agenttesla | 2f5b78358322f5fd8c560d8a223282016decea4d3f74f5145283d3f1ec764ebc

Resubmissions

16-03-2022 08:41

220316-klxj3abce2 10

16-03-2022 08:37

220316-kjjv7abca8 8

Analysis

max time kernel
4294180s
max time network
202s
platform
windows7_x64
resource
win7-20220311-en
submitted
16-03-2022 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO 121873.xlsx
Size

713KB
MD5

9f2cf851a66d5ec3520dab2364619890
SHA1

cf6184531e30b05d1e5565d4626441c757240aa5
SHA256

2f5b78358322f5fd8c560d8a223282016decea4d3f74f5145283d3f1ec764ebc
SHA512

1da16064e04dcddd44e49cb4973a407c9502dbbe23d3247322c3114329994799219c7244bd4876bf9f89b1fe3cc7d6366704cb944e30bf56b5b6e6d7bf19230b

Score

10^/10

agenttesla collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
transportescascao.com
Port:
587
Username:
geral@transportescascao.com
Password:
CasMan123*

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Blocklisted process makes network request 1 IoCs

Processes:

EQNEDT32.EXE

flow pid process

3 1072 EQNEDT32.EXE
Downloads MZ/PE file
Executes dropped EXE 3 IoCs

Processes:

binex.exeywpbz.exeywpbz.exe

pid process

1820 binex.exe
2036 ywpbz.exe
1508 ywpbz.exe
Loads dropped DLL 4 IoCs

Processes:

EQNEDT32.EXEbinex.exeywpbz.exe

pid process

1072 EQNEDT32.EXE
1820 binex.exe
1820 binex.exe
2036 ywpbz.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

flow	pid	process
3	1072	EQNEDT32.EXE

pid	process
1820	binex.exe
2036	ywpbz.exe
1508	ywpbz.exe

pid	process
1072	EQNEDT32.EXE
1820	binex.exe
1820	binex.exe
2036	ywpbz.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

ywpbz.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ywpbz.exe
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ywpbz.exe
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ywpbz.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ywpbz.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\ZxoUsb = "C:\\Users\\Admin\\AppData\\Roaming\\ZxoUsb\\ZxoUsb.exe"	ywpbz.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ywpbz.exe

description pid process target process

PID 2036 set thread context of 1508 2036 ywpbz.exe ywpbz.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 2036 set thread context of 1508	2036	ywpbz.exe	ywpbz.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\binex.exe	nsis_installer_1
\Users\Admin\AppData\Roaming\binex.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\binex.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\binex.exe	nsis_installer_2
C:\Users\Admin\AppData\Roaming\binex.exe	nsis_installer_1
C:\Users\Admin\AppData\Roaming\binex.exe	nsis_installer_2

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
exploit

Exploitation for Client Execution
T1203

Processes:

EQNEDT32.EXE

pid process

1072 EQNEDT32.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

pid	process
1072	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2000 EXCEL.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ywpbz.exe

pid process

1508 ywpbz.exe
1508 ywpbz.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ywpbz.exe

description pid process

Token: SeDebugPrivilege 1508 ywpbz.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

EXCEL.EXE

pid process

2000 EXCEL.EXE
2000 EXCEL.EXE
2000 EXCEL.EXE

pid	process
2000	EXCEL.EXE

pid	process
1508	ywpbz.exe
1508	ywpbz.exe

description	pid	process
Token: SeDebugPrivilege	1508	ywpbz.exe

pid	process
2000	EXCEL.EXE
2000	EXCEL.EXE
2000	EXCEL.EXE

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

EQNEDT32.EXEbinex.exeywpbz.exe

description	pid	process	target process
PID 1072 wrote to memory of 1820	1072	EQNEDT32.EXE	binex.exe
PID 1072 wrote to memory of 1820	1072	EQNEDT32.EXE	binex.exe
PID 1072 wrote to memory of 1820	1072	EQNEDT32.EXE	binex.exe
PID 1072 wrote to memory of 1820	1072	EQNEDT32.EXE	binex.exe
PID 1820 wrote to memory of 2036	1820	binex.exe	ywpbz.exe
PID 1820 wrote to memory of 2036	1820	binex.exe	ywpbz.exe
PID 1820 wrote to memory of 2036	1820	binex.exe	ywpbz.exe
PID 1820 wrote to memory of 2036	1820	binex.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe
PID 2036 wrote to memory of 1508	2036	ywpbz.exe	ywpbz.exe

outlook_office_path 1 IoCs

Processes:

ywpbz.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ywpbz.exe

outlook_win_path 1 IoCs

Processes:

ywpbz.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	ywpbz.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PO 121873.xlsx"
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2000

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Roaming\binex.exe
C:\Users\Admin\AppData\Roaming\binex.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820

C:\Users\Admin\AppData\Local\Temp\ywpbz.exe
C:\Users\Admin\AppData\Local\Temp\ywpbz.exe C:\Users\Admin\AppData\Local\Temp\opdnes
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\ywpbz.exe
C:\Users\Admin\AppData\Local\Temp\ywpbz.exe C:\Users\Admin\AppData\Local\Temp\opdnes
4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Exploitation for Client Execution

T1203

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\opdnes
MD5
d8ce6543d4538361a349095393dc90df

SHA1
95cf11f8b0b4c38e3fc34b62ed30fd825849e450

SHA256
37f0d216865d08ad1b6c2db09b83ea0378e3865b1accb59c2205254823022126

SHA512
1511daefa4960b7c405ee1e4ca7cc15c364760f2343e10671b9c113a5daadd0f279363f9ca0093e8f2b4af0f01dc9e249b8caa8d5f5c0449158eaa3b6d22ceac

Download Submit
C:\Users\Admin\AppData\Local\Temp\voi7mz7tn6xhb
MD5
9e4a9d377b8c15e3d1a1bd46fa18d895

SHA1
128880ea79f7b2b425972d15b6b3f8846479482d

SHA256
a7f3e111f1dbb15a9cc163e8061f7c2a21c7fb68ce1d68d978c7b188b108551b

SHA512
5b4f0a9db68c3cec059905c4c5b5190b84e0ead0c0dffd0760bddb802326aea4a7c3a24124e7f0b41378119cc6b3932e1b55bc69e1fc6370cf9ed185cc00acd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ywpbz.exe
MD5
90a1dac0739ab7c2ea592a3618bdee6e

SHA1
241113468ea4b329eeaa3c803666c59d20b1eff5

SHA256
fc56dd7e8517ce405e67e050cfe282508198202ee5a2742482df02af34b727da

SHA512
ae2325c4f8077fa3ecdd62a6a3aaa3b733f132e60de8381514036095a9d2c0b049dd6d3ee48097b3fb10a33037778a15df10fa9d77f9cb5afea9d36616593577

Download Submit
C:\Users\Admin\AppData\Local\Temp\ywpbz.exe
MD5
90a1dac0739ab7c2ea592a3618bdee6e

SHA1
241113468ea4b329eeaa3c803666c59d20b1eff5

SHA256
fc56dd7e8517ce405e67e050cfe282508198202ee5a2742482df02af34b727da

SHA512
ae2325c4f8077fa3ecdd62a6a3aaa3b733f132e60de8381514036095a9d2c0b049dd6d3ee48097b3fb10a33037778a15df10fa9d77f9cb5afea9d36616593577

Download Submit
C:\Users\Admin\AppData\Local\Temp\ywpbz.exe
MD5
90a1dac0739ab7c2ea592a3618bdee6e

SHA1
241113468ea4b329eeaa3c803666c59d20b1eff5

SHA256
fc56dd7e8517ce405e67e050cfe282508198202ee5a2742482df02af34b727da

SHA512
ae2325c4f8077fa3ecdd62a6a3aaa3b733f132e60de8381514036095a9d2c0b049dd6d3ee48097b3fb10a33037778a15df10fa9d77f9cb5afea9d36616593577

Download Submit
C:\Users\Admin\AppData\Roaming\binex.exe
MD5
8b6315ffbe8e1d694f3f171938883d5a

SHA1
60f2841be2c529e7c1523b1f694d5e4eb111aa26

SHA256
22d022c8ec04868088139c6e01f084dc77926025b0765bda3f7aa9769cd23dcb

SHA512
f773bc4db4afaf71889f7aa61f6024c2f08dbd0ee13c90460e663b453b7e3e91ba7489c33f65ed04613177a5360061fdeabf4489e54c5d5d5d3e79a07751be99

Download Submit
C:\Users\Admin\AppData\Roaming\binex.exe
MD5
8b6315ffbe8e1d694f3f171938883d5a

SHA1
60f2841be2c529e7c1523b1f694d5e4eb111aa26

SHA256
22d022c8ec04868088139c6e01f084dc77926025b0765bda3f7aa9769cd23dcb

SHA512
f773bc4db4afaf71889f7aa61f6024c2f08dbd0ee13c90460e663b453b7e3e91ba7489c33f65ed04613177a5360061fdeabf4489e54c5d5d5d3e79a07751be99

Download Submit
\Users\Admin\AppData\Local\Temp\ywpbz.exe
MD5
90a1dac0739ab7c2ea592a3618bdee6e

SHA1
241113468ea4b329eeaa3c803666c59d20b1eff5

SHA256
fc56dd7e8517ce405e67e050cfe282508198202ee5a2742482df02af34b727da

SHA512
ae2325c4f8077fa3ecdd62a6a3aaa3b733f132e60de8381514036095a9d2c0b049dd6d3ee48097b3fb10a33037778a15df10fa9d77f9cb5afea9d36616593577

Download Submit
\Users\Admin\AppData\Local\Temp\ywpbz.exe
MD5
90a1dac0739ab7c2ea592a3618bdee6e

SHA1
241113468ea4b329eeaa3c803666c59d20b1eff5

SHA256
fc56dd7e8517ce405e67e050cfe282508198202ee5a2742482df02af34b727da

SHA512
ae2325c4f8077fa3ecdd62a6a3aaa3b733f132e60de8381514036095a9d2c0b049dd6d3ee48097b3fb10a33037778a15df10fa9d77f9cb5afea9d36616593577

Download Submit
\Users\Admin\AppData\Local\Temp\ywpbz.exe
MD5
90a1dac0739ab7c2ea592a3618bdee6e

SHA1
241113468ea4b329eeaa3c803666c59d20b1eff5

SHA256
fc56dd7e8517ce405e67e050cfe282508198202ee5a2742482df02af34b727da

SHA512
ae2325c4f8077fa3ecdd62a6a3aaa3b733f132e60de8381514036095a9d2c0b049dd6d3ee48097b3fb10a33037778a15df10fa9d77f9cb5afea9d36616593577

Download Submit
\Users\Admin\AppData\Roaming\binex.exe
MD5
8b6315ffbe8e1d694f3f171938883d5a

SHA1
60f2841be2c529e7c1523b1f694d5e4eb111aa26

SHA256
22d022c8ec04868088139c6e01f084dc77926025b0765bda3f7aa9769cd23dcb

SHA512
f773bc4db4afaf71889f7aa61f6024c2f08dbd0ee13c90460e663b453b7e3e91ba7489c33f65ed04613177a5360061fdeabf4489e54c5d5d5d3e79a07751be99

Download Submit
memory/1072-58-0x0000000075471000-0x0000000075473000-memory.dmp

Filesize
8KB

Download
memory/1508-76-0x00000000009B0000-0x00000000009EA000-memory.dmp

Filesize
232KB

Download
memory/1508-71-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1508-75-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1508-78-0x0000000000871000-0x0000000000872000-memory.dmp

Filesize
4KB

Download
memory/1508-77-0x000000006C320000-0x000000006CA0E000-memory.dmp

Filesize
6.9MB

Download
memory/1508-79-0x0000000000872000-0x0000000000873000-memory.dmp

Filesize
4KB

Download
memory/1508-80-0x0000000000873000-0x0000000000874000-memory.dmp

Filesize
4KB

Download
memory/1508-81-0x0000000000874000-0x0000000000875000-memory.dmp

Filesize
4KB

Download
memory/2000-57-0x00000000725DD000-0x00000000725E8000-memory.dmp

Filesize
44KB

Download
memory/2000-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2000-55-0x00000000715F1000-0x00000000715F3000-memory.dmp

Filesize
8KB

Download
memory/2000-54-0x000000002F8B1000-0x000000002F8B4000-memory.dmp

Filesize
12KB

Download