Analysis
- max time kernel
141s - max time network
134s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
12/01/2022, 03:41
General
- Target 972d4586f9c5ca66b4d42756d4c3cacb.xls
- Size 118KB
- Sample220112-d8rtrsbbbj
- SHA256 174ff5d09f0be20dfe363bdaeec30dcf984e0de64929abe14bf67e370cf78097
Malware Config
Extracted
-
xlm4.0
-
xlm40.dropper
http://www.cuneytkocas.com/wp-content/VSnofpES1wO2CcVob/
-
xlm40.dropper
http://towardsun.net/admin/BYGGkrYAnT/
Signatures
- Downloads MZ/PE file
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\972d4586f9c5ca66b4d42756d4c3cacb.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2168-115-0x00007FFDCB810000-0x00007FFDCB820000-memory.dmp
memory/2168-116-0x00007FFDCB810000-0x00007FFDCB820000-memory.dmp
memory/2168-117-0x00007FFDCB810000-0x00007FFDCB820000-memory.dmp
memory/2168-118-0x00007FFDCB810000-0x00007FFDCB820000-memory.dmp
memory/2168-119-0x00007FFDCB810000-0x00007FFDCB820000-memory.dmp
memory/2168-120-0x000002C00E960000-0x000002C00E962000-memory.dmp
memory/2168-121-0x000002C00E960000-0x000002C00E962000-memory.dmp
memory/2168-122-0x000002C00E960000-0x000002C00E962000-memory.dmp
memory/2168-128-0x00007FFDC85C0000-0x00007FFDC85D0000-memory.dmp
memory/2168-129-0x00007FFDC85C0000-0x00007FFDC85D0000-memory.dmp