B1000-0x00000000760B3000-memory.dmp
memory/544-69-0x0000000000210000-0x0000000000211000-memory.dmp
memory/1180-64-0x000007FEFB891000-0x000007FEFB893000-memory.dmp
memory/1612-70-0x00000000001E0000-0x00000000001E1000-memory.dmp
memory/2024-60-0x000000002F511000-0x000000002F514000-memory.dmp
memory/2024-61-0x0000000071141000-0x0000000071143000-memory.dmp
memory/2024-62-0x000000005FFF0000-0x0000000060000000-memory.dmp