Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 17:41

General

  • Target

    eb1b1f24745953db908595cd2b1854cd5c6e62356319b61e43bc7f0714f8ab0d.xlsm

  • Size

    35KB

  • MD5

    1909a5fa37d26c68daf7d52c0a22d351

  • SHA1

    228669309cbcbecd913acbe657858908d3fda9af

  • SHA256

    eb1b1f24745953db908595cd2b1854cd5c6e62356319b61e43bc7f0714f8ab0d

  • SHA512

    7d0b66ff4f1eaff10b50ebd1a54e6dd0a1c04477d077d01c401fdf7e57cac70cda50a6a7f6574b794e3d0ecc908e17debded45590840db7e7d2b41372009c56b

  • SSDEEP

    768:aYKtm5eMn7AjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooXLR:aYKtmg+UOZZ1ZYpoQ/pMAm

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://casinojackpotking.com/cgi-bin/47sKbklSQf31/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\eb1b1f24745953db908595cd2b1854cd5c6e62356319b61e43bc7f0714f8ab0d.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Windows\SysWow64\regsvr32.exe
      C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:1276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    17b851c2122eac380135453d86afb6a6

    SHA1

    88b335ff55d23ea78f636db90021a2611a9cc3a0

    SHA256

    8d164e87eb866dedd32a3691f49b92b5059639542eb777558e5095bf0a6ac74f

    SHA512

    88f727ffa8560e2c48d0c90522c1b194562f788d21a6177d8bc9fbc893288e3f9911a7230ea94f8d23b6230b60596207e397c85b08586dc86f54677d64b4143a

  • C:\Users\Admin\xdha.ocx

    Filesize

    9B

    MD5

    9d1ead73e678fa2f51a70a933b0bf017

    SHA1

    d205cbd6783332a212c5ae92d73c77178c2d2f28

    SHA256

    0019dfc4b32d63c1392aa264aed2253c1e0c2fb09216f8e2cc269bbfb8bb49b5

    SHA512

    935b3d516e996f6d25948ba8a54c1b7f70f7f0e3f517e36481fdf0196c2c5cfc2841f86e891f3df9517746b7fb605db47cdded1b8ff78d9482ddaa621db43a34

  • memory/1968-15-0x00007FFBE8B70000-0x00007FFBE8B80000-memory.dmp

    Filesize

    64KB

  • memory/1968-16-0x00007FFBE8B70000-0x00007FFBE8B80000-memory.dmp

    Filesize

    64KB

  • memory/1968-7-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

    Filesize

    2.0MB

  • memory/1968-5-0x00007FFBEB410000-0x00007FFBEB420000-memory.dmp

    Filesize

    64KB

  • memory/1968-8-0x00007FFBEB410000-0x00007FFBEB420000-memory.dmp

    Filesize

    64KB

  • memory/1968-12-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

    Filesize

    2.0MB

  • memory/1968-14-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

    Filesize

    2.0MB

  • memory/1968-13-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

    Filesize

    2.0MB

  • memory/1968-0-0x00007FFC2B42D000-0x00007FFC2B42E000-memory.dmp

    Filesize

    4KB

  • memory/1968-2-0x00007FFBEB410000-0x00007FFBEB420000-memory.dmp

    Filesize

    64KB

  • memory/1968-11-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

    Filesize

    2.0MB

  • memory/1968-10-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

    Filesize

    2.0MB

  • memory/1968-9-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

    Filesize

    2.0MB

  • memory/1968-4-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

    Filesize

    2.0MB

  • memory/1968-6-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

    Filesize

    2.0MB

  • memory/1968-29-0x00007FFC2B390000-0x00007FFC2B585000-memory.dmp

    Filesize

    2.0MB

  • memory/1968-30-0x00007FFC2B42D000-0x00007FFC2B42E000-memory.dmp

    Filesize

    4KB

  • memory/1968-3-0x00007FFBEB410000-0x00007FFBEB420000-memory.dmp

    Filesize

    64KB

  • memory/1968-1-0x00007FFBEB410000-0x00007FFBEB420000-memory.dmp

    Filesize

    64KB