Analysis

  • max time kernel
    4265094s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    15-01-2022 10:40

General

  • Target

    nn30.xlsm

  • Size

    83KB

  • MD5

    9636f43534938f7dfa6f9662fca03ff8

  • SHA1

    494885b3781fe4adab15e6738a99555a341b4b82

  • SHA256

    1a243db583013a6999761dad88d6952351fdc2cd17d2016990276a9dd11ac90b

  • SHA512

    e1e9e6832eb13fd3d6f22b22be0f3aeb41b662c4c217dd6f2a841b38b71d2c82cc14dbf97a3167c30be56e9838398870349e12196493a49ca21ab166fe1edd63

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://zml.laneso.com/packet/AlvJ8OdtSYEeeCQP/

xlm40.dropper

http://ostadsarma.com/wp-admin/JNgASjNC/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\nn30.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Windows\SysWow64\rundll32.exe
      C:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D"&"l"&"lR"&"egister"&"Serve"&"r
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:496
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\erum.ocx",DllRegisterServer
        3⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious use of WriteProcessMemory
        PID:4056
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Bbnyqwtgf\vxvmxxowqtbwh.lxg",cBlztdS
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:3504
          • C:\Windows\SysWOW64\rundll32.exe
            C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Bbnyqwtgf\vxvmxxowqtbwh.lxg",DllRegisterServer
            5⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:2488
  • C:\Windows\system32\MusNotification.exe
    C:\Windows\system32\MusNotification.exe
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1312

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\erum.ocx

    MD5

    893b80ebfbd0e2f5c5dc72bb4091a14e

    SHA1

    d08a60ece78a54860987b92f5c0170d7fa5c54b3

    SHA256

    2dc5a01671a0b64736258b66b49526f55f4985fdab69aa3974fcc753b0dc3f2e

    SHA512

    5938d26ecb9e58de997f3463839143f69f798b83d333c674090a3dd956f643ee60872e0b0024954f83d07f4d3a2ca305b3bf0252c056638077425a6391ac4aae

  • C:\Users\Admin\erum.ocx

    MD5

    893b80ebfbd0e2f5c5dc72bb4091a14e

    SHA1

    d08a60ece78a54860987b92f5c0170d7fa5c54b3

    SHA256

    2dc5a01671a0b64736258b66b49526f55f4985fdab69aa3974fcc753b0dc3f2e

    SHA512

    5938d26ecb9e58de997f3463839143f69f798b83d333c674090a3dd956f643ee60872e0b0024954f83d07f4d3a2ca305b3bf0252c056638077425a6391ac4aae

  • C:\Users\Admin\erum.ocx

    MD5

    893b80ebfbd0e2f5c5dc72bb4091a14e

    SHA1

    d08a60ece78a54860987b92f5c0170d7fa5c54b3

    SHA256

    2dc5a01671a0b64736258b66b49526f55f4985fdab69aa3974fcc753b0dc3f2e

    SHA512

    5938d26ecb9e58de997f3463839143f69f798b83d333c674090a3dd956f643ee60872e0b0024954f83d07f4d3a2ca305b3bf0252c056638077425a6391ac4aae

  • C:\Windows\SysWOW64\Bbnyqwtgf\vxvmxxowqtbwh.lxg

    MD5

    893b80ebfbd0e2f5c5dc72bb4091a14e

    SHA1

    d08a60ece78a54860987b92f5c0170d7fa5c54b3

    SHA256

    2dc5a01671a0b64736258b66b49526f55f4985fdab69aa3974fcc753b0dc3f2e

    SHA512

    5938d26ecb9e58de997f3463839143f69f798b83d333c674090a3dd956f643ee60872e0b0024954f83d07f4d3a2ca305b3bf0252c056638077425a6391ac4aae

  • C:\Windows\SysWOW64\Bbnyqwtgf\vxvmxxowqtbwh.lxg

    MD5

    893b80ebfbd0e2f5c5dc72bb4091a14e

    SHA1

    d08a60ece78a54860987b92f5c0170d7fa5c54b3

    SHA256

    2dc5a01671a0b64736258b66b49526f55f4985fdab69aa3974fcc753b0dc3f2e

    SHA512

    5938d26ecb9e58de997f3463839143f69f798b83d333c674090a3dd956f643ee60872e0b0024954f83d07f4d3a2ca305b3bf0252c056638077425a6391ac4aae

  • memory/496-144-0x0000000000000000-mapping.dmp

  • memory/496-148-0x0000000004065000-0x0000000004066000-memory.dmp

    Filesize

    4KB

  • memory/496-147-0x0000000004041000-0x0000000004065000-memory.dmp

    Filesize

    144KB

  • memory/2488-182-0x00000000051C1000-0x00000000051E5000-memory.dmp

    Filesize

    144KB

  • memory/2488-174-0x0000000000000000-mapping.dmp

  • memory/2488-176-0x0000000003061000-0x0000000003085000-memory.dmp

    Filesize

    144KB

  • memory/2488-178-0x0000000005081000-0x00000000050A5000-memory.dmp

    Filesize

    144KB

  • memory/2488-180-0x0000000005161000-0x0000000005185000-memory.dmp

    Filesize

    144KB

  • memory/2488-184-0x00000000052A1000-0x00000000052C5000-memory.dmp

    Filesize

    144KB

  • memory/2488-186-0x00000000055B1000-0x00000000055D5000-memory.dmp

    Filesize

    144KB

  • memory/2712-152-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-138-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-140-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-142-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-131-0x00007FFCE5130000-0x00007FFCE5140000-memory.dmp

    Filesize

    64KB

  • memory/2712-141-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-151-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-130-0x00007FFCE5130000-0x00007FFCE5140000-memory.dmp

    Filesize

    64KB

  • memory/2712-153-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-155-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-154-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-132-0x00007FFCE5130000-0x00007FFCE5140000-memory.dmp

    Filesize

    64KB

  • memory/2712-158-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-159-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-133-0x00007FFCE5130000-0x00007FFCE5140000-memory.dmp

    Filesize

    64KB

  • memory/2712-134-0x00007FFCE5130000-0x00007FFCE5140000-memory.dmp

    Filesize

    64KB

  • memory/2712-135-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-136-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-137-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-139-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/2712-143-0x000001B062D50000-0x000001B062D52000-memory.dmp

    Filesize

    8KB

  • memory/3504-172-0x0000000004D11000-0x0000000004D35000-memory.dmp

    Filesize

    144KB

  • memory/3504-168-0x0000000000000000-mapping.dmp

  • memory/4056-170-0x00000000051B1000-0x00000000051D5000-memory.dmp

    Filesize

    144KB

  • memory/4056-166-0x0000000004E31000-0x0000000004E55000-memory.dmp

    Filesize

    144KB

  • memory/4056-164-0x0000000004DD1000-0x0000000004DF5000-memory.dmp

    Filesize

    144KB

  • memory/4056-162-0x0000000004CC1000-0x0000000004CE5000-memory.dmp

    Filesize

    144KB

  • memory/4056-160-0x0000000004BD1000-0x0000000004BF5000-memory.dmp

    Filesize

    144KB

  • memory/4056-156-0x0000000004611000-0x0000000004635000-memory.dmp

    Filesize

    144KB

  • memory/4056-149-0x0000000000000000-mapping.dmp