Excel 4.0 Macros Analysis - Cobalt Strike Shellcode Injection

How to analyze process injection of Cobalt Strike shellcode using Excel 4.0 macros.

Here I describe how you can analyse a very stealthy technique to execute shellcode via Process Injection from an old-skool Excel Macro technique, known as Excel 4.0 Macros. This seems to be a technique favoured by many APT's and Red Teams given the lack of detection by lots of anti-malware technology. The sample attempts to inject shellcode which transpires to be a Cobalt Strike beacon which uses Domain Fronting to access its C2. The sample was provided by Arti Karahoda, definitely give him a follow: twitter.com/w1zzcap The sample can be obtained from here: app.any.run/tasks/e8db83aa-894a-4196-ab01-23e61a9820b4/ Also, I mention a few resources in the video, as follows: outflank.nl/blog/2018/10/06/old-school-evil-excel-4-0-macros… d13ot9o61jdzpp.cloudfront.net/files/Excel%204.0%20Macro%20Fu… hexacorn.com/blog/2015/12/10/converting-shellcode-to-portabl… Thanks for the sample Arti! Hope you all like the video and the techniques used and hopefully this will help protect you in your own environments. If you liked the video, hit the thumbs up. If you loved it, please subscribe. Find Me: twitter.com/cybercdh colin.guru Thanks! Colin