Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
25-11-2021 16:58
Static task
static1
Behavioral task
behavioral1
Sample
REMITTANCE ADVICE.xlsx
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
REMITTANCE ADVICE.xlsx
Resource
win10-en-20211104
General
-
Target
REMITTANCE ADVICE.xlsx
-
Size
228KB
-
MD5
2caab2292b282e6a5dea1cf78f84924a
-
SHA1
86f37c31091b15cca135490a84eb52027bb1a4df
-
SHA256
4c84124c87cd46ce58a7a8208ad1674c4a270793f9a6158e80fd28f96b3cc844
-
SHA512
70590f55c98c31fb7b2a95cb6d6b63917e1fa0f868c3af852a805d45cbb176356a4b1dc1431ef908c680821730d0d02948956c03388fcee6fcf6bbd661d55733
Malware Config
Extracted
xloader
2.5
m07f
http://www.ff4cu6twc.xyz/m07f/
khitthit.club
kczu.net
caylalamar.com
iixiazai.com
nickatwoodrealestate.com
006664.com
strimsbdltd.com
mykyhouse.com
flyestkicks.com
campingwithoutcanvas.com
sarishamisen.com
retrorecycling.com
zw4azsjb3cuj.biz
lokasennaservices.com
charleswagner.xyz
smmbazar.net
rebornmkt.com
clicktoreach.com
alendigital.xyz
carehrc.com
locationdevice.online
homevoru.com
electrahealth.clinic
punto-linea-espacio.com
yhxt13800.com
pancakeshares.com
artdecooutdoor.com
phg-formation.com
businessagilitysessions.com
procofun.com
thekatz.group
casepoo.com
tokofebri.store
crippledom.com
online-shrine-ltd.com
jesbon.com
ligoom.com
odonofally.quest
tender.guru
payments-gate-325r.xyz
bfcmtld.com
scoocs.info
welderstexas.com
eastendfinances.com
bohoglamburlesque.com
naijafame.net
digitallghtning.com
refreshpor.xyz
luly-boo.com
enchantedroses-shop.com
victorrialand.com
kenzivenum.com
protokolavukatlik.com
berrymojito.com
empireexteriorservices.com
pushaoeel-kouhu-bunan7266.com
travellerbugs.com
allcources.com
jaszicurls.com
rem-youth.com
strawberryroom-15.com
paramusinsurancebroker.com
jhtz001.com
promtgloan.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-67-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1704-68-0x000000000041D430-mapping.dmp xloader behavioral1/memory/988-78-0x0000000000110000-0x0000000000139000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
EQNEDT32.EXEflow pid process 4 1112 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
vbc.exevbc.exepid process 1824 vbc.exe 1704 vbc.exe -
Loads dropped DLL 4 IoCs
Processes:
EQNEDT32.EXEvbc.exepid process 1112 EQNEDT32.EXE 1112 EQNEDT32.EXE 1112 EQNEDT32.EXE 1824 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exerundll32.exedescription pid process target process PID 1824 set thread context of 1704 1824 vbc.exe vbc.exe PID 1704 set thread context of 1380 1704 vbc.exe Explorer.EXE PID 988 set thread context of 1380 988 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 12 IoCs
Processes:
resource yara_rule \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 \Users\Public\vbc.exe nsis_installer_1 \Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 C:\Users\Public\vbc.exe nsis_installer_1 C:\Users\Public\vbc.exe nsis_installer_2 -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1664 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
vbc.exerundll32.exepid process 1704 vbc.exe 1704 vbc.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe 988 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exerundll32.exepid process 1704 vbc.exe 1704 vbc.exe 1704 vbc.exe 988 rundll32.exe 988 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
vbc.exeExplorer.EXErundll32.exedescription pid process Token: SeDebugPrivilege 1704 vbc.exe Token: SeShutdownPrivilege 1380 Explorer.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE Token: SeDebugPrivilege 988 rundll32.exe Token: SeShutdownPrivilege 1380 Explorer.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE Token: SeShutdownPrivilege 1380 Explorer.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 1664 EXCEL.EXE 1664 EXCEL.EXE 1664 EXCEL.EXE 1664 EXCEL.EXE 1664 EXCEL.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
EQNEDT32.EXEvbc.exeExplorer.EXErundll32.exedescription pid process target process PID 1112 wrote to memory of 1824 1112 EQNEDT32.EXE vbc.exe PID 1112 wrote to memory of 1824 1112 EQNEDT32.EXE vbc.exe PID 1112 wrote to memory of 1824 1112 EQNEDT32.EXE vbc.exe PID 1112 wrote to memory of 1824 1112 EQNEDT32.EXE vbc.exe PID 1824 wrote to memory of 1704 1824 vbc.exe vbc.exe PID 1824 wrote to memory of 1704 1824 vbc.exe vbc.exe PID 1824 wrote to memory of 1704 1824 vbc.exe vbc.exe PID 1824 wrote to memory of 1704 1824 vbc.exe vbc.exe PID 1824 wrote to memory of 1704 1824 vbc.exe vbc.exe PID 1824 wrote to memory of 1704 1824 vbc.exe vbc.exe PID 1824 wrote to memory of 1704 1824 vbc.exe vbc.exe PID 1380 wrote to memory of 988 1380 Explorer.EXE rundll32.exe PID 1380 wrote to memory of 988 1380 Explorer.EXE rundll32.exe PID 1380 wrote to memory of 988 1380 Explorer.EXE rundll32.exe PID 1380 wrote to memory of 988 1380 Explorer.EXE rundll32.exe PID 1380 wrote to memory of 988 1380 Explorer.EXE rundll32.exe PID 1380 wrote to memory of 988 1380 Explorer.EXE rundll32.exe PID 1380 wrote to memory of 988 1380 Explorer.EXE rundll32.exe PID 988 wrote to memory of 1732 988 rundll32.exe cmd.exe PID 988 wrote to memory of 1732 988 rundll32.exe cmd.exe PID 988 wrote to memory of 1732 988 rundll32.exe cmd.exe PID 988 wrote to memory of 1732 988 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\REMITTANCE ADVICE.xlsx"2⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Public\vbc.exe"3⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\vbc.exe"C:\Users\Public\vbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\vbc.exeMD5
1624595e2354ff7be9e7dc6def2ed69e
SHA11dcfaae594e3690d3fef5fd4de855d02e9cbb2a5
SHA2564b50745e74fea6faa516b4d46b7c9fbe36fdae2301b76ec940635d033707a2c8
SHA512aebd6e6d28ecab56e48b037836c2ffc573a8493b576ea3b59ac6932c6e782fc99ad1da7a67a231830a2c4612c89e24f0e7f483d24080f29d6133d81c7207971e
-
C:\Users\Public\vbc.exeMD5
1624595e2354ff7be9e7dc6def2ed69e
SHA11dcfaae594e3690d3fef5fd4de855d02e9cbb2a5
SHA2564b50745e74fea6faa516b4d46b7c9fbe36fdae2301b76ec940635d033707a2c8
SHA512aebd6e6d28ecab56e48b037836c2ffc573a8493b576ea3b59ac6932c6e782fc99ad1da7a67a231830a2c4612c89e24f0e7f483d24080f29d6133d81c7207971e
-
C:\Users\Public\vbc.exeMD5
1624595e2354ff7be9e7dc6def2ed69e
SHA11dcfaae594e3690d3fef5fd4de855d02e9cbb2a5
SHA2564b50745e74fea6faa516b4d46b7c9fbe36fdae2301b76ec940635d033707a2c8
SHA512aebd6e6d28ecab56e48b037836c2ffc573a8493b576ea3b59ac6932c6e782fc99ad1da7a67a231830a2c4612c89e24f0e7f483d24080f29d6133d81c7207971e
-
\Users\Admin\AppData\Local\Temp\nsd3DCC.tmp\otav.dllMD5
a55ce7f1cf8df8b06a15140a3e9e3f9b
SHA15f787501f1d8b2a93d1df6d5c91cde0dd2ba14ce
SHA256b6a12bc611f92d3d793ce5c3c9cff8a906ca96bd6b1d5c0da8ebf9080ff4428a
SHA512544823425ee681acf6fa08ceb4a64840a16317573f2d6b6c6e4559199164d92c3f599521aea245340cc6c756ed808c1f4e2c131239bfdc67ee9ae376aef8ba4d
-
\Users\Public\vbc.exeMD5
1624595e2354ff7be9e7dc6def2ed69e
SHA11dcfaae594e3690d3fef5fd4de855d02e9cbb2a5
SHA2564b50745e74fea6faa516b4d46b7c9fbe36fdae2301b76ec940635d033707a2c8
SHA512aebd6e6d28ecab56e48b037836c2ffc573a8493b576ea3b59ac6932c6e782fc99ad1da7a67a231830a2c4612c89e24f0e7f483d24080f29d6133d81c7207971e
-
\Users\Public\vbc.exeMD5
1624595e2354ff7be9e7dc6def2ed69e
SHA11dcfaae594e3690d3fef5fd4de855d02e9cbb2a5
SHA2564b50745e74fea6faa516b4d46b7c9fbe36fdae2301b76ec940635d033707a2c8
SHA512aebd6e6d28ecab56e48b037836c2ffc573a8493b576ea3b59ac6932c6e782fc99ad1da7a67a231830a2c4612c89e24f0e7f483d24080f29d6133d81c7207971e
-
\Users\Public\vbc.exeMD5
1624595e2354ff7be9e7dc6def2ed69e
SHA11dcfaae594e3690d3fef5fd4de855d02e9cbb2a5
SHA2564b50745e74fea6faa516b4d46b7c9fbe36fdae2301b76ec940635d033707a2c8
SHA512aebd6e6d28ecab56e48b037836c2ffc573a8493b576ea3b59ac6932c6e782fc99ad1da7a67a231830a2c4612c89e24f0e7f483d24080f29d6133d81c7207971e
-
memory/988-80-0x00000000003B0000-0x0000000000440000-memory.dmpFilesize
576KB
-
memory/988-77-0x00000000003A0000-0x00000000003AE000-memory.dmpFilesize
56KB
-
memory/988-79-0x0000000002250000-0x0000000002553000-memory.dmpFilesize
3.0MB
-
memory/988-74-0x0000000000000000-mapping.dmp
-
memory/988-78-0x0000000000110000-0x0000000000139000-memory.dmpFilesize
164KB
-
memory/1112-58-0x00000000762D1000-0x00000000762D3000-memory.dmpFilesize
8KB
-
memory/1380-81-0x0000000008C20000-0x0000000008D6D000-memory.dmpFilesize
1.3MB
-
memory/1380-73-0x0000000006590000-0x0000000006663000-memory.dmpFilesize
844KB
-
memory/1664-57-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1664-55-0x000000002F441000-0x000000002F444000-memory.dmpFilesize
12KB
-
memory/1664-56-0x0000000071821000-0x0000000071823000-memory.dmpFilesize
8KB
-
memory/1664-82-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1704-68-0x000000000041D430-mapping.dmp
-
memory/1704-71-0x0000000000820000-0x0000000000B23000-memory.dmpFilesize
3.0MB
-
memory/1704-72-0x00000000002C0000-0x00000000002D1000-memory.dmpFilesize
68KB
-
memory/1704-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1732-76-0x0000000000000000-mapping.dmp
-
memory/1824-62-0x0000000000000000-mapping.dmp