Threat Research · blog.talosintelligence.com

Threat Actors Increasingly Use Malicious Excel XLL Add-Ins to Deliver Malware

Dec 20, 2022 · Original article ↗

Summary

Cisco Talos traces malicious Excel XLL add-ins from early use in 2017 to wider adoption by APT groups and commodity malware, detailing how they execute code and deliver payloads as VBA macro protections expand.

Key points

XLL files are Windows DLLs that Excel loads as add-ins; functions such as xlAutoOpen can run code when an add-in loads.
Talos found malicious XLL use beginning in 2017, with adoption rising notably from late 2021 as commodity malware families began using the technique.
APT10, TA410, DoNot and FIN7 are among the actors linked to XLLs; observed malware includes Dridex, FormBook, Warzone and Ducktail.
Some XLLs arrive as email attachments or lures and download or load additional malware; Excel-DNA lets developers build .NET-based XLLs.
Talos describes VirusTotal search methods and YARA rules for hunting native and Excel-DNA-based XLL files.
Blocking VBA macros in downloaded Office documents does not prevent XLL-based code execution; Talos recommends its security products and provides applicable Snort SIDs and ClamAV signatures.

Article Details

Attack Vectors: Malicious XLL add-ins are delivered as email attachments; opening an XLL causes Excel to load and execute its code.
XLL add-ins use xlAutoOpen, xlAutoClose, or other exported functions to run code when Excel loads the add-in or handles an event.
FIN7 used XLL email attachments as downloaders for additional components.
A Warzone campaign used an XLL attachment in an email impersonating the Hungarian police.
A Ducktail XLL decoded and decrypted an embedded Base32 data blob, loaded it into Explorer through reflection, then downloaded the stealer payload from Discord.
XLL samples used process injection, including an APT10 sample that injected Anel into svchost.exe.
The article reports that FormBook can record keystrokes, steal locally stored and web-form passwords, and take screenshots.
Defensive Notes: Microsoft began rolling out Office versions that block VBA macros by default in documents marked as downloaded from the internet, but this does not prevent malicious XLL add-ins.
The article warns that users may disregard Excel's warning about potentially malicious XLL code.
Cisco lists endpoint, email, firewall, network analytics, malware analysis, web, and DNS-security products as available protections for the described threat.

Indicators of compromise

Type	Indicator	Context
SHA256	`09271afc6f7ac254b4942a14559a0015fb4893d9bb478844ced2f78c0695929e`	XLL test sample used to launch calc.exe.
SHA256	`55228eec31193a900e8216ab245391f1e40feb742d780caa91fdb1000d8434c2`	FormBook XLL downloader delivered as an email attachment.
SHA256	`7a234d1a2415834290a3a9c7274aadb7253dcfe24edb10b22f1a4a33fd027a08`	FIN7 XLL attachment used as a downloader for the next stage.
SHA256	`90205826eb40d5d4b454c2cfde44abe49f6c3b471681c700e30b45eb5078eee2`	Warzone payload hosted at the URL used by the XLL downloader.
SHA256	`9dd2425c1a40b8899b2a4ac0a85b047bede642c5dfd3b5a2a2f066a853b49e2d`	TA410 process-injection DLL identified as an XLL-stage component.
SHA256	`a5d46912f0767ae30bc169a85c5bcb309d93c3802a2e32e04165fa25740afac1`	APT10-associated XLL sample that injects the Anel backdoor payload into svchost.exe.
SHA256	`d7c3dd8bc55649b2a77dc921e70f5f208946f64aedfdaabd7b02a247669a73aa`	Ducktail XLL downloader containing an encoded and encrypted data blob.
SHA256	`d8286133d3d21b7e2b83a6c071147b8ef993e963ad6bdb0f95d665869557a444`	DoNot-associated DLL named 1.xll, identified as a native-based XLL payload.
SHA256	`f2c5327b7bf88c65d0552d8664aca2ac542c8d37ae19582ba56690f1df420b53`	Dridex XLL downloader.
SHA256	`f5c27b7bdea3861a9414a0dc6b08556ea50423d63297e08eedff69ae9c240cae`	Warzone XLL attachment that downloads the payload.
SHA256	`fdfdfc8878f39424920d469bcd05060a6f7c95794aaa2422941913553d3dd01f`	Meterpreter reverse-shell XLL sample.
URL	`hxxp[:]//172[.]245[.]120[.]8/pdfreader[.]exe`	URL used by the Warzone XLL to download the payload; the article says it hosted Warzone and later AgentTesla and Lokibot samples.