de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386

General
Target

de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386.xlsm

Filesize

83KB

Completed

15-01-2022 01:25

Score
10/10
MD5

6b5fbfc62c3f736a188c3f614b14fbe3

SHA1

1ce7dd32aecf09f3b4683f9c3c005d0c6ae82b0a

SHA256

de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386

Malware Config

Extracted

Language xlm4.0
Source
URLs
xlm40.dropper

http://recont.com/n8xbqb/lwEORjcJYPKCNQ/
Signatures 12

Filter: none

Discovery
  • Process spawned unexpected child process
    rundll32.exe

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

    Reported IOCs

    descriptionpidpid_targetprocesstarget process
    Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process19922656rundll32.exeEXCEL.EXE
  • Blocklisted process makes network request
    rundll32.exe

    Reported IOCs

    flowpidprocess
    431404rundll32.exe
    441404rundll32.exe
    451404rundll32.exe
  • Downloads MZ/PE file
  • Loads dropped DLL
    rundll32.exerundll32.exe

    Reported IOCs

    pidprocess
    1992rundll32.exe
    2280rundll32.exe
  • Drops file in System32 directory
    rundll32.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SysWOW64\Vtqpsroub\bbbck.zwvrundll32.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Checks processor information in registry
    EXCEL.EXE

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringEXCEL.EXE
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0EXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzEXCEL.EXE
  • Enumerates system info in registry
    EXCEL.EXE

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\Hardware\Description\System\BIOSEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamilyEXCEL.EXE
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKUEXCEL.EXE
  • Suspicious behavior: AddClipboardFormatListener
    EXCEL.EXE

    Reported IOCs

    pidprocess
    2656EXCEL.EXE
  • Suspicious behavior: EnumeratesProcesses
    rundll32.exe

    Reported IOCs

    pidprocess
    1404rundll32.exe
    1404rundll32.exe
  • Suspicious use of SetWindowsHookEx
    EXCEL.EXE

    Reported IOCs

    pidprocess
    2656EXCEL.EXE
    2656EXCEL.EXE
    2656EXCEL.EXE
    2656EXCEL.EXE
    2656EXCEL.EXE
    2656EXCEL.EXE
    2656EXCEL.EXE
    2656EXCEL.EXE
    2656EXCEL.EXE
    2656EXCEL.EXE
    2656EXCEL.EXE
    2656EXCEL.EXE
  • Suspicious use of WriteProcessMemory
    EXCEL.EXErundll32.exerundll32.exerundll32.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2656 wrote to memory of 19922656EXCEL.EXErundll32.exe
    PID 2656 wrote to memory of 19922656EXCEL.EXErundll32.exe
    PID 2656 wrote to memory of 19922656EXCEL.EXErundll32.exe
    PID 1992 wrote to memory of 22801992rundll32.exerundll32.exe
    PID 1992 wrote to memory of 22801992rundll32.exerundll32.exe
    PID 1992 wrote to memory of 22801992rundll32.exerundll32.exe
    PID 2280 wrote to memory of 15802280rundll32.exerundll32.exe
    PID 2280 wrote to memory of 15802280rundll32.exerundll32.exe
    PID 2280 wrote to memory of 15802280rundll32.exerundll32.exe
    PID 1580 wrote to memory of 14041580rundll32.exerundll32.exe
    PID 1580 wrote to memory of 14041580rundll32.exerundll32.exe
    PID 1580 wrote to memory of 14041580rundll32.exerundll32.exe
Processes 5
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386.xlsm"
    Checks processor information in registry
    Enumerates system info in registry
    Suspicious behavior: AddClipboardFormatListener
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Windows\SysWow64\rundll32.exe
      C:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r
      Process spawned unexpected child process
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1992
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\erum.ocx",DllRegisterServer
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        PID:2280
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vtqpsroub\bbbck.zwv",ibQQquQD
          Suspicious use of WriteProcessMemory
          PID:1580
          • C:\Windows\SysWOW64\rundll32.exe
            C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vtqpsroub\bbbck.zwv",DllRegisterServer
            Blocklisted process makes network request
            Suspicious behavior: EnumeratesProcesses
            PID:1404
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads

                        • C:\Users\Admin\erum.ocx

                          MD5

                          bb8e2574a3832904c6e4308548f8cc10

                          SHA1

                          8cb5d14c959f47e49524dfbd57697dc04a092d98

                          SHA256

                          96bf62e2cba59dbee4dba9efccb6b0b090fae3017ef2f04ef1edb57338f1b363

                          SHA512

                          a07e26bbb364f145a24b22fa700562bb683af1ceb8fee2ea517906f4fb3be40516b17b67bd8605ae91d922442860a77382a08032373abbcbc47c3476e6c532c8

                          Download Submit

                        • \Users\Admin\erum.ocx

                          MD5

                          bb8e2574a3832904c6e4308548f8cc10

                          SHA1

                          8cb5d14c959f47e49524dfbd57697dc04a092d98

                          SHA256

                          96bf62e2cba59dbee4dba9efccb6b0b090fae3017ef2f04ef1edb57338f1b363

                          SHA512

                          a07e26bbb364f145a24b22fa700562bb683af1ceb8fee2ea517906f4fb3be40516b17b67bd8605ae91d922442860a77382a08032373abbcbc47c3476e6c532c8

                          Download Submit

                        • \Users\Admin\erum.ocx

                          MD5

                          bb8e2574a3832904c6e4308548f8cc10

                          SHA1

                          8cb5d14c959f47e49524dfbd57697dc04a092d98

                          SHA256

                          96bf62e2cba59dbee4dba9efccb6b0b090fae3017ef2f04ef1edb57338f1b363

                          SHA512

                          a07e26bbb364f145a24b22fa700562bb683af1ceb8fee2ea517906f4fb3be40516b17b67bd8605ae91d922442860a77382a08032373abbcbc47c3476e6c532c8

                          Download Submit

                        • memory/1404-302-0x0000000000000000-mapping.dmp

                          Download

                        • memory/1580-297-0x0000000000000000-mapping.dmp

                          Download

                        • memory/1992-277-0x0000000000000000-mapping.dmp

                          Download

                        • memory/2280-282-0x0000000000000000-mapping.dmp

                          Download

                        • memory/2656-149-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-128-0x00007FFD6F570000-0x00007FFD6F580000-memory.dmp

                          Download

                        • memory/2656-129-0x00007FFD6F570000-0x00007FFD6F580000-memory.dmp

                          Download

                        • memory/2656-148-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-150-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-122-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-151-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-152-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-153-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-154-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-155-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-121-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp

                          Download

                        • memory/2656-120-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-119-0x0000017619A20000-0x0000017619A22000-memory.dmp

                          Download

                        • memory/2656-118-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp

                          Download

                        • memory/2656-117-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp

                          Download

                        • memory/2656-116-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp

                          Download

                        • memory/2656-115-0x00007FFD72FE0000-0x00007FFD72FF0000-memory.dmp

                          Download