Analysis
- max time kernel
153s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
01/03/2022, 07:51
General
- Target DAR_ NALJART TECHNOLOGY_CONDITIONS.xll
- Size 4KB
- Sample220301-jpw72aaedq
- SHA256 4e1397fff753fe86be50e152d3e2ace6a8a9e0b3f8e63e77c0e0c1c1d6ed71c3
Malware Config
Extracted
-
xlm4.0
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\DAR_ NALJART TECHNOLOGY_CONDITIONS.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\WindowsMediaPlayere.exe"C:\ProgramData\WindowsMediaPlayere.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 01⤵
- Checks processor information in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/880-134-0x00007FF9BCA90000-0x00007FF9BCAA0000-memory.dmp
memory/880-155-0x000000006D3E0000-0x000000006D3E6000-memory.dmp
memory/880-135-0x00007FF9FCAAD000-0x00007FF9FCAAE000-memory.dmp
memory/880-130-0x00007FF9BCA90000-0x00007FF9BCAA0000-memory.dmp
memory/880-133-0x00007FF9BCA90000-0x00007FF9BCAA0000-memory.dmp
memory/880-132-0x00007FF9BCA90000-0x00007FF9BCAA0000-memory.dmp
memory/880-131-0x00007FF9BCA90000-0x00007FF9BCAA0000-memory.dmp
memory/880-136-0x00007FF9FCAB0000-0x00007FF9FCAB1000-memory.dmp
memory/3908-156-0x000000007479E000-0x000000007479F000-memory.dmp
memory/3908-157-0x0000000000180000-0x000000000023E000-memory.dmp
memory/3908-158-0x00000000051D0000-0x0000000005774000-memory.dmp
memory/3908-159-0x0000000004C20000-0x0000000004CB2000-memory.dmp
memory/3908-160-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/3908-161-0x0000000004BD0000-0x0000000004BDA000-memory.dmp