Resubmissions
25/04/2025, 03:24
250425-dybpssslt325/04/2025, 03:22
250425-dxdsrssls71013/04/2025, 09:37
250413-lljhwatshw1013/04/2025, 09:33
250413-ljk9patsex10Analysis
- max time kernel
146s - max time network
124s - platform
windows11-21h2_x64 - resource
win11-20250411-en - resource tags
- submitted
25/04/2025, 03:22
General
- Target virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9.xls
- Size 937KB
- Sample250425-dxdsrssls7
- SHA256 64af94592f6707505fa6f42b58776c3635706a414e6362a92f707df84627679c
Malware Config
Extracted
-
xlm4.0
Signatures
- TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
- Ta505 family
- Loads dropped DLL 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 37 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\virusshare\1\VirusShare_0fea640a7da27f365b3675f73626b9c9.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
xcopy00.xlsx
b8ab77100df80ab2.customDestinations-ms
contract_.dll
memory/4768-23-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-0-0x00007FF9B7110000-0x00007FF9B7120000-memory.dmp
memory/4768-9-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-11-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-12-0x00007FF9B4C60000-0x00007FF9B4C70000-memory.dmp
memory/4768-8-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-14-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-15-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-16-0x00007FF9B4C60000-0x00007FF9B4C70000-memory.dmp
memory/4768-17-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-13-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-18-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-20-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-2-0x00007FF9B7110000-0x00007FF9B7120000-memory.dmp
memory/4768-10-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-22-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-5-0x00007FF9B7110000-0x00007FF9B7120000-memory.dmp
memory/4768-7-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-6-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-1-0x00007FF9B7110000-0x00007FF9B7120000-memory.dmp
memory/4768-21-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-53-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-19-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-4-0x00007FF9B7110000-0x00007FF9B7120000-memory.dmp
memory/4768-207-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-208-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-210-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-209-0x0000000055530000-0x0000000055582000-memory.dmp
memory/4768-214-0x00007FF9F7080000-0x00007FF9F7289000-memory.dmp
memory/4768-3-0x00007FF9F7123000-0x00007FF9F7124000-memory.dmp