Fake SpaceX Starbase Invite Excel document found distributing Dridex

The SonicWall Capture Labs Threat Research Team has observed that a fake Space Starbase Invite is being circulated over email with a malicious excel document as an attachment. On opening the attachment, it will execute VBA macro code to infect the system with Dridex malware.

Infection Cycle

Upon opening the attachment, the user is displayed instructions to enable content as shown below:

Fig-1: Excel File

The malicious excel file has obfuscated macro and a workbook_open method, which gets executed upon opening the document. The VBA Macro drops an XSL file into %appdata%\<random>.xsl.  The dropped XSL is then executed by passing it as an argument to WMIC (Windows Management Instrumentation Command-line utility).

Fig-2: VBA Macro creating XSL file

XSL file

XSL files are style sheets to process data in XLM files which also supports script embedding and execution. This old technique has been assigned Mitre ATT &CK ID: T1220.

The XSL file contains JScript code to download and execute the payload. The payload takes "validateLog" as an argument as shown below:

Fig-3: Contents of XSL file

SonicWall Capture ATP protects against this threat as shown below:

Fig-4: Capture ATP report

Indicators of Compromise

SHA256 of malicious excel files:

• 21bf810cf015e8ffec9b844632a94274d9d387ad528e7d75adf116acea5a4d4b
• 2355f05bca712ce31b1fef911395862eb34e73db7a3ca0a6bee2664024e47518
• 376dad0f953db87ebfa71edb5173d4d8226c242d257a40cc9359f4d53b850aff
• 466e4c5fe6b3c05ff34e487a0ba0910c1dc53b1c41ef1c27a779379bd2c9534d
• 4d8ae33f7f5e41d9b3c3109daf043f5a803c639a68a697838bdcd17135c03730
• 55a258190c8461b2aec9e698edb85297f2c850de44e6659529b00a0af7c98fe6
• a5bc04a9b80ebb1b62367b8fec7463da3b0d096bc99c798f7ecf1f048580729c
• af686418e437e9dca34e08381e3dc8e5f3aa06a458e610d9095ce2eb0a00ebc4
• c83e3d04d0807dbb1144f776ab144e9b85c94b0c0e8ca05f78664e6e46f621cd
• ee3755902532f4636d3a8a86de2f9bc13ae235a9220f97a8862d82bc52599066

Network Connections:

• https://new[.]bombill[.]com/B2B/js/public_html/new[.]bombill[.]com/kML98YVm1[.]php
• https://mishpachton[.]club/wp-content/uploads/2020/01/sULnmh1mel6Ha[.]php
• https://hotelmarissa[.]ro/hms/highslide/graphics/outlines/aKBRsNGhkJnFy[.]php
• https://lekkievents[.]com/RcjJztqmB3CJ[.]php
• https://slasinfo[.]com/wp-content/plugins/better-wp-security/core/Z3w9lRfmiUeqn[.]php
• https://turktech[.]co[.]uk/wp-content/uploads/2020/01/XBKtCe6h[.]php
• https://marcosindiagroup[.]com/wp-content/uploads/elementor/css/Y1KA13a0oHq0vv[.]php
• https://drakarys[.]rs/img/icons/tabs/xTPpiyC3[.]php
• https://jettyplus[.]com/wp-includes/sodium_compat/namespaced/Core/n95mTqnEYm2lEqF[.]php
• https://desertkingresort[.]com/wp-includes/js/mediaelement/renderers/Qh3RRz2g[.]php
• https://elivebox[.]net/school/bower_components/chosen/docsupport/7Il9rC5wQ[.]php
• https://eletronicaeduardo[.]com[.]br/www3/sistema/application/config/ANBPUKvb49gQn[.]php
• https://mail[.]beetleorchid[.]in//i07uqfyKKQ3jUN8[.]php
• https://nationalngofederation[.]com/wp-includes/SimplePie/Decode/HTML/CQiRG6YtYGt[.]php
• https://leer-afrikaans[.]co[.]za/5TdZj0lfsvo[.]php
• https://mail[.]account[.]inventorybiz[.]com//X70ySsjm2[.]php
• https://elkytoursandtravel[.]com/wp-includes/SimplePie/Decode/HTML/i06d5d4XcypWc[.]php
• https://drlamyas[.]net/wp-content/plugins/LayerSlider/classes/gt45kDacR6[.]php
• https://one2onematch[.]net/back_up/under/fonts/Montserrat/kDCn9x8aeY8jz[.]php
• https://centrodetraduccionespuce[.]com/intranet_old/css/vendor/square/risWzMrGzRtO4bS[.]php
• https://askcon[.]net/wp-includes/SimplePie/Content/Type/0lOzUuHLScUH[.]php
• https://crm[.]sgdatapos[.]com/modules/goals/language/bulgarian/vdOwNUr2yXh[.]php
• https://lweonepal[.]com/wp-content/cache/object/013/bFPs28xfQyOe[.]php
• https://triplonet[.]com[.]br/__MACOSX/wp-includes/js/codemirror/3Uqzx5RTyl8pT[.]php
• https://casagrandecontabil[.]com[.]br/vo/vfm-admin/images/avatars/1Wu2EdUfRb3q7Zu[.]php
• https://ppdb[.]smp1sbw[.]sch[.]id/ro-plugins/ckeditor/skins/moono-lisa/767884gnQIu[.]php
• https://blog[.]garantitorna[.]com/wp-includes/css/dist/block-directory/j9nCiyCAcJQDh3[.]php
• https://dikan[.]co[.]za/wsz2SCI6sU6k6o[.]php
• https://elearn[.]empoweredmw[.]com/lib/minify/matthiasmullie-minify/data/WD3Uawo4EEZ[.]php
• https://equiposautomotriz[.]com/wp-includes/Requests/Exception/HTTP/U997eIiQSqs3[.]php
• https://familystory[.]es/wp-content/uploads/2021/01/InOm7e9u4vMmW[.]php
• https://fortgem[.]co[.]uk/wp-includes/css/dist/block-directory/Pk57G2yz[.]php
• https://sproca[.]tg/wp-content/themes/agronomics-lite/css/nj6N9LQhADNC[.]php
• https://tarifacabins[.]com/wp-includes/js/mediaelement/renderers/KcsChOSuEV[.]php
• https://gesky[.]co[.]tz/wp-includes/sodium_compat/namespaced/Core/HMJi1PQC[.]php
• https://birkett[.]com[.]au/include/Base/Modules/Filter/KZyRSXJtoC[.]php
• https://dentaldesignstudiowi[.]com/wp-content/uploads/2021/01/9eFsntMZ[.]php

SHA256 of Dridex payload:

• a095a0ec3cd1655bbabad3f3b2e996521444c93dc51f1e78af878bfef3fd3ca8
• c190c5a25b2616a4a0c4965d5f83cc47e47f2d2e4d2cab2c8987dcc29db290a3

Dropped Files:

• %appdata%\<random>.xsl
• C:\windows\Temp\<random>.dll