MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03ceb725e997c085e3cb226c4bdc43114fa9a7dfdbd7fe59a538b8d0206fec61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Dridex

Vendor detections: 10

Maldoc score: 33

Intelligence 10 IOCs YARA 7 File information Comments

SHA256 hash:	03ceb725e997c085e3cb226c4bdc43114fa9a7dfdbd7fe59a538b8d0206fec61
SHA3-384 hash:	d65b66aea445b3002b55e1c1d5b8426a9de8b6a757fc2d3ca8a53c1f05a6b7cf9b63028074485993269e7bb86228ebb6
SHA1 hash:	d5d2faf8d019f0a84ab398663a591c6dd4978c3c
MD5 hash:	857c15427dbacfa62f0cbb2d2a78aa71
humanhash:	indigo-oklahoma-double-earth
File name:	Reports #176.xlsm
Download:	download sample
Signature	Dridex Create hunting rule
File size:	311'921 bytes
First seen:	2021-02-24 15:08:12 UTC
Last seen:	Never
File type:	xlsm
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	6144:z+5DxYbinUMqPaYKaTLFIiwu8HjdkNUVsWkMkb5hBvhXj5j0:linUtaYB6uIdlOhMshBvpje
TLSH	1764021CE9A25860DE60E7B255CA4845A33A15C3D543722C0A3EB33E5E9B77E5B0C39F
Reporter	abuse_ch
Tags:	Dridex xlsm

abuse_ch

Malspam distributing Dridex:

HELO: server.gssint.com
Sending IP: 5.9.89.80
From: Armin Ghaderi <Armin.Ghaderi@gssint.com>
Subject: payment received: invoice from pcs of west central ks aug 2021
Attachment: Reports 176.zip (contains "Reports #176.xlsm")

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 33

OLE dump

MalwareBazaar was able to identify 41 sections in this file using oledump:

Section ID	Section size	Section name
A1	97 bytes	HvpquuIW/CompObj
A2	290 bytes	HvpquuIW/VBFrame
A3	90 bytes	HvpquuIW/f
A4	4752 bytes	HvpquuIW/o
A5	97 bytes	OxRR1_I6sg_Z59/CompObj
A6	270 bytes	OxRR1_I6sg_Z59/VBFrame
A7	38 bytes	OxRR1_I6sg_Z59/f
A8	0 bytes	OxRR1_I6sg_Z59/o
A9	97 bytes	P9j0pR13czB/CompObj
A10	267 bytes	P9j0pR13czB/VBFrame
A11	38 bytes	P9j0pR13czB/f
A12	0 bytes	P9j0pR13czB/o
A13	1002 bytes	PROJECT
A14	383 bytes	PROJECTwm
A15	2908 bytes	VBA/BvoU_c7Ys
A16	1810 bytes	VBA/HvpquuIW
A17	4817 bytes	VBA/I4wD_HI0_G2U_kKEF
A18	3012 bytes	VBA/OxRR1_I6sg_Z59
A19	2699 bytes	VBA/P9j0pR13czB
A20	991 bytes	VBA/Sheet1
A21	1553 bytes	VBA/ThisWorkbook
A22	8671 bytes	VBA/_VBA_PROJECT
A23	2882 bytes	VBA/__SRP_0
A24	302 bytes	VBA/__SRP_1
A25	269 bytes	VBA/__SRP_2
A26	298 bytes	VBA/__SRP_3
A27	214 bytes	VBA/__SRP_4
A28	206 bytes	VBA/__SRP_5
A29	170 bytes	VBA/__SRP_6
A30	156 bytes	VBA/__SRP_7
A31	171 bytes	VBA/__SRP_8
A32	170 bytes	VBA/__SRP_9
A33	3568 bytes	VBA/cmPYJ_CUB_wGP_mQi
A34	6170 bytes	VBA/dfo7CWOKcO0ywO
A35	1300 bytes	VBA/dir
A36	1594 bytes	VBA/hRzKk_Jvx
A37	97 bytes	cmPYJ_CUB_wGP_mQi/CompObj
A38	273 bytes	cmPYJ_CUB_wGP_mQi/VBFrame
A39	38 bytes	cmPYJ_CUB_wGP_mQi/f
A40	0 bytes	cmPYJ_CUB_wGP_mQi/o

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	Workbook_Open	Runs when the Excel Workbook is opened
Hex String	VPy6Py6	56507936507936
Hex String	SWd7XvW	53576437587657
Suspicious	Environ	May read system environment variables
Suspicious	Open	May open a file
Suspicious	write	May write to a file (if combined with Open)
Suspicious	Put	May write to a file (if combined with Open)
Suspicious	Binary	May read or write a binary file (if combined with Open)
Suspicious	savetofile	May create a text file
Suspicious	run	May run an executable file or a system command
Suspicious	Create	May execute file or a system command through WMI
Suspicious	ShowWindow	May hide the application
Suspicious	GetObject	May get an OLE object with a running instance
Suspicious	Windows	May enumerate application windows (if combined with Shell.Application object)
Suspicious	Chr	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	ChrW	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	Xor	May attempt to obfuscate specific strings (use option --deobf to deobfuscate)
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Reports #176.xlsm

Verdict:

Malicious activity

Analysis date:

2021-02-24 21:59:31 UTC

Tags:

macros macros-on-open

Link:

https://app.any.run/tasks/37d99ec3-dac0-42d4-aa96-e0dae1a648b1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

File type:

application/vnd.ms-excel.sheet.macroEnabled.12

Has a screenshot:

False

Contains macros:

True

Detection(s):

TwinWave.EvilDoc.FuncProcessAGoGo.20200805.UNOFFICIAL

TwinWave.EvilDoc.WithGObjComingBackToLife.20201124.UNOFFICIAL

TwinWave.EvilDoc.WelcomeBackEmotetThatsWhyTheyCallItWindowPain.2020717.UNOFFICIAL

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% directory

Using the Windows Management Instrumentation requests

Launching a process

Creating a process with a hidden window

DNS request

Sending a custom TCP request

Result

Verdict:

Malicious

File Type:

Excel File with Macro

Link:

https://app.docguard.net/03ceb725e997c085e3cb226c4bdc43114fa9a7dfdbd7fe59a538b8d0206fec61/results/dashboard

Payload URLs

URL

File name

https://hashmiricemills.com.pk/prettyPhoto/images/default/default/OAca11pvIrMc.php',

vbaProject.bin

Document image

Image:

Download PNG

Result

Verdict:

MALICIOUS

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro Execution Coercion

Detected a document that appears to social engineer the user into activating embedded logic.

Document With Minimal Content

Document contains less than 1 kilobyte of semantic information.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

expl.evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/617890

Signature

Antivirus detection for URL or domain

Creates processes via WMI

Document contains an embedded macro with GUI obfuscation

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/03ceb725e997c085e3cb226c4bdc43114fa9a7dfdbd7fe59a538b8d0206fec61/

Threat name:

Document-Word.Trojan.Heuristic

Status:

Malicious

First seen:

2021-02-24 15:08:31 UTC

AV detection:

14 of 47 (29.79%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=aphlojpjs7aily6lejwexxcdcfh2tj673pl74wnfhc4naidp5rqq._file

Result

Malware family:

dridex

Score:

10/10

Tags:

family:dridex botnet:111 botnet discovery evasion loader macro trojan

Link:

https://tria.ge/reports/210224-7f5237h5se/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Modifies system certificate store

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Enumerates physical storage devices

Checks installed software on the system

Checks whether UAC is enabled

Loads dropped DLL

Blocklisted process makes network request

Dridex Loader

Dridex

Process spawned unexpected child process

Malware Config

C2 Extraction:

209.151.236.42:443
91.121.94.86:8172
5.189.144.136:6516

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Email_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Email in files like avemaria

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	MALWARE_Win_DLLLoader Create hunting rule
Author:	ditekSHen
Description:	Detects unknown DLL Loader

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	SharedStrings Create hunting rule
Author:	Katie Kleemola
Description:	Internal names found in LURK0/CCTV0 samples

Rule name:	UAC_bypass_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	UAC bypass in files like avemaria

Rule name:	win_dridex_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator