Analysis
-
max time kernel
115s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-07-2022 18:06
Static task
static1
Behavioral task
behavioral1
Sample
STOWAGE PLAN.xll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
STOWAGE PLAN.xll
Resource
win10v2004-20220414-en
General
-
Target
STOWAGE PLAN.xll
-
Size
1.7MB
-
MD5
6ea1c38ca441834adead2a04cb8f5d8a
-
SHA1
c1fe55edbca69ee37a2378c957b9c0c1c85471d8
-
SHA256
7e47e3f0546d15968a9feab556f1b5630b2ede65a31db2e488c7a51e059ba280
-
SHA512
23eaf7841fa1b11d86a2e9ffc7874a669f4cd3bf68b4ecc03a7eb6a013dc5f2a6a62393f01f6bb4b4b2b72bddf908ca813ee26ae016a5e0fa662604a5a0736fe
Malware Config
Extracted
Extracted
snakekeylogger
https://api.telegram.org/bot1897716112:AAEAtOCkOV8umHBB93Og24bkiIdUKReGK44/sendMessage?chat_id=1745211648
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.execmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4492 4832 cmd.exe EXCEL.EXE Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3956 4832 cmd.exe EXCEL.EXE -
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
-
Snake Keylogger Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/768-167-0x0000000000400000-0x0000000000426000-memory.dmp family_snakekeylogger -
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
appMTBYNNHMVY.txt.exepid process 3372 appMTBYNNHMVY.txt.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
appMTBYNNHMVY.txt.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation appMTBYNNHMVY.txt.exe -
Loads dropped DLL 2 IoCs
Processes:
EXCEL.EXEpid process 4832 EXCEL.EXE 4832 EXCEL.EXE -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
appMTBYNNHMVY.txt.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rrfta = "\"C:\\Users\\Admin\\AppData\\Roaming\\Hbxhwj\\Rrfta.exe\"" appMTBYNNHMVY.txt.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 54 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
appMTBYNNHMVY.txt.exedescription pid process target process PID 3372 set thread context of 768 3372 appMTBYNNHMVY.txt.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4832 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeappMTBYNNHMVY.txt.exeInstallUtil.exepid process 928 powershell.exe 928 powershell.exe 3372 appMTBYNNHMVY.txt.exe 3372 appMTBYNNHMVY.txt.exe 768 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
EXCEL.EXEappMTBYNNHMVY.txt.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4832 EXCEL.EXE Token: SeDebugPrivilege 3372 appMTBYNNHMVY.txt.exe Token: SeDebugPrivilege 928 powershell.exe Token: SeDebugPrivilege 768 InstallUtil.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
EXCEL.EXEcmd.execmd.exeappMTBYNNHMVY.txt.exedescription pid process target process PID 4832 wrote to memory of 4492 4832 EXCEL.EXE cmd.exe PID 4832 wrote to memory of 4492 4832 EXCEL.EXE cmd.exe PID 4492 wrote to memory of 2748 4492 cmd.exe certutil.exe PID 4492 wrote to memory of 2748 4492 cmd.exe certutil.exe PID 4832 wrote to memory of 3956 4832 EXCEL.EXE cmd.exe PID 4832 wrote to memory of 3956 4832 EXCEL.EXE cmd.exe PID 3956 wrote to memory of 4892 3956 cmd.exe certutil.exe PID 3956 wrote to memory of 4892 3956 cmd.exe certutil.exe PID 4832 wrote to memory of 3372 4832 EXCEL.EXE appMTBYNNHMVY.txt.exe PID 4832 wrote to memory of 3372 4832 EXCEL.EXE appMTBYNNHMVY.txt.exe PID 4832 wrote to memory of 3372 4832 EXCEL.EXE appMTBYNNHMVY.txt.exe PID 3372 wrote to memory of 928 3372 appMTBYNNHMVY.txt.exe powershell.exe PID 3372 wrote to memory of 928 3372 appMTBYNNHMVY.txt.exe powershell.exe PID 3372 wrote to memory of 928 3372 appMTBYNNHMVY.txt.exe powershell.exe PID 3372 wrote to memory of 768 3372 appMTBYNNHMVY.txt.exe InstallUtil.exe PID 3372 wrote to memory of 768 3372 appMTBYNNHMVY.txt.exe InstallUtil.exe PID 3372 wrote to memory of 768 3372 appMTBYNNHMVY.txt.exe InstallUtil.exe PID 3372 wrote to memory of 768 3372 appMTBYNNHMVY.txt.exe InstallUtil.exe PID 3372 wrote to memory of 768 3372 appMTBYNNHMVY.txt.exe InstallUtil.exe PID 3372 wrote to memory of 768 3372 appMTBYNNHMVY.txt.exe InstallUtil.exe PID 3372 wrote to memory of 768 3372 appMTBYNNHMVY.txt.exe InstallUtil.exe PID 3372 wrote to memory of 768 3372 appMTBYNNHMVY.txt.exe InstallUtil.exe -
outlook_office_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
Processes:
InstallUtil.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\STOWAGE PLAN.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C certutil -decode C:\Users\Admin\Downloads\appMTBYNNHMVY.txt C:\Users\Admin\Downloads\appMTBYNNHMVY.txt.xlsx2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -decode C:\Users\Admin\Downloads\appMTBYNNHMVY.txt C:\Users\Admin\Downloads\appMTBYNNHMVY.txt.xlsx3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C certutil -decode C:\Users\Admin\Downloads\appMTBYNNHMVY.txt C:\Users\Admin\Downloads\appMTBYNNHMVY.txt.exe &2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -decode C:\Users\Admin\Downloads\appMTBYNNHMVY.txt C:\Users\Admin\Downloads\appMTBYNNHMVY.txt.exe3⤵
-
C:\Users\Admin\Downloads\appMTBYNNHMVY.txt.exe"C:\Users\Admin\Downloads\appMTBYNNHMVY.txt.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\STOWAGE PLAN.xllFilesize
1.7MB
MD56ea1c38ca441834adead2a04cb8f5d8a
SHA1c1fe55edbca69ee37a2378c957b9c0c1c85471d8
SHA2567e47e3f0546d15968a9feab556f1b5630b2ede65a31db2e488c7a51e059ba280
SHA51223eaf7841fa1b11d86a2e9ffc7874a669f4cd3bf68b4ecc03a7eb6a013dc5f2a6a62393f01f6bb4b4b2b72bddf908ca813ee26ae016a5e0fa662604a5a0736fe
-
C:\Users\Admin\AppData\Local\Temp\STOWAGE PLAN.xllFilesize
1.7MB
MD56ea1c38ca441834adead2a04cb8f5d8a
SHA1c1fe55edbca69ee37a2378c957b9c0c1c85471d8
SHA2567e47e3f0546d15968a9feab556f1b5630b2ede65a31db2e488c7a51e059ba280
SHA51223eaf7841fa1b11d86a2e9ffc7874a669f4cd3bf68b4ecc03a7eb6a013dc5f2a6a62393f01f6bb4b4b2b72bddf908ca813ee26ae016a5e0fa662604a5a0736fe
-
C:\Users\Admin\Downloads\appMTBYNNHMVY.txtFilesize
24KB
MD5fbefbe8ae4a09ba8018b2d7ff9143f3e
SHA1c03cd7561d6a64f754c65bda8faa5a434eb04e0b
SHA256881a15d10e000d20b2179290d340e1234f46301569f19e34fe06f82f37cb32c8
SHA512490167845d6930e10339e83a5e60181e78a718b8975eccb6bb104467020b4fd4b080be20e463e5bfe681549e843999a2b90b3f48db737229e8a0bdc198af7189
-
C:\Users\Admin\Downloads\appMTBYNNHMVY.txtFilesize
56B
MD57b26a5b21212e4cec867bff58478af37
SHA1f3449915ec0554c3ec7a32d1239e7e9e8cb53eb2
SHA256960e7eaf0228ddbb7dda410c09e5094d73475a5b1d05825fe9770ef7cf3ceb4d
SHA5125be5e0f7132a91c671ef28b4855cfbfe26fbe22e98482f79bcf56bcff22bde9b8765d999fab40bca7e83cbd67a44041c6ffb28ca55e474c1acb42d3e05e238cc
-
C:\Users\Admin\Downloads\appMTBYNNHMVY.txt.exeFilesize
174KB
MD5e4a741c46581b1e1b66ebae36db1d676
SHA1438d8b0da4fbe056d1fef528b013d31999ea276e
SHA256b4e8875282bb35cda28a68b17840e5a4ab771f64af7cdfb9322909f59bd9139e
SHA5127eb57eb07c8009c369c178ab3df9d19d2e9b32310facf05f417aadc30ca4301053a6fcb3f5e180d39bae546f51c2fdac1bdbe09d76667e9463ab006d76a20d83
-
C:\Users\Admin\Downloads\appMTBYNNHMVY.txt.exeFilesize
174KB
MD5e4a741c46581b1e1b66ebae36db1d676
SHA1438d8b0da4fbe056d1fef528b013d31999ea276e
SHA256b4e8875282bb35cda28a68b17840e5a4ab771f64af7cdfb9322909f59bd9139e
SHA5127eb57eb07c8009c369c178ab3df9d19d2e9b32310facf05f417aadc30ca4301053a6fcb3f5e180d39bae546f51c2fdac1bdbe09d76667e9463ab006d76a20d83
-
C:\Users\Admin\Downloads\appMTBYNNHMVY.txt.xlsxFilesize
18KB
MD5aea065e068a1c885c5c82b9da16de628
SHA1f6c1af23d9e30b77160bf0da4f56eaef94d853c1
SHA256fcd49a887692286cd815e911fd667f9323152c4d13e37020f065aabd023ab0ca
SHA512092247866bca90694c95e7d1db658baba7fd88c192fd8e2c132de896541b3a09b74b17055022dbb03789814a0a31c3ae57072e6ef6f3c88f2cd23c0ca8275c8a
-
memory/768-167-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/768-168-0x00000000057F0000-0x0000000005D94000-memory.dmpFilesize
5.6MB
-
memory/768-166-0x0000000000000000-mapping.dmp
-
memory/768-171-0x0000000006280000-0x000000000628A000-memory.dmpFilesize
40KB
-
memory/768-170-0x0000000006400000-0x00000000065C2000-memory.dmpFilesize
1.8MB
-
memory/768-169-0x00000000052E0000-0x000000000537C000-memory.dmpFilesize
624KB
-
memory/928-154-0x0000000000000000-mapping.dmp
-
memory/928-164-0x0000000006870000-0x000000000688A000-memory.dmpFilesize
104KB
-
memory/928-160-0x0000000005CC0000-0x0000000005D26000-memory.dmpFilesize
408KB
-
memory/928-159-0x00000000053C0000-0x00000000053E2000-memory.dmpFilesize
136KB
-
memory/928-161-0x0000000005D30000-0x0000000005D96000-memory.dmpFilesize
408KB
-
memory/928-157-0x00000000054E0000-0x0000000005B08000-memory.dmpFilesize
6.2MB
-
memory/928-162-0x0000000006390000-0x00000000063AE000-memory.dmpFilesize
120KB
-
memory/928-163-0x00000000079C0000-0x000000000803A000-memory.dmpFilesize
6.5MB
-
memory/928-155-0x0000000004DC0000-0x0000000004DF6000-memory.dmpFilesize
216KB
-
memory/2748-144-0x0000000000000000-mapping.dmp
-
memory/3372-153-0x00000000005A0000-0x00000000005D2000-memory.dmpFilesize
200KB
-
memory/3372-150-0x0000000000000000-mapping.dmp
-
memory/3372-165-0x000000002A900000-0x000000002A992000-memory.dmpFilesize
584KB
-
memory/3956-147-0x0000000000000000-mapping.dmp
-
memory/4492-143-0x0000000000000000-mapping.dmp
-
memory/4832-136-0x00007FFAA2CD0000-0x00007FFAA2CE0000-memory.dmpFilesize
64KB
-
memory/4832-173-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmpFilesize
64KB
-
memory/4832-134-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmpFilesize
64KB
-
memory/4832-133-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmpFilesize
64KB
-
memory/4832-141-0x00007FFABC2C0000-0x00007FFABCD81000-memory.dmpFilesize
10.8MB
-
memory/4832-138-0x00000111D9C10000-0x00000111D9DE3000-memory.dmpFilesize
1.8MB
-
memory/4832-156-0x00007FFABC2C0000-0x00007FFABCD81000-memory.dmpFilesize
10.8MB
-
memory/4832-158-0x00000111F314C000-0x00000111F314F000-memory.dmpFilesize
12KB
-
memory/4832-177-0x00007FFABC2C0000-0x00007FFABCD81000-memory.dmpFilesize
10.8MB
-
memory/4832-135-0x00007FFAA2CD0000-0x00007FFAA2CE0000-memory.dmpFilesize
64KB
-
memory/4832-142-0x00000111F314C000-0x00000111F314F000-memory.dmpFilesize
12KB
-
memory/4832-132-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmpFilesize
64KB
-
memory/4832-131-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmpFilesize
64KB
-
memory/4832-130-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmpFilesize
64KB
-
memory/4832-174-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmpFilesize
64KB
-
memory/4832-175-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmpFilesize
64KB
-
memory/4832-176-0x00007FFAA4EF0000-0x00007FFAA4F00000-memory.dmpFilesize
64KB
-
memory/4892-148-0x0000000000000000-mapping.dmp