Analysis

  • max time kernel
    132s
  • max time network
    134s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    15-01-2022 01:26

General

  • Target

    e839313f28c2088224ab43e562fe1cbdfd9861122c4a80fdc9121cfff8d58690.xlsm

  • Size

    83KB

  • MD5

    8a33badcc1ed80af8d3ba0f02b85a8e7

  • SHA1

    a1374206e356e9ad4ae461511c76b543d969b6f0

  • SHA256

    e839313f28c2088224ab43e562fe1cbdfd9861122c4a80fdc9121cfff8d58690

  • SHA512

    f45ee0f0cdece0cace1e4ad150e2602f79b26ddbadec6b85c4f7085627abab4604e315174500eaea9c8cca09fbc04343636b5255515459de7fbb06706e55fc8e

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/

xlm40.dropper

https://wordpress.baishuweb.com/wp-includes/10q0ice6/

xlm40.dropper

http://monorailegypt.com/wp-admin/6uBf9CCfZRMh/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e839313f28c2088224ab43e562fe1cbdfd9861122c4a80fdc9121cfff8d58690.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2240

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2240-115-0x00007FF8AEA50000-0x00007FF8AEA60000-memory.dmp
    Filesize

    64KB

  • memory/2240-116-0x00007FF8AEA50000-0x00007FF8AEA60000-memory.dmp
    Filesize

    64KB

  • memory/2240-117-0x00007FF8AEA50000-0x00007FF8AEA60000-memory.dmp
    Filesize

    64KB

  • memory/2240-118-0x00007FF8AEA50000-0x00007FF8AEA60000-memory.dmp
    Filesize

    64KB

  • memory/2240-119-0x00007FF8AEA50000-0x00007FF8AEA60000-memory.dmp
    Filesize

    64KB

  • memory/2240-120-0x000001ADAE5C0000-0x000001ADAE5C2000-memory.dmp
    Filesize

    8KB

  • memory/2240-121-0x000001ADAE5C0000-0x000001ADAE5C2000-memory.dmp
    Filesize

    8KB

  • memory/2240-122-0x000001ADAE5C0000-0x000001ADAE5C2000-memory.dmp
    Filesize

    8KB

  • memory/2240-128-0x00007FF8ABF00000-0x00007FF8ABF10000-memory.dmp
    Filesize

    64KB

  • memory/2240-129-0x00007FF8ABF00000-0x00007FF8ABF10000-memory.dmp
    Filesize

    64KB