MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c3c6bbc7a17f82520d093369374ab9b15cfdbb8b5451f976fc5939670cbf257. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DarkComet


Vendor detections: 9


Maldoc score: 23


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c3c6bbc7a17f82520d093369374ab9b15cfdbb8b5451f976fc5939670cbf257
SHA3-384 hash: 8c6fe5b97aafca7259007f043a801b4d5301331f9e9255ffa9ebb7215917280a3699b038a648fa037e26e59dcb962432
SHA1 hash: b7dc8f7d695418dcfdd28cc832af4c84e2b3bc00
MD5 hash: 13d4e72a61618efcff3e6cb35cadd71a
humanhash: sink-mango-september-pluto
File name:Zahlung.swift.xls
Download: download sample
Signature DarkComet
Create hunting rule
File size:275'456 bytes
First seen:2021-10-05 11:01:38 UTC
Last seen:2021-10-05 12:06:18 UTC
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 6144:lxEtjPOtioVjDGUU1qfDlavx+W2QnA9bYBj0MU9Gu2TyAOXqvyG1ewWkHqGCFbmu:rYV0MU9GuQOaaGww+GCFbYO
TLSH T13044D05271A8F896D90A13320DEACAE52636FC508D5AD7173589BB7E2F337E285013DC
Reporter pr0xylife
Tags:DarkComet xls

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 23
OLE dump

MalwareBazaar was able to identify 16 sections in this file using oledump:

Section IDSection sizeSection name
1107 bytesCompObj
2244 bytesDocumentSummaryInformation
3264 bytesSummaryInformation
4229529 bytesWorkbook
5524 bytes_VBA_PROJECT_CUR/PROJECT
6104 bytes_VBA_PROJECT_CUR/PROJECTwm
7985 bytes_VBA_PROJECT_CUR/VBA/Sheet1
8985 bytes_VBA_PROJECT_CUR/VBA/Sheet2
9985 bytes_VBA_PROJECT_CUR/VBA/Sheet3
1018167 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
117300 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
123942 bytes_VBA_PROJECT_CUR/VBA/__SRP_0
13477 bytes_VBA_PROJECT_CUR/VBA/__SRP_1
141064 bytes_VBA_PROJECT_CUR/VBA/__SRP_2
152014 bytes_VBA_PROJECT_CUR/VBA/__SRP_3
16559 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecWorkbook_OpenRuns when the Excel Workbook is opened
IOCwinmm.dllExecutable file name
IOCshell32.dllExecutable file name code and P-code are different, this may have been used to hide malicious code
SuspiciousEnvironMay read system environment variables
SuspiciousopenMay open a file
SuspiciousvbNormalFocusMay run an executable file or a system command
SuspiciousShellExecuteAMay run an executable file or a system command
Suspiciousshell32May run an executable file or a system command
SuspiciousLibMay run code from a DLL
SuspiciousURLDownloadToFileAMay download files from the Internet
SuspiciousChrMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousStrReverseMay attempt to obfuscate specific strings (use option --deobf to deobfuscate)
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
3
# of downloads :
825
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Zahlung.swift.xls
Verdict:
No threats detected
Analysis date:
2021-10-05 12:05:10 UTC
Tags:
macros macros-on-open
Link:
https://app.any.run/tasks/7c9c10d3-ce34-4a97-ba18-fba30b5edb6d

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Legit
File type:
application/vnd.ms-excel
Has a screenshot:
False
Contains macros:
True
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/194991/
Detection(s):
TwinWave.EvilDoc.URLDownloaderSuperStar.20200510.UNOFFICIAL
Create hunting rule

TwinWave.EvilDocs.FuncStacksJustWannaHaveFUN.20210129.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DidntIBlowYourMindThisTime.20210922.UNOFFICIAL
Create hunting rule

Sanesecurity.Badmacro.Doc.ShellExe.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/9c3c6bbc7a17f82520d093369374ab9b15cfdbb8b5451f976fc5939670cbf257/results/dashboard
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
75%
Tags:
evasive macros macros-on-open
Link:
https://www.filescan.io/uploads/615c3288e3d213d202b7750b/reports/7cfdbe1c-703f-4667-aab2-736db73f90d2/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/9c3c6bbc7a17f82520d093369374ab9b15cfdbb8b5451f976fc5939670cbf257
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Macro Contains Suspicious String
Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...
Macro with DLL Reference
Detected macro logic that will load additional functionality from Dynamically Linked Libraries (DLLs). While not explicitly malicious, this is a common tactic for accessing APIs that are not otherwised exposed via Visual Basic for Applications (VBA).
Document With Minimal Content
Document contains less than 1 kilobyte of semantic information.
Result
Threat name:
DarkComet
Create hunting rule
Detection:
malicious
Classification:
expl.evad.troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/864698
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Creates files in alternative data streams (ADS)
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document contains an embedded VBA with hexadecimal encoded strings
Document contains VBA stomped code (only p-code) potentially bypassing AV detection
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Document exploit detected (process start blacklist hit)
Document exploit detected (UrlDownloadToFile)
Found malware configuration
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Office process drops PE file
Sigma detected: MS Office Product Spawning Exe in User Dir
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected DarkComet
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 497126 Sample: Zahlung.swift.xls Startdate: 05/10/2021 Architecture: WINDOWS Score: 100 78 Found malware configuration 2->78 80 Malicious sample detected (through community Yara rule) 2->80 82 Antivirus detection for dropped file 2->82 84 14 other signatures 2->84 9 EXCEL.EXE 24 31 2->9         started        14 cssrr.exe 2->14         started        16 cssrr.exe 3 2->16         started        18 cssrr.exe 2->18         started        process3 dnsIp4 74 js-hurling.com 192.185.113.96, 443, 49728 UNIFIEDLAYER-AS-1US United States 9->74 76 www.js-hurling.com 9->76 66 C:\Users\user\AppData\Roaming\cuer.exe, PE32 9->66 dropped 68 C:\...\aeopmguywjffmigwnfbefrvgqg[1].exe, PE32 9->68 dropped 100 Document exploit detected (creates forbidden files) 9->100 102 Document exploit detected (UrlDownloadToFile) 9->102 20 cuer.exe 8 9->20         started        104 Injects a PE file into a foreign processes 14->104 24 cmd.exe 14->24         started        26 cssrr.exe 14->26         started        38 2 other processes 14->38 28 cmd.exe 1 16->28         started        30 cssrr.exe 16->30         started        32 cssrr.exe 16->32         started        34 cmd.exe 18->34         started        36 cssrr.exe 18->36         started        file5 signatures6 process7 file8 62 C:\Users\user\AppData\Roaming\...\cssrr.exe, PE32 20->62 dropped 86 Antivirus detection for dropped file 20->86 88 Machine Learning detection for dropped file 20->88 40 cssrr.exe 2 4 20->40         started        43 cmd.exe 2 20->43         started        64 C:\Users\user\...\cssrr.exe:ZONE.identifier, ASCII 24->64 dropped 46 conhost.exe 24->46         started        48 conhost.exe 28->48         started        50 conhost.exe 34->50         started        signatures9 process10 file11 92 Antivirus detection for dropped file 40->92 94 Machine Learning detection for dropped file 40->94 96 Injects a PE file into a foreign processes 40->96 52 cssrr.exe 3 40->52         started        56 cmd.exe 1 40->56         started        70 C:\Users\user\...\cuer.exe:ZONE.identifier, ASCII 43->70 dropped 98 Creates files in alternative data streams (ADS) 43->98 58 conhost.exe 43->58         started        signatures12 process13 dnsIp14 72 sommerishere.sytes.net 212.192.246.92, 1678, 49752 RHC-HOSTINGGB Russian Federation 52->72 90 Installs a global keyboard hook 52->90 60 conhost.exe 56->60         started        signatures15 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c3c6bbc7a17f82520d093369374ab9b15cfdbb8b5451f976fc5939670cbf257/
Threat name:
Script.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-10-05 11:02:06 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tq6gxpd2c74ckigqsm3jg5fltmk47w5ywvcr7f3pywjzm4gl6jlq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
macro macro_on_action
Link:
https://tria.ge/reports/211005-m45phahfc9/
Behaviour
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Office loads VBA resources, possible macro or embedded object present
Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/9c3c6bbc7a17/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c3c6bbc7a17f82520d093369374ab9b15cfdbb8b5451f976fc5939670cbf257

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/194991/

Comments