Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22-02-2022 08:08
Static task
static1
Behavioral task
behavioral1
Sample
Factura 0000000065.xll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Factura 0000000065.xll
Resource
win10v2004-en-20220112
General
-
Target
Factura 0000000065.xll
-
Size
638KB
-
MD5
a673f1b64b97384cdb86e148a94188e8
-
SHA1
2f924ea70a3a8c7b3c5808af437cb895f90f588a
-
SHA256
4a9683f3b6658f4895cd3d44c4920d77db5dfd410cf0dc188e4f4d2740c24539
-
SHA512
0eaaf0d09a828b7289e75e3c92bfb70b5a168031b7670f6eb6c74a0104b448b58f9bb30a09295141e23d0ea60b4571d9f0b220b4e61c38fd81197fc31e254002
Malware Config
Extracted
asyncrat
0.5.7B
1
212.193.30.54:8755
gyQ12!.,=FD7trew
-
anti_vm
false
-
bsod
false
-
delay
3
-
install
false
-
install_folder
%AppData%
-
pastebin_config
null
Signatures
-
Async RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/288-80-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/288-81-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/288-82-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat behavioral1/memory/288-83-0x0000000000400000-0x0000000000412000-memory.dmp asyncrat -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
poa70b.exepid process 432 poa70b.exe -
Loads dropped DLL 3 IoCs
Processes:
EXCEL.EXEpid process 1680 EXCEL.EXE 1680 EXCEL.EXE 1680 EXCEL.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
poa70b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dslfiip = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cltjej\\Dslfiip.exe\"" poa70b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
poa70b.exedescription pid process target process PID 432 set thread context of 288 432 poa70b.exe MSBuild.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1680 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
poa70b.exepid process 432 poa70b.exe 432 poa70b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
EXCEL.EXEpoa70b.exedescription pid process Token: SeDebugPrivilege 1680 EXCEL.EXE Token: SeDebugPrivilege 432 poa70b.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 1680 EXCEL.EXE 1680 EXCEL.EXE -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
EXCEL.EXEpid process 1680 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
EXCEL.EXEpid process 1680 EXCEL.EXE 1680 EXCEL.EXE 1680 EXCEL.EXE 1680 EXCEL.EXE 1680 EXCEL.EXE 1680 EXCEL.EXE 1680 EXCEL.EXE 1680 EXCEL.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
EXCEL.EXEpoa70b.exedescription pid process target process PID 1680 wrote to memory of 432 1680 EXCEL.EXE poa70b.exe PID 1680 wrote to memory of 432 1680 EXCEL.EXE poa70b.exe PID 1680 wrote to memory of 432 1680 EXCEL.EXE poa70b.exe PID 1680 wrote to memory of 432 1680 EXCEL.EXE poa70b.exe PID 432 wrote to memory of 288 432 poa70b.exe MSBuild.exe PID 432 wrote to memory of 288 432 poa70b.exe MSBuild.exe PID 432 wrote to memory of 288 432 poa70b.exe MSBuild.exe PID 432 wrote to memory of 288 432 poa70b.exe MSBuild.exe PID 432 wrote to memory of 288 432 poa70b.exe MSBuild.exe PID 432 wrote to memory of 288 432 poa70b.exe MSBuild.exe PID 432 wrote to memory of 288 432 poa70b.exe MSBuild.exe PID 432 wrote to memory of 288 432 poa70b.exe MSBuild.exe PID 432 wrote to memory of 288 432 poa70b.exe MSBuild.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Factura 0000000065.xll"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\poa70b.exe"C:\Users\Public\poa70b.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\poa70b.exeMD5
3c39836dedf6779a0207819c72238fa5
SHA107433edf63057fff1e96ddbf5249aa2c50f69dbd
SHA25634694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87
SHA512f8a6810abf551f01aae3a8d7c2e6a3421aac3f0312301a5e12a28bfe9490ae064f5c8dd846113cf755a3d9b8f22b80f92b27ec6e4590b04a1629662f472a7086
-
C:\Users\Public\poa70b.exeMD5
3c39836dedf6779a0207819c72238fa5
SHA107433edf63057fff1e96ddbf5249aa2c50f69dbd
SHA25634694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87
SHA512f8a6810abf551f01aae3a8d7c2e6a3421aac3f0312301a5e12a28bfe9490ae064f5c8dd846113cf755a3d9b8f22b80f92b27ec6e4590b04a1629662f472a7086
-
\Users\Admin\AppData\Local\Temp\Factura 0000000065.xllMD5
a673f1b64b97384cdb86e148a94188e8
SHA12f924ea70a3a8c7b3c5808af437cb895f90f588a
SHA2564a9683f3b6658f4895cd3d44c4920d77db5dfd410cf0dc188e4f4d2740c24539
SHA5120eaaf0d09a828b7289e75e3c92bfb70b5a168031b7670f6eb6c74a0104b448b58f9bb30a09295141e23d0ea60b4571d9f0b220b4e61c38fd81197fc31e254002
-
\Users\Admin\AppData\Local\Temp\Factura 0000000065.xllMD5
a673f1b64b97384cdb86e148a94188e8
SHA12f924ea70a3a8c7b3c5808af437cb895f90f588a
SHA2564a9683f3b6658f4895cd3d44c4920d77db5dfd410cf0dc188e4f4d2740c24539
SHA5120eaaf0d09a828b7289e75e3c92bfb70b5a168031b7670f6eb6c74a0104b448b58f9bb30a09295141e23d0ea60b4571d9f0b220b4e61c38fd81197fc31e254002
-
\Users\Public\poa70b.exeMD5
3c39836dedf6779a0207819c72238fa5
SHA107433edf63057fff1e96ddbf5249aa2c50f69dbd
SHA25634694c57b7447b59d6bc6a2dba635fa320a4d4b1e550a36840fe1f2208b76d87
SHA512f8a6810abf551f01aae3a8d7c2e6a3421aac3f0312301a5e12a28bfe9490ae064f5c8dd846113cf755a3d9b8f22b80f92b27ec6e4590b04a1629662f472a7086
-
memory/288-78-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/288-81-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/288-86-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/288-85-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB
-
memory/288-84-0x000000006C5DE000-0x000000006C5DF000-memory.dmpFilesize
4KB
-
memory/288-83-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/288-82-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/288-79-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/288-80-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/432-73-0x0000000000BC0000-0x0000000000C6E000-memory.dmpFilesize
696KB
-
memory/432-77-0x0000000000B60000-0x0000000000BAC000-memory.dmpFilesize
304KB
-
memory/432-76-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/432-75-0x0000000002200000-0x000000000229E000-memory.dmpFilesize
632KB
-
memory/432-74-0x000000006C5DE000-0x000000006C5DF000-memory.dmpFilesize
4KB
-
memory/1680-55-0x0000000071301000-0x0000000071303000-memory.dmpFilesize
8KB
-
memory/1680-66-0x0000000005133000-0x0000000005134000-memory.dmpFilesize
4KB
-
memory/1680-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1680-57-0x00000000722ED000-0x00000000722F8000-memory.dmpFilesize
44KB
-
memory/1680-69-0x000000000513B000-0x000000000514C000-memory.dmpFilesize
68KB
-
memory/1680-54-0x000000002FC11000-0x000000002FC14000-memory.dmpFilesize
12KB
-
memory/1680-68-0x0000000005135000-0x0000000005137000-memory.dmpFilesize
8KB
-
memory/1680-60-0x000000006C5DE000-0x000000006C5DF000-memory.dmpFilesize
4KB
-
memory/1680-67-0x0000000005134000-0x0000000005135000-memory.dmpFilesize
4KB
-
memory/1680-65-0x0000000003020000-0x000000000302A000-memory.dmpFilesize
40KB
-
memory/1680-64-0x0000000004580000-0x00000000045BA000-memory.dmpFilesize
232KB
-
memory/1680-61-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/1680-62-0x0000000002F90000-0x0000000002FAC000-memory.dmpFilesize
112KB
-
memory/1680-63-0x0000000005131000-0x0000000005132000-memory.dmpFilesize
4KB