4bd4cca6e4678b02247d333da7ae4939db889ddc4f14aa8a8fa870d95c0e9371

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4bd4cca6e4678b02247d333da7ae4939db889ddc4f14aa8a8fa870d95c0e9371.xlsm
Size

37KB
MD5

43b6025a6eb4670b27ec8e977f7b7916
SHA1

4a95f0defc13c7808423205ff8e171304c202c37
SHA256

4bd4cca6e4678b02247d333da7ae4939db889ddc4f14aa8a8fa870d95c0e9371
SHA512

89c0f05fc96f834fddf8f0aeef9a3157293d70cca6d568f9669678ec1ee4bef3a1475f616ffd6655ef72c48552641de79198834889924888b96bffe97d7c8a9b
SSDEEP

768:27CkFF/vxL7UD9msu3bm9Y9Z502lkJexn9/Eg00wPYRND/0ZSPo0B5HAVJ:27Tlxwuaa502Wex9wTsZ/0YBdI

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://sorathlions.com/tmp/bfJrKD4g0bJL73qw/

xlm40.dropper

http://www.invest-moon.com/wp-admin/2PbOcXXyFr4oFoogAA/

xlm40.dropper

http://narsanatanaokulu.com/wp-includes/reZNtZ53IH/

xlm40.dropper

https://ramijabali.com/licenses/WQu8ZS0qQNGp/

xlm40.dropper

http://support.techopesolutions.com/gq2z3/yt7TquOtSLXXeade/

xlm40.dropper

http://blog.centerking.top/wp-includes/YvwIBPBq/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1176	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1176	EXCEL.EXE
1176	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1176	EXCEL.EXE
1176	EXCEL.EXE
1176	EXCEL.EXE
1176	EXCEL.EXE
1176	EXCEL.EXE
1176	EXCEL.EXE
1176	EXCEL.EXE
1176	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4bd4cca6e4678b02247d333da7ae4939db889ddc4f14aa8a8fa870d95c0e9371.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
c0d3aa254bfa3d58efe1346d0fd19170

SHA1
1fe6f2b77a3908b3a50345212dad37f1e19dd6d7

SHA256
9e3d811a2e272ff7561ae0d9eab1e58595028e147c5c1f08febc9e818a769081

SHA512
36ba937074ad4d18d4ad47a605cda7586858afc6dbb9e997980a0a103b2af2d0d5a0f7eb80f92cde870e550634b62a665d1e06d7e4c6443653ec6153c1b881cf

Download Submit
memory/1176-10-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-5-0x00007FFBB06F0000-0x00007FFBB0700000-memory.dmp

Filesize
64KB

Download
memory/1176-3-0x00007FFBF070D000-0x00007FFBF070E000-memory.dmp

Filesize
4KB

Download
memory/1176-1-0x00007FFBB06F0000-0x00007FFBB0700000-memory.dmp

Filesize
64KB

Download
memory/1176-0-0x00007FFBB06F0000-0x00007FFBB0700000-memory.dmp

Filesize
64KB

Download
memory/1176-8-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-7-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-6-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-2-0x00007FFBB06F0000-0x00007FFBB0700000-memory.dmp

Filesize
64KB

Download
memory/1176-9-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-12-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-13-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-11-0x00007FFBADE70000-0x00007FFBADE80000-memory.dmp

Filesize
64KB

Download
memory/1176-17-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-16-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-15-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-18-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-14-0x00007FFBADE70000-0x00007FFBADE80000-memory.dmp

Filesize
64KB

Download
memory/1176-35-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download
memory/1176-4-0x00007FFBB06F0000-0x00007FFBB0700000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads