Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2023 07:17
Behavioral task
behavioral1
Sample
RLP1964598032xlsm.xlsm
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
RLP1964598032xlsm.xlsm
Resource
win10v2004-20230621-en
General
-
Target
RLP1964598032xlsm.xlsm
-
Size
46KB
-
MD5
8d9e59e5063fe4fdc5eb1f7e4f242405
-
SHA1
c767e1544bbd7ea7c33d7d8034ef266c8d9f01a6
-
SHA256
816139a521f5f7194347aea048e100b8893fa8ce7d6a86910a72bb190425e553
-
SHA512
dacde4954db52f6dd220cc959e2434d88d9be58d517e4daeda68be650516caf81e64fa6b69e09a4ce7e1d03cf2021a470c214e8356d9671d6ee300104d24b40f
-
SSDEEP
768:QmBlntZhEI2YmxNskmoKjBvK3HqK88F/G6YzATUfJnXYS6oRM:hBlntTEvDLmXi3JvG6YzATOJnXYSXRM
Malware Config
Extracted
http://eles-tech.com/css/KzMysMqFMs/
http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
regsvr32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 836 2944 regsvr32.exe EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2944 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 2944 EXCEL.EXE 2944 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
EXCEL.EXEpid process 2944 EXCEL.EXE 2944 EXCEL.EXE 2944 EXCEL.EXE 2944 EXCEL.EXE 2944 EXCEL.EXE 2944 EXCEL.EXE 2944 EXCEL.EXE 2944 EXCEL.EXE 2944 EXCEL.EXE 2944 EXCEL.EXE 2944 EXCEL.EXE 2944 EXCEL.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 2944 wrote to memory of 836 2944 EXCEL.EXE regsvr32.exe PID 2944 wrote to memory of 836 2944 EXCEL.EXE regsvr32.exe PID 2944 wrote to memory of 836 2944 EXCEL.EXE regsvr32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RLP1964598032xlsm.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\regsvr32.exeC:\Windows\SysWow64\regsvr32.exe -s ..\xewn.dll2⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\xewn.dllFilesize
1.2MB
MD5a0ceb214519370f10ef796e4e9d1aeaa
SHA17b8d9a72a9cbe2145c30785bbd7791edc4603d83
SHA256cf7d36aec9644e4dc126ff5b136354cd2ef3b6abf27dfbce84f3ecbdf48fe8ea
SHA512573c239fb7c50fe22bbd7c169c224e68453dc60d4690fd02cc2f9d8ee43a4cce5f8c59ff6e3c3851ffdd97d141457dee10d082f3a2dc1eaf73ac64095a2945d5
-
memory/2944-133-0x00007FFE184B0000-0x00007FFE184C0000-memory.dmpFilesize
64KB
-
memory/2944-134-0x00007FFE184B0000-0x00007FFE184C0000-memory.dmpFilesize
64KB
-
memory/2944-135-0x00007FFE184B0000-0x00007FFE184C0000-memory.dmpFilesize
64KB
-
memory/2944-136-0x00007FFE184B0000-0x00007FFE184C0000-memory.dmpFilesize
64KB
-
memory/2944-137-0x00007FFE184B0000-0x00007FFE184C0000-memory.dmpFilesize
64KB
-
memory/2944-138-0x00007FFE162A0000-0x00007FFE162B0000-memory.dmpFilesize
64KB
-
memory/2944-139-0x00007FFE162A0000-0x00007FFE162B0000-memory.dmpFilesize
64KB