Analysis
- max time kernel
98s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
26/03/2023, 15:15
General
- Target SZOI-Wyciek-20-03-2023.xll
- Size 718KB
- Sample230326-sncxfagh98
- SHA256 1c9264473281f0d5144912a8c05d803697c7da8707cd5607017e6936d2fa1588
Malware Config
Extracted
-
xlm4.0
Extracted
-
vidar
-
3
-
e37abeff0df24a473dacaf8467d6fa48
-
https://t.me/zaskullz
-
https://steamcommunity.com/profiles/76561199486572327
-
http://135.181.87.234:80
-
profile_id_v2
e37abeff0df24a473dacaf8467d6fa48
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 13 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SZOI-Wyciek-20-03-2023.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Date2023.exe"C:\Users\Admin\AppData\Local\Temp\Date2023.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 16203⤵
- Program crash
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C start %temp%/Excel.xlsx2⤵
- Process spawned unexpected child process
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Excel.xlsx"3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4128 -ip 41281⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
excel.exe_Rules.xml
excel.exe.db
excel.exe.db-wal
excel.exe.db-wal
Date2023.exe
Date2023.exe
Date2023.exe
Excel.xlsx
SZOI-Wyciek-20-03-2023.xll
SZOI-Wyciek-20-03-2023.xll
memory/664-148-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-209-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-153-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-154-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-151-0x000001EFA9540000-0x000001EFA9552000-memory.dmp
memory/664-150-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-149-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-133-0x00007FFBFD110000-0x00007FFBFD120000-memory.dmp
memory/664-147-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-144-0x000001EFA7E50000-0x000001EFA7F1D000-memory.dmp
memory/664-139-0x00007FFBFA960000-0x00007FFBFA970000-memory.dmp
memory/664-138-0x00007FFBFA960000-0x00007FFBFA970000-memory.dmp
memory/664-137-0x00007FFBFD110000-0x00007FFBFD120000-memory.dmp
memory/664-134-0x00007FFBFD110000-0x00007FFBFD120000-memory.dmp
memory/664-135-0x00007FFBFD110000-0x00007FFBFD120000-memory.dmp
memory/664-136-0x00007FFBFD110000-0x00007FFBFD120000-memory.dmp
memory/664-208-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-203-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-204-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-205-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-207-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-206-0x000001EFC1870000-0x000001EFC1880000-memory.dmp
memory/664-152-0x000001EFA9520000-0x000001EFA952A000-memory.dmp
memory/4128-212-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-222-0x0000000051290000-0x0000000051383000-memory.dmp
memory/4128-292-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4128-293-0x0000000000400000-0x0000000000471000-memory.dmp
memory/4540-201-0x00007FFBFD110000-0x00007FFBFD120000-memory.dmp
memory/4540-200-0x00007FFBFD110000-0x00007FFBFD120000-memory.dmp
memory/4540-198-0x00007FFBFD110000-0x00007FFBFD120000-memory.dmp
memory/4540-199-0x00007FFBFD110000-0x00007FFBFD120000-memory.dmp