The ASEC analysis team discovered that excel files containing the same type of malicious macros are being distributed indiscriminately through emails.
Such excel files contain macros that additionally download malware. Recently, it was found that reply mails targeting random people were added with threatening text and malicious excel macro files.
One feature that the three collected emails share is that they all disguise themselves as reply mails and distribute malicious macro excel files. In the example of Figure 3, the e-mail disguised as a reply to the invitation mail for ‘KINGCA week 2021’ is prompting the viewer to check the mail.
Upon downloading the attached file and opening it, a user can see an excel file that has the same filename as that of the compressed file.
The method of using the Excel 4.0 macro (formula macro) that was introduced previously continues to be found frequently even to this day. Generally, malicious excel files using formula macros have three characteristics, which are as follows.
1) Hidden sheets
2) Macros hidden within sheet with white-colored texts
3) Downloads and runs additional malware from external URLs
The file introduced in this post has all three characteristics, which are made clear upon checking the internal XML file. When the macro is run, it uses the URLDownloadToFileA function to download additional executable files from the URL with the hxxp://[malicious IP]/[designated numbers].dat format. The downloaded files are loaded as DllRegisterSever parameter in rundll32.exe and run.
As the team could not access the URL, the identity of the additionally downloaded malware remains a mystery. However, judging from previous cases, it is likely that the macro would download executable files such as ransomware, BokBot, and QakBot.
Users should not open mails with unknown sources, and also update the anti-malware product to the latest version.
AhnLab’s anti-malware product, V3, detects and blocks the files above using the aliases below.
[File Detection]
Downloader/XLS.XlmMacro
Downloader/XLS.Generic
[IoC]
Hash
e53c6b9d4d5f536a7ac2a2bd3f67e4a5
9533108a07c61ab8e743c68cac25f85e
396971293048dd203c3aa05f55c49e4f
Malicious URLs
hxxp://190.14.38[.]118/44342.2224001157.dat
hxxp://45.138.157[.]157/44342.2224001157.dat
hxxp://176.31.87[.]211/44342.2224001157.dat
hxxp://188.119.113[.]227/44342.4386916667.dat
hxxp://2.56.244[.]8/44342.4386916667.dat
hxxp://185.141.26[.]131/44342.4386916667.dat
Categories:Malware Information