Analysis

  • max time kernel
    133s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2024 17:51

General

  • Target

    130b2c5e6a9365152926fd09f1b60b327a2f934ca7c4c120af94f0c7b88cd348.xls

  • Size

    48KB

  • MD5

    0d233225bd6aae913ab4a59f37cecd2e

  • SHA1

    0c211134b6b77d368501bc807ee6e0bfe78f16cc

  • SHA256

    130b2c5e6a9365152926fd09f1b60b327a2f934ca7c4c120af94f0c7b88cd348

  • SHA512

    73a2202c67875a34b5b4cc86066c50790e79e7078e96d5cf0e1365a57882c0376a1b973e314791e4341441191b2144f3a16df35dca5ecb39ca11966a32d0b5c6

  • SSDEEP

    768:uDM52tfQXi8vgLZkTOHkQT51Vp6AwPdM8gQ6JL/K9abdDKHGeWmqkySbuR/3ej79:u62tfQXi8vgLZkTOHkQT51Vp6AwPe8gy

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://famesa.com.ar/dos/gaa/

xlm40.dropper

https://www.fantasyclub.com.br/imgs/rggmVTfvT/

xlm40.dropper

http://ecoarch.com.tw/cgi-bin/vWW/

xlm40.dropper

https://dp-flex.co.jp/cgi-bin/Bt3Ycq5Tix/

xlm40.dropper

http://dharmacomunicacao.com.br/OLD/PjBkVBhUH/

xlm40.dropper

http://expresocba.com.ar/snnyNkcVAE3Ztitw/TT0h7/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\130b2c5e6a9365152926fd09f1b60b327a2f934ca7c4c120af94f0c7b88cd348.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1052-2-0x00007FFC7FA10000-0x00007FFC7FA20000-memory.dmp

    Filesize

    64KB

  • memory/1052-0-0x00007FFC7FA10000-0x00007FFC7FA20000-memory.dmp

    Filesize

    64KB

  • memory/1052-3-0x00007FFC7FA10000-0x00007FFC7FA20000-memory.dmp

    Filesize

    64KB

  • memory/1052-1-0x00007FFCBFA2D000-0x00007FFCBFA2E000-memory.dmp

    Filesize

    4KB

  • memory/1052-6-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-7-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-9-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-11-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-12-0x00007FFC7D0B0000-0x00007FFC7D0C0000-memory.dmp

    Filesize

    64KB

  • memory/1052-10-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-8-0x00007FFC7FA10000-0x00007FFC7FA20000-memory.dmp

    Filesize

    64KB

  • memory/1052-13-0x00007FFC7D0B0000-0x00007FFC7D0C0000-memory.dmp

    Filesize

    64KB

  • memory/1052-5-0x00007FFC7FA10000-0x00007FFC7FA20000-memory.dmp

    Filesize

    64KB

  • memory/1052-4-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-15-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-14-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-16-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-38-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-39-0x00007FFCBFA2D000-0x00007FFCBFA2E000-memory.dmp

    Filesize

    4KB

  • memory/1052-40-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB

  • memory/1052-41-0x00007FFCBF990000-0x00007FFCBFB85000-memory.dmp

    Filesize

    2.0MB