Analysis
-
max time kernel
129s -
max time network
132s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
04-12-2021 08:40
General
-
Target
f26a443ac89f9b418959ed6f59163358f57a469af9a4509ca82bfec3e6d092b0.xlsm
-
Size
37KB
-
MD5
b85066e6d286499120d91f942f43d371
-
SHA1
1cfc720d33149fb6e1600144c701b057edc7c38c
-
SHA256
f26a443ac89f9b418959ed6f59163358f57a469af9a4509ca82bfec3e6d092b0
-
SHA512
9c676cc214ebfb50326858fc91ebae9811a4b2d3924f742d87eb0274766bdc8c1e4e8d394d3cdea7e6fcdaab2ce0c61d0a8f040c3026541a319755f2bc777f61
Score
10/10
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
http://inorte.com.br/awkl2/NFkGvrZkoh7TdwolFM/
xlm40.dropper
http://otoway.com/5/h2syajK78/
xlm40.dropper
http://xhamster-deutsch.biz/wp-content/cache/m1G6/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f26a443ac89f9b418959ed6f59163358f57a469af9a4509ca82bfec3e6d092b0.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB