Malicious Macros in Office Documents
Claim_732989680_03292021.xlsm
- Author
- Moise Medici
- Updated
- 25 Oct 2025 · Completed
- Difficulty
- Easy
- Platform
- Languages
- MITRE
MITRE ATT&CK
Execution
Command and Scripting Interpreter
The malicious logic is Excel 4.0 (XLM) macro formulas in the macro sheets
Lof, Lov and Lov2, which Excel evaluates cell by cell, jumping between sheets with GOTO until HALT().Command and Scripting Interpreter: Visual Basic
The VBA
Auto_Open sub in Module1 runs as the workbook opens and calls Application.Run Sheets("Lof").Range("CD5") to start the XLM code.Native API
REGISTER binds URLDownloadToFileA from uRlMon to the name Belandes, so the macro calls the Win32 API directly to fetch each payload.User Execution: Malicious File
Nothing runs until the victim opens the workbook and enables macros;
Auto_Open then fires with no further interaction.Stealth
Obfuscated Files or Information: Command Obfuscation
The URLs only exist once
CONCATENATE joins shared-string cells at runtime, and the download API is called through the meaningless alias Belandes rather than by its name.System Binary Proxy Execution: Rundll32
Each download is run with
rundll32 ..\Hodas.vyur,DllRegisterServer (then Hodas.vyur1 and Hodas.vyur2) through EXEC, so the DLLs load inside the signed rundll32.exe.Hide Artifacts
The three macro sheets are saved with
state="hidden", and in Lof the columns CA to CF holding the formulas are hidden as well, leaving only Sheet visible.Command and Control
Application Layer Protocol: Web Protocols
The payloads are requested over plain HTTP from
45.150.67.234, 45.150.67.232 and 195.123.210.162, with a file name built from the current NOW() value.