MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e66c639f157fa066c2e4070a46cb0af32548f4fba63684120513433059cd26d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 10


Maldoc score: 11


Intelligence 10 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e66c639f157fa066c2e4070a46cb0af32548f4fba63684120513433059cd26d
SHA3-384 hash: 1ab244e22e37c95a5dce1ed29247cd5f4d137e02b673529dbf5de0ccb66ce8723f8a1af3f2ece7dbd5472bae1f2c0963
SHA1 hash: f38cd18659e0fb5d862bac1d9f24691dda4a292c
MD5 hash: 032734a3c93c44855955d4769b7ded98
humanhash: texas-orange-green-friend
File name:INV8222874744_20210111490395.xlsm
Download: download sample
Signature Dridex
Create hunting rule
File size:42'241 bytes
First seen:2021-01-12 06:14:39 UTC
Last seen:2021-02-19 19:25:36 UTC
File type:Excel file xlsm
MIME type:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep 768:wT1rKsMOiiWLB7m7dMEuiJD/IxuKLh5XKZ0hVqu8:KVMOkLB7m7hh/Ix5LvaZMqu8
TLSH 8213E12EB501F816C23A49FAD02410F35B4E7161F146E68F1C90BE8E1A556EB538EBBD
Reporter cocaman
Tags:Dridex xlsm


Avatar
cocaman
Malicious email (T1566.001)
From: "<customerservice@freightquote.com>" (likely spoofed)
Received: "from exchange.millepiedi.net (unknown [93.145.111.74]) "
Date: "Tue, 12 Jan 2021 00:56:15 +0100"
Subject: "Freightquote Invoice"
Attachment: "INV8222874744_20210111490395.xlsm"

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 11
OLE dump

MalwareBazaar was able to identify 23 sections in this file using oledump:

Section IDSection sizeSection name
A1550 bytesPROJECT
A286 bytesPROJECTwm
A33200 bytesVBA/Module1
A41627 bytesVBA/Sheet1
A5999 bytesVBA/ThisWorkbook
A63568 bytesVBA/_VBA_PROJECT
A72060 bytesVBA/__SRP_0
A8187 bytesVBA/__SRP_1
A9363 bytesVBA/__SRP_2
A10398 bytesVBA/__SRP_3
A11820 bytesVBA/dir
B1115 bytesCompObj
B2178 bytesf
B3110 bytesi02/CompObj
B440 bytesi02/f
B50 bytesi02/o
B6110 bytesi03/CompObj
B740 bytesi03/f
B80 bytesi03/o
B9152 byteso
B1048 bytesx
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecview_1_a_LayoutRuns when the file is opened and ActiveX objects trigger events
SuspiciousRunMay run an executable file or a system command
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousXLM macrosheetXLM macrosheet found. It could contain malicious code

Intelligence

File Origin
# of uploads :
448
# of downloads :
123
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
INV8222874744_20210111490395.xlsm
Verdict:
Malicious activity
Analysis date:
2021-01-12 06:19:36 UTC
Tags:
macros macros-on-open macros40 trojan banker dridex
Link:
https://app.any.run/tasks/154dca17-441f-4a13-9fc0-8d57ac4eada0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
File type:
application/vnd.ms-excel.sheet.macroEnabled.12
Has a screenshot:
False
Contains macros:
True
Detection(s):
TwinWave.EvilDoc.DridexLivingInTheDaysOfThunder.2021011.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.Xls.Split1.UNOFFICIAL
Create hunting rule

Sanesecurity.Rogue.0hr.20210111-2006.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
DNS request
Creating a process with a hidden window
Sending an HTTP GET request
Launching a process by exploiting the app vulnerability
Result
Verdict:
Malicious
File Type:
OOXML Excel File with Excel4Macro
Link:
https://app.docguard.net/1e66c639f157fa066c2e4070a46cb0af32548f4fba63684120513433059cd26d/results/dashboard
Result
Verdict:
MALICIOUS
Result
Threat name:
Hidden Macro 4.0 Dridex
Create hunting rule
Detection:
malicious
Classification:
bank.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/578622
Signature
Detected Dridex e-Banking trojan
Document contains an embedded VBA macro which may execute processes
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Found Excel 4.0 Macro with suspicious formulas
Found malware configuration
Machine Learning detection for dropped file
Multi AV Scanner detection for submitted file
Office process drops PE file
Sigma detected: BlueMashroom DLL Load
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: Regsvr32 Anomaly
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e66c639f157fa066c2e4070a46cb0af32548f4fba63684120513433059cd26d/
Threat name:
Script-Macro.Trojan.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-01-11 22:25:12 UTC
File Type:
Document
Extracted files:
48
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dztmmoprk75am3boibyki3fqv4zfjd2pxjrwqqjake2dgbm42jwq._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
macro
Link:
https://tria.ge/reports/210112-r4n95er6e6/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Office loads VBA resources, possible macro or embedded object present
Process spawned suspicious child process
Process spawned unexpected child process
Malware Config
Dropper Extraction:
https://intranet.iep-lacatolica.pe/gwrrsdtg.zip
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1e66c639f157fa066c2e4070a46cb0af32548f4fba63684120513433059cd26d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_Dridex_xlsm_20200528_2
Create hunting rule
Author:abuse.ch
Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:Microsoft_XLSX_with_Macrosheet
Create hunting rule
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:SharedStrings
Create hunting rule
Author:Katie Kleemola
Description:Internal names found in LURK0/CCTV0 samples
Rule name:UAC_bypass_bin_mem
Create hunting rule
Author:James_inthe_box
Description:UAC bypass in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Dridex

Excel file xlsm 1e66c639f157fa066c2e4070a46cb0af32548f4fba63684120513433059cd26d

(this sample)

  
Delivery method
Distributed via e-mail attachment
  
Dropping
Dridex

Comments