efa77ac16d7ac9c01da1faece2214bb67d0a73c8b31260dd11522e8a77ab24a4

General

Target

efa77ac16d7ac9c01da1faece2214bb67d0a73c8b31260dd11522e8a77ab24a4.xlsm
Size

83KB
MD5

8e2cf0d83f51ce1fc97fc0d96022341f
SHA1

0d936f0fbfb8be0c7b10b78c1aae8f135341d194
SHA256

efa77ac16d7ac9c01da1faece2214bb67d0a73c8b31260dd11522e8a77ab24a4
SHA512

0df23689a36aa060f6c116dc611f0e74bebc7fe95ff7c5072d2d4e5e3f030ac1ec31249cefedbcb00f09628a959ee05e5f64a2665681b7c483731d7fd3147c86

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

rundll32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2020	3636	rundll32.exe	EXCEL.EXE

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exe

flow pid process

42 2276 rundll32.exe
43 2276 rundll32.exe
Downloads MZ/PE file
Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

2020 rundll32.exe
2224 rundll32.exe
Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\Mvrhckro\wykkiuxnjuoyrim.rcs rundll32.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
42	2276	rundll32.exe
43	2276	rundll32.exe

pid	process
2020	rundll32.exe
2224	rundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Mvrhckro\wykkiuxnjuoyrim.rcs	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3636 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2276 rundll32.exe
2276 rundll32.exe

pid	process
2276	rundll32.exe
2276	rundll32.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

EXCEL.EXE

pid	process
3636	EXCEL.EXE
3636	EXCEL.EXE
3636	EXCEL.EXE
3636	EXCEL.EXE
3636	EXCEL.EXE
3636	EXCEL.EXE
3636	EXCEL.EXE
3636	EXCEL.EXE
3636	EXCEL.EXE
3636	EXCEL.EXE
3636	EXCEL.EXE
3636	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

EXCEL.EXErundll32.exerundll32.exerundll32.exe

description	pid	process	target process
PID 3636 wrote to memory of 2020	3636	EXCEL.EXE	rundll32.exe
PID 3636 wrote to memory of 2020	3636	EXCEL.EXE	rundll32.exe
PID 3636 wrote to memory of 2020	3636	EXCEL.EXE	rundll32.exe
PID 2020 wrote to memory of 2224	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2224	2020	rundll32.exe	rundll32.exe
PID 2020 wrote to memory of 2224	2020	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 3488	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 3488	2224	rundll32.exe	rundll32.exe
PID 2224 wrote to memory of 3488	2224	rundll32.exe	rundll32.exe
PID 3488 wrote to memory of 2276	3488	rundll32.exe	rundll32.exe
PID 3488 wrote to memory of 2276	3488	rundll32.exe	rundll32.exe
PID 3488 wrote to memory of 2276	3488	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\efa77ac16d7ac9c01da1faece2214bb67d0a73c8b31260dd11522e8a77ab24a4.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3636

C:\Windows\SysWow64\rundll32.exe
C:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\erum.ocx",DllRegisterServer
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2224

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Mvrhckro\wykkiuxnjuoyrim.rcs",QmnTUIIzgwUZH
4⤵
- Suspicious use of WriteProcessMemory
PID:3488

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Mvrhckro\wykkiuxnjuoyrim.rcs",DllRegisterServer
5⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2276

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\erum.ocx
MD5
14dbd77bcf0f638ac1413c6c3fdce4fe

SHA1
3dd1d6c876d5e76874bf851e079fbae56960c235

SHA256
cd83f0ec528ae4528c09de3c1de5291592823825d32b7b409836014de288412a

SHA512
53e4374c1a55e6444fa30c156952fb1966b5dfc779f71596c70cb7aa0b40211adda604f7603a82ae10b480fbe71fd0ab981a88af6f406cf259155aaee9e3b0b0

Download Submit
\Users\Admin\erum.ocx
MD5
14dbd77bcf0f638ac1413c6c3fdce4fe

SHA1
3dd1d6c876d5e76874bf851e079fbae56960c235

SHA256
cd83f0ec528ae4528c09de3c1de5291592823825d32b7b409836014de288412a

SHA512
53e4374c1a55e6444fa30c156952fb1966b5dfc779f71596c70cb7aa0b40211adda604f7603a82ae10b480fbe71fd0ab981a88af6f406cf259155aaee9e3b0b0

Download Submit
\Users\Admin\erum.ocx
MD5
14dbd77bcf0f638ac1413c6c3fdce4fe

SHA1
3dd1d6c876d5e76874bf851e079fbae56960c235

SHA256
cd83f0ec528ae4528c09de3c1de5291592823825d32b7b409836014de288412a

SHA512
53e4374c1a55e6444fa30c156952fb1966b5dfc779f71596c70cb7aa0b40211adda604f7603a82ae10b480fbe71fd0ab981a88af6f406cf259155aaee9e3b0b0

Download Submit
memory/2020-262-0x0000000000000000-mapping.dmp

Download
memory/2224-267-0x0000000000000000-mapping.dmp

Download
memory/2276-283-0x0000000000000000-mapping.dmp

Download
memory/3488-280-0x0000000000000000-mapping.dmp

Download
memory/3636-120-0x0000028AFCD50000-0x0000028AFCD52000-memory.dmp

Filesize
8KB

Download
memory/3636-129-0x00007FF86F1F0000-0x00007FF86F200000-memory.dmp

Filesize
64KB

Download
memory/3636-130-0x00007FF86F1F0000-0x00007FF86F200000-memory.dmp

Filesize
64KB

Download
memory/3636-123-0x0000028AFCD50000-0x0000028AFCD52000-memory.dmp

Filesize
8KB

Download
memory/3636-122-0x00007FF8726E0000-0x00007FF8726F0000-memory.dmp

Filesize
64KB

Download
memory/3636-121-0x0000028AFCD50000-0x0000028AFCD52000-memory.dmp

Filesize
8KB

Download
memory/3636-116-0x00007FF8726E0000-0x00007FF8726F0000-memory.dmp

Filesize
64KB

Download
memory/3636-119-0x00007FF8726E0000-0x00007FF8726F0000-memory.dmp

Filesize
64KB

Download
memory/3636-118-0x00007FF8726E0000-0x00007FF8726F0000-memory.dmp

Filesize
64KB

Download
memory/3636-117-0x00007FF8726E0000-0x00007FF8726F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads