Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
29/07/2024, 06:03
General
- Target TDOMAN_CV.doc
- Size 59KB
- Sample240729-gsfncazfrd
- SHA256 924f953de2ee0ba094a76e5001b8f445d5e80f37e1fa6c5943a13b971f63b0fb
Malware Config
Signatures
- Sliver RAT v2 1 IoCs
- SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\TDOMAN_CV.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\spool\drivers\color\grandfraisupdate.dll,update_grandfrais1⤵
- Blocklisted process makes network request
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
5C33D0C2-43C3-4C53-BD2F-354932654DC9
mip_sdk.miplog
089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
sist02.xsl
CUSTOM.DIC
fb3b0dbfee58fac8.customDestinations-ms
grandfraisupdate.dll
memory/3504-130-0x00007FFEC3B70000-0x00007FFEC3B80000-memory.dmp
memory/3504-131-0x00007FFEC3B70000-0x00007FFEC3B80000-memory.dmp
memory/3504-132-0x00007FFEC3B70000-0x00007FFEC3B80000-memory.dmp
memory/3504-133-0x00007FFEC3B70000-0x00007FFEC3B80000-memory.dmp
memory/4000-13-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-122-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-17-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-18-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-16-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-15-0x00007FFEC1B10000-0x00007FFEC1B20000-memory.dmp
memory/4000-14-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-38-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-51-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-52-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-50-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-2-0x00007FFEC3B70000-0x00007FFEC3B80000-memory.dmp
memory/4000-11-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-10-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-9-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-7-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-8-0x00007FFEC1B10000-0x00007FFEC1B20000-memory.dmp
memory/4000-12-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-6-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-0-0x00007FFEC3B70000-0x00007FFEC3B80000-memory.dmp
memory/4000-1-0x00007FFEC3B70000-0x00007FFEC3B80000-memory.dmp
memory/4000-3-0x00007FFF03B8D000-0x00007FFF03B8E000-memory.dmp
memory/4000-5-0x00007FFEC3B70000-0x00007FFEC3B80000-memory.dmp
memory/4000-297-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-4-0x00007FFEC3B70000-0x00007FFEC3B80000-memory.dmp
memory/4000-155-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-150-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-145-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-146-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4000-149-0x00007FFF03AF0000-0x00007FFF03CE5000-memory.dmp
memory/4652-147-0x00000181B8AD0000-0x00000181B9BD9000-memory.dmp
memory/4652-143-0x00000181B8AD0000-0x00000181B9BD9000-memory.dmp
memory/4652-144-0x00007FFED71E0000-0x00007FFED8346000-memory.dmp
memory/4652-141-0x00000181B8AD0000-0x00000181B9BD9000-memory.dmp
memory/4652-142-0x00000181B8AD0000-0x00000181B9BD9000-memory.dmp
memory/4652-140-0x00000181B8AD0000-0x00000181B9BD9000-memory.dmp