Analysis
-
max time kernel
136s -
max time network
138s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-01-2022 19:55
General
-
Target
0fdebd51c10306d56bd1555cc2467ae166b662318767f4913f57c930dfb4be05.xlsm
-
Size
84KB
-
MD5
07b04849e0e6e2eac4d82ddace0ff848
-
SHA1
7e9d3eeb8e71916eb8bae191df937bca616e0291
-
SHA256
0fdebd51c10306d56bd1555cc2467ae166b662318767f4913f57c930dfb4be05
-
SHA512
22a8c86f3f7db54c5eba2a292645f50efe658963ac896dd70d34b3e7864b0b10f7ade28c1d37ecc16dcd80900ea68b618369c36ad370f6bb9d022491e3b22e43
Score
10/10
Malware Config
Extracted
Language
xlm4.0
Source
URLs
xlm40.dropper
http://auto.lambolero.com/f1nygync/J18Keqh/
xlm40.dropper
http://archives-program.com/lbx2/fq4/
xlm40.dropper
http://easyfitcr.com/app/LskbLtWaI/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0fdebd51c10306d56bd1555cc2467ae166b662318767f4913f57c930dfb4be05.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
64KB