SOC Malware Analysis – Excel 4.0 (XLM) Macro Abuse via Static Analysis (LetsDefend Challenge)

Описание: In this LetsDefend malware challenge, I analyse a malicious Excel document abusing legacy Excel 4.0 (XLM) macros, using static analysis only.

Normally, tools like XLMMacroDeobfuscator would be used for this type of sample. However, in the LetsDefend lab environment the tool fails during formula resolution. Instead, this investigation demonstrates how to recover all required answers manually, without executing the document and without relying on external deobfuscation tools.

File analysed:
research-1646684671.xls

Summary:

Legacy Excel document confirmed to support Excel 4.0 macros

OLE inspection revealed the presence of the Book stream

File converted safely to XLSX format to extract defined macro names

Auto_Open macro entry point identified

Macro execution starts from cell Doc4!BA7

Raw macro formulas extracted from the Book stream

EXEC function usage identified

DLL references observed, indicating LOLBAS-based execution

regsvr32.exe identified as the most likely execution binary

Full analysis completed using static techniques only

Commands used during analysis:

olefile research-1646684671.xls

soffice --headless --convert-to xlsx research-1646684671.xls --outdir .

unzip -p research-1646684671.xlsx xl/workbook.xml


python3 - 'PY'
import olefile
fn="research-1646684671.xls"
ole = olefile.OleFileIO(fn)
open("Book.bin","wb").write(ole.openstream("Book").read())
print("Book extracted")
PY

strings -n 3 Book.bin | grep -i exec

strings -n 3 Book.bin | grep -Ei '\.dll\b' | sort -u


This video demonstrates how Excel 4.0 macro malware can be analysed safely using static techniques, even when automated tooling fails.

For educational and defensive security purposes only.

#SOC
#LetsDefend
#MalwareAnalysis
#ExcelMacros
#XLM
#BlueTeam