Overview

overview

10

Static

static

10

?i=1lmlfsgug.xlsm

windows7_x64

10

?i=1lmlfsgug.xlsm

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    22-05-2022 05:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ?i=1lmlfsgug.xlsm

  • Size

    83KB

  • MD5

    7d3cda77a05f3883eedfacd2eabfdac9

  • SHA1

    05358e587fd9cc5e1ed4903f4fdca621eadde86c

  • SHA256

    79f3b373fa9006ca74b6f4bd4eb82a98eed7e7377038b7a4dd821a937d01f38e

  • SHA512

    b3a05537600370e7aa96bd29a10570fdadbfad2d178d6551bdc74d6164419757244134f41fe4b2ea78639fc40ea3b5018be403c9df52e71461d92bcf182a2149

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://unifiedpharma.com/wp-admin/ildi5K2aTIrdvEobQ/
xlm40.dropper

https://kauffmancreates.com/images/G8050LVq/
xlm40.dropper

https://sanagrafix.com/udll/fki4w1vFApT4Rwjp1R/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\_i=1lmlfsgug.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2556

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2556-130-0x00007FFBFB590000-0x00007FFBFB5A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2556-131-0x00007FFBFB590000-0x00007FFBFB5A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2556-132-0x00007FFBFB590000-0x00007FFBFB5A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2556-133-0x00007FFBFB590000-0x00007FFBFB5A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2556-134-0x00007FFBFB590000-0x00007FFBFB5A0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2556-135-0x00007FFBF93F0000-0x00007FFBF9400000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2556-136-0x00007FFBF93F0000-0x00007FFBF9400000-memory.dmp
    Filesize

    64KB

    Download