5646744689a2caeeac4a124a4b9b64f9666799521064cb131390da29e2603dd9

General

Target

5646744689a2caeeac4a124a4b9b64f9666799521064cb131390da29e2603dd9.xls
Size

71KB
MD5

e5457cd93d2ee82a691abf1435f4a3bd
SHA1

5db1aa76b481fa03d672be636354042bffd2f198
SHA256

5646744689a2caeeac4a124a4b9b64f9666799521064cb131390da29e2603dd9
SHA512

7c1d4014944fd3c5d253a94b9ede0a8f0b7d10737d9b484d6cb5f66a4dc4ca2dcc419588e5bad6d35c6187558387e30bb5069bde729cc5246eea029d5b1891b3
SSDEEP

1536:jhKpb8rGYrMPe3q7Q0XV5xtezE8vG8UM+0+hDcnTLiQrRTZws8Eh:lKpb8rGYrMPe3q7Q0XV5xtezE8vG8UMz

Score

10^/10

discovery

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://natayakim.com/personal/o0sKIzRjM/

xlm40.dropper

http://meta4media.com/portfolio2/flb3iuglypsbqT/

xlm40.dropper

http://hathaabeach.com/documents/zNsC/

Signatures

Process spawned unexpected child process 3 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2816	1968	regsvr32.exe	29
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2396	1968	regsvr32.exe	29
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2820	1968	regsvr32.exe	29

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1968	EXCEL.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1968	EXCEL.EXE
1968	EXCEL.EXE
1968	EXCEL.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2816	1968	EXCEL.EXE	31
PID 1968 wrote to memory of 2816	1968	EXCEL.EXE	31
PID 1968 wrote to memory of 2816	1968	EXCEL.EXE	31
PID 1968 wrote to memory of 2816	1968	EXCEL.EXE	31
PID 1968 wrote to memory of 2816	1968	EXCEL.EXE	31
PID 1968 wrote to memory of 2816	1968	EXCEL.EXE	31
PID 1968 wrote to memory of 2816	1968	EXCEL.EXE	31
PID 1968 wrote to memory of 2396	1968	EXCEL.EXE	32
PID 1968 wrote to memory of 2396	1968	EXCEL.EXE	32
PID 1968 wrote to memory of 2396	1968	EXCEL.EXE	32
PID 1968 wrote to memory of 2396	1968	EXCEL.EXE	32
PID 1968 wrote to memory of 2396	1968	EXCEL.EXE	32
PID 1968 wrote to memory of 2396	1968	EXCEL.EXE	32
PID 1968 wrote to memory of 2396	1968	EXCEL.EXE	32
PID 1968 wrote to memory of 2820	1968	EXCEL.EXE	33
PID 1968 wrote to memory of 2820	1968	EXCEL.EXE	33
PID 1968 wrote to memory of 2820	1968	EXCEL.EXE	33
PID 1968 wrote to memory of 2820	1968	EXCEL.EXE	33
PID 1968 wrote to memory of 2820	1968	EXCEL.EXE	33
PID 1968 wrote to memory of 2820	1968	EXCEL.EXE	33
PID 1968 wrote to memory of 2820	1968	EXCEL.EXE	33

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\5646744689a2caeeac4a124a4b9b64f9666799521064cb131390da29e2603dd9.xls
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\dxgxe1.ocx
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  PID:2816
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\dxgxe2.ocx
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  PID:2396
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\System32\regsvr32.exe /S ..\dxgxe3.ocx
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\dxgxe1.ocx

Filesize
53KB

MD5
3e9dab724ad50e7f7be47727f4e3df34

SHA1
c945044a00a7cf2b6b32466ca60cb222627bc544

SHA256
080c417ab22b78f5fd90e4428281ff69737f74d9b4d9536661bc9bdd23932b07

SHA512
3cab9558bc2843d94bc7986aaca476acaab32ebc9ecc9e4e6fdd6eeea041422f1826b037e9257585c744370c01b9f09052386116370c1a7b0dab7e7ae1f0934b

Download Submit
memory/1968-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1968-1-0x0000000072B5D000-0x0000000072B68000-memory.dmp

Filesize
44KB

Download
memory/1968-21-0x0000000072B5D000-0x0000000072B68000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads