Malware Analysis Report

2025-08-11 01:43

Sample ID 221109-2gl17scfh6
Target 10112022.xls
SHA256 82d3e0feb4e9fb53a00a23700f936021aba598ffc08e1d8b8c5f33e327d09912
Tags
macro xlm emotet epoch5 banker trojan persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82d3e0feb4e9fb53a00a23700f936021aba598ffc08e1d8b8c5f33e327d09912

Threat Level: Known bad

The file 10112022.xls was found to be: Known bad.

Malicious Activity Summary

macro xlm emotet epoch5 banker trojan persistence

Emotet

Process spawned unexpected child process

Suspicious Office macro

Downloads MZ/PE file

Loads dropped DLL

Adds Run key to start application

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-11-09 22:33

Signatures

Suspicious Office macro

macro xlm
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-11-09 22:33

Reported

2022-11-09 22:36

Platform

win7-20220812-en

Max time kernel

151s

Max time network

159s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\10112022.xls

Signatures

Emotet

trojan banker emotet

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\regsvr32.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\regsvr32.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\regsvr32.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\regsvr32.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

Downloads MZ/PE file

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1184 wrote to memory of 1816 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1816 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1816 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1816 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1816 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1816 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1816 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1816 wrote to memory of 2036 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1816 wrote to memory of 2036 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1816 wrote to memory of 2036 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1816 wrote to memory of 2036 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1816 wrote to memory of 2036 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1816 wrote to memory of 2036 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1816 wrote to memory of 2036 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2036 wrote to memory of 1048 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2036 wrote to memory of 1048 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2036 wrote to memory of 1048 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2036 wrote to memory of 1048 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2036 wrote to memory of 1048 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1184 wrote to memory of 1972 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1972 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1972 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1972 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1972 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1972 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1972 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1972 wrote to memory of 1568 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1972 wrote to memory of 1568 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1972 wrote to memory of 1568 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1972 wrote to memory of 1568 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1972 wrote to memory of 1568 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1972 wrote to memory of 1568 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1972 wrote to memory of 1568 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1568 wrote to memory of 932 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1568 wrote to memory of 932 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1568 wrote to memory of 932 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1568 wrote to memory of 932 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1568 wrote to memory of 932 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1184 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 1080 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1080 wrote to memory of 1372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1080 wrote to memory of 1372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1080 wrote to memory of 1372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1080 wrote to memory of 1372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1080 wrote to memory of 1372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1080 wrote to memory of 1372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1080 wrote to memory of 1372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1372 wrote to memory of 972 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1372 wrote to memory of 972 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1372 wrote to memory of 972 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1372 wrote to memory of 972 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1372 wrote to memory of 972 N/A C:\Windows\system32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1184 wrote to memory of 428 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 428 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 428 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 428 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 428 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 428 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe
PID 1184 wrote to memory of 428 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\10112022.xls

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx

C:\Windows\system32\regsvr32.exe

/S ..\elv1.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\OOAbqHA\rYvMcX.dll"

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx

C:\Windows\system32\regsvr32.exe

/S ..\elv2.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\VwDfiYQY\DvBpgFdgdXv.dll"

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx

C:\Windows\system32\regsvr32.exe

/S ..\elv3.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\EBFMWhOuBcMBu\seFApwfgfAklQ.dll"

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx

C:\Windows\system32\regsvr32.exe

/S ..\elv4.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\KDGytCdoYytPhl\csKQbZblblADu.dll"

Network

Country Destination Domain Proto
US 8.8.8.8:53 fixoutlet.com udp
NL 141.138.168.119:80 fixoutlet.com tcp
US 8.8.8.8:53 www.cesasin.com.ar udp
AR 179.43.117.122:80 www.cesasin.com.ar tcp
US 8.8.8.8:53 blacktequila.com.br udp
US 192.169.82.54:80 blacktequila.com.br tcp
US 8.8.8.8:53 case.co.il udp
IL 185.18.204.26:80 case.co.il tcp
KR 218.38.121.17:443 tcp
KR 218.38.121.17:443 tcp
BR 186.250.48.5:443 tcp
BR 186.250.48.5:443 tcp
KR 218.38.121.17:443 tcp
KR 218.38.121.17:443 tcp
IT 80.211.107.116:8080 tcp
IT 80.211.107.116:8080 tcp
BR 186.250.48.5:443 tcp
BR 186.250.48.5:443 tcp
KR 218.38.121.17:443 tcp
KR 218.38.121.17:443 tcp
US 174.138.33.49:7080 tcp
US 174.138.33.49:7080 tcp
IT 80.211.107.116:8080 tcp
IT 80.211.107.116:8080 tcp
KR 218.38.121.17:443 tcp
KR 218.38.121.17:443 tcp
SG 165.22.254.236:8080 tcp
BR 186.250.48.5:443 tcp
BR 186.250.48.5:443 tcp
US 174.138.33.49:7080 tcp
US 174.138.33.49:7080 tcp
BR 186.250.48.5:443 tcp
BR 186.250.48.5:443 tcp
IT 80.211.107.116:8080 tcp
IT 80.211.107.116:8080 tcp
DE 185.148.169.10:8080 tcp
SG 165.22.254.236:8080 tcp
IT 80.211.107.116:8080 tcp
IT 80.211.107.116:8080 tcp
US 174.138.33.49:7080 tcp
US 174.138.33.49:7080 tcp
DE 62.171.178.147:8080 tcp
US 174.138.33.49:7080 tcp
US 174.138.33.49:7080 tcp
DE 185.148.169.10:8080 tcp
SG 165.22.254.236:8080 tcp
SG 128.199.217.206:443 tcp
SG 165.22.254.236:8080 tcp

Files

memory/1184-54-0x000000002FB01000-0x000000002FB04000-memory.dmp

memory/1184-55-0x0000000070FC1000-0x0000000070FC3000-memory.dmp

memory/1184-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/1184-57-0x0000000071FAD000-0x0000000071FB8000-memory.dmp

memory/1184-58-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

memory/1184-59-0x0000000071FAD000-0x0000000071FB8000-memory.dmp

memory/1816-60-0x0000000000000000-mapping.dmp

C:\Users\Admin\elv1.ooocccxxx

MD5 7e8fee77132c086dee1d35b3883093c0
SHA1 cb76cf15cc4b8a9716234ddad4dacf31310fff22
SHA256 c92ff622c42f6ec9de3fda948add268884f3f490514d539e6bff37af5321ac86
SHA512 b3aa4869b58962fff26d487a8fd9de48bc957fe31d9d99870e9318ce2d48d04e1de445966c0e2d5e87590848c981db08e497874f535b45e0b689bb9edfdb2448

\Users\Admin\elv1.ooocccxxx

MD5 7e8fee77132c086dee1d35b3883093c0
SHA1 cb76cf15cc4b8a9716234ddad4dacf31310fff22
SHA256 c92ff622c42f6ec9de3fda948add268884f3f490514d539e6bff37af5321ac86
SHA512 b3aa4869b58962fff26d487a8fd9de48bc957fe31d9d99870e9318ce2d48d04e1de445966c0e2d5e87590848c981db08e497874f535b45e0b689bb9edfdb2448

memory/2036-64-0x0000000000000000-mapping.dmp

memory/2036-65-0x000007FEFB7D1000-0x000007FEFB7D3000-memory.dmp

\Users\Admin\elv1.ooocccxxx

MD5 7e8fee77132c086dee1d35b3883093c0
SHA1 cb76cf15cc4b8a9716234ddad4dacf31310fff22
SHA256 c92ff622c42f6ec9de3fda948add268884f3f490514d539e6bff37af5321ac86
SHA512 b3aa4869b58962fff26d487a8fd9de48bc957fe31d9d99870e9318ce2d48d04e1de445966c0e2d5e87590848c981db08e497874f535b45e0b689bb9edfdb2448

memory/2036-67-0x00000000001F0000-0x0000000000220000-memory.dmp

memory/1048-70-0x0000000000000000-mapping.dmp

memory/1972-75-0x0000000000000000-mapping.dmp

\Users\Admin\elv2.ooocccxxx

MD5 4e7d14eb59c3e63be0ce4d1b1af6a551
SHA1 594d9dceb37b5a61d1e9cf4ed1a6be2808ee730f
SHA256 89b29bad84ce0fa4d806b481a996c180a95e47e370d573ff590094261cfe4e91
SHA512 c1f1b192db14e315fc3dc7230eb6e2dfa9612d938b5170d4da920146dfd6ebea3279e6a1402757d3f203fe985cd5d37be231e9389bbae04461b25f61814483ac

memory/1568-79-0x0000000000000000-mapping.dmp

C:\Users\Admin\elv2.ooocccxxx

MD5 4e7d14eb59c3e63be0ce4d1b1af6a551
SHA1 594d9dceb37b5a61d1e9cf4ed1a6be2808ee730f
SHA256 89b29bad84ce0fa4d806b481a996c180a95e47e370d573ff590094261cfe4e91
SHA512 c1f1b192db14e315fc3dc7230eb6e2dfa9612d938b5170d4da920146dfd6ebea3279e6a1402757d3f203fe985cd5d37be231e9389bbae04461b25f61814483ac

\Users\Admin\elv2.ooocccxxx

MD5 4e7d14eb59c3e63be0ce4d1b1af6a551
SHA1 594d9dceb37b5a61d1e9cf4ed1a6be2808ee730f
SHA256 89b29bad84ce0fa4d806b481a996c180a95e47e370d573ff590094261cfe4e91
SHA512 c1f1b192db14e315fc3dc7230eb6e2dfa9612d938b5170d4da920146dfd6ebea3279e6a1402757d3f203fe985cd5d37be231e9389bbae04461b25f61814483ac

memory/932-85-0x0000000000000000-mapping.dmp

memory/1080-90-0x0000000000000000-mapping.dmp

C:\Users\Admin\elv3.ooocccxxx

MD5 6867f2d861160fbfeed5b7c6d0208a8c
SHA1 ef8d76eeb4a1bf3500f2b0a75ecf8db9ec7755d8
SHA256 957505bbcf458e5b668d2c9ad930e7268f1edc16028c6e8547044963754d3d6d
SHA512 b86f9ce88fd416c34c858712349f6b857052f6e6b4c631c3637d8a611c299337d2de5d214dc4775ed9fe5b3e4f6de2715470e57b1d8d8022f37cb94faca958fb

\Users\Admin\elv3.ooocccxxx

MD5 6867f2d861160fbfeed5b7c6d0208a8c
SHA1 ef8d76eeb4a1bf3500f2b0a75ecf8db9ec7755d8
SHA256 957505bbcf458e5b668d2c9ad930e7268f1edc16028c6e8547044963754d3d6d
SHA512 b86f9ce88fd416c34c858712349f6b857052f6e6b4c631c3637d8a611c299337d2de5d214dc4775ed9fe5b3e4f6de2715470e57b1d8d8022f37cb94faca958fb

memory/1372-94-0x0000000000000000-mapping.dmp

\Users\Admin\elv3.ooocccxxx

MD5 6867f2d861160fbfeed5b7c6d0208a8c
SHA1 ef8d76eeb4a1bf3500f2b0a75ecf8db9ec7755d8
SHA256 957505bbcf458e5b668d2c9ad930e7268f1edc16028c6e8547044963754d3d6d
SHA512 b86f9ce88fd416c34c858712349f6b857052f6e6b4c631c3637d8a611c299337d2de5d214dc4775ed9fe5b3e4f6de2715470e57b1d8d8022f37cb94faca958fb

memory/972-100-0x0000000000000000-mapping.dmp

memory/428-105-0x0000000000000000-mapping.dmp

\Users\Admin\elv4.ooocccxxx

MD5 3995fa09a20398b02e68d778b8f24f60
SHA1 1780771df76d11a5bb023ad2cb41728004743769
SHA256 134baf345332ba4de3b080a1fb3b72758c52e72c9896937921b0e92cc9fa3f34
SHA512 37f3ea200b7380e8f9426fbe8dbf29b6d94042e9a795b22ebd459e9da57e3b0b4462f94f00a6d43ebeb5cd2746a50631da7953071563f65023b6d790b528388a

C:\Users\Admin\elv4.ooocccxxx

MD5 3995fa09a20398b02e68d778b8f24f60
SHA1 1780771df76d11a5bb023ad2cb41728004743769
SHA256 134baf345332ba4de3b080a1fb3b72758c52e72c9896937921b0e92cc9fa3f34
SHA512 37f3ea200b7380e8f9426fbe8dbf29b6d94042e9a795b22ebd459e9da57e3b0b4462f94f00a6d43ebeb5cd2746a50631da7953071563f65023b6d790b528388a

memory/1652-109-0x0000000000000000-mapping.dmp

\Users\Admin\elv4.ooocccxxx

MD5 3995fa09a20398b02e68d778b8f24f60
SHA1 1780771df76d11a5bb023ad2cb41728004743769
SHA256 134baf345332ba4de3b080a1fb3b72758c52e72c9896937921b0e92cc9fa3f34
SHA512 37f3ea200b7380e8f9426fbe8dbf29b6d94042e9a795b22ebd459e9da57e3b0b4462f94f00a6d43ebeb5cd2746a50631da7953071563f65023b6d790b528388a

memory/1068-115-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-11-09 22:33

Reported

2022-11-09 22:36

Platform

win10v2004-20220901-en

Max time kernel

150s

Max time network

140s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\10112022.xls"

Signatures

Emotet

trojan banker emotet

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\System32\regsvr32.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Downloads MZ/PE file

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KKIZGakMKi.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\FGzPLzZXeyROMld\\KKIZGakMKi.dll\"" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nxii.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\NWJKpDRbes\\nxii.dll\"" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ISuiZaCOWWt.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\AZsAIR\\ISuiZaCOWWt.dll\"" C:\Windows\system32\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\system32\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VNJOWVVI.dll = "C:\\Windows\\system32\\regsvr32.exe \"C:\\Windows\\system32\\AcyiPSNZc\\VNJOWVVI.dll\"" C:\Windows\system32\regsvr32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1828 wrote to memory of 2012 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 1828 wrote to memory of 2012 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 2012 wrote to memory of 368 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2012 wrote to memory of 368 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1828 wrote to memory of 1420 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 1828 wrote to memory of 1420 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 1420 wrote to memory of 4852 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1420 wrote to memory of 4852 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1828 wrote to memory of 2256 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 1828 wrote to memory of 2256 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 2256 wrote to memory of 2392 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2256 wrote to memory of 2392 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 1828 wrote to memory of 2876 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 1828 wrote to memory of 2876 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Windows\System32\regsvr32.exe
PID 2876 wrote to memory of 3416 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe
PID 2876 wrote to memory of 3416 N/A C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\10112022.xls"

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv1.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NWJKpDRbes\nxii.dll"

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv2.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AZsAIR\ISuiZaCOWWt.dll"

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv3.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\AcyiPSNZc\VNJOWVVI.dll"

C:\Windows\System32\regsvr32.exe

C:\Windows\System32\regsvr32.exe /S ..\elv4.ooocccxxx

C:\Windows\system32\regsvr32.exe

C:\Windows\system32\regsvr32.exe "C:\Windows\system32\FGzPLzZXeyROMld\KKIZGakMKi.dll"

Network

Country Destination Domain Proto
US 8.8.8.8:53 fixoutlet.com udp
NL 141.138.168.119:80 fixoutlet.com tcp
US 8.8.8.8:53 www.cesasin.com.ar udp
AR 179.43.117.122:80 www.cesasin.com.ar tcp
NL 104.80.225.205:443 tcp
US 8.8.8.8:53 blacktequila.com.br udp
US 192.169.82.54:80 blacktequila.com.br tcp
US 8.8.8.8:53 case.co.il udp
IL 185.18.204.26:80 case.co.il tcp
US 20.189.173.4:443 tcp
US 8.253.183.120:80 tcp
US 8.253.183.120:80 tcp
US 8.253.183.120:80 tcp
KR 218.38.121.17:443 218.38.121.17 tcp
KR 218.38.121.17:443 218.38.121.17 tcp
KR 218.38.121.17:443 218.38.121.17 tcp
KR 218.38.121.17:443 218.38.121.17 tcp

Files

memory/1828-132-0x00007FF927810000-0x00007FF927820000-memory.dmp

memory/1828-133-0x00007FF927810000-0x00007FF927820000-memory.dmp

memory/1828-134-0x00007FF927810000-0x00007FF927820000-memory.dmp

memory/1828-135-0x00007FF927810000-0x00007FF927820000-memory.dmp

memory/1828-136-0x00007FF927810000-0x00007FF927820000-memory.dmp

memory/1828-137-0x00007FF925010000-0x00007FF925020000-memory.dmp

memory/1828-138-0x00007FF925010000-0x00007FF925020000-memory.dmp

memory/2012-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\elv1.ooocccxxx

MD5 7e8fee77132c086dee1d35b3883093c0
SHA1 cb76cf15cc4b8a9716234ddad4dacf31310fff22
SHA256 c92ff622c42f6ec9de3fda948add268884f3f490514d539e6bff37af5321ac86
SHA512 b3aa4869b58962fff26d487a8fd9de48bc957fe31d9d99870e9318ce2d48d04e1de445966c0e2d5e87590848c981db08e497874f535b45e0b689bb9edfdb2448

C:\Users\Admin\elv1.ooocccxxx

MD5 7e8fee77132c086dee1d35b3883093c0
SHA1 cb76cf15cc4b8a9716234ddad4dacf31310fff22
SHA256 c92ff622c42f6ec9de3fda948add268884f3f490514d539e6bff37af5321ac86
SHA512 b3aa4869b58962fff26d487a8fd9de48bc957fe31d9d99870e9318ce2d48d04e1de445966c0e2d5e87590848c981db08e497874f535b45e0b689bb9edfdb2448

memory/2012-142-0x0000000002880000-0x00000000028B0000-memory.dmp

memory/368-145-0x0000000000000000-mapping.dmp

C:\Windows\System32\NWJKpDRbes\nxii.dll

MD5 7e8fee77132c086dee1d35b3883093c0
SHA1 cb76cf15cc4b8a9716234ddad4dacf31310fff22
SHA256 c92ff622c42f6ec9de3fda948add268884f3f490514d539e6bff37af5321ac86
SHA512 b3aa4869b58962fff26d487a8fd9de48bc957fe31d9d99870e9318ce2d48d04e1de445966c0e2d5e87590848c981db08e497874f535b45e0b689bb9edfdb2448

memory/1420-150-0x0000000000000000-mapping.dmp

C:\Users\Admin\elv2.ooocccxxx

MD5 4e7d14eb59c3e63be0ce4d1b1af6a551
SHA1 594d9dceb37b5a61d1e9cf4ed1a6be2808ee730f
SHA256 89b29bad84ce0fa4d806b481a996c180a95e47e370d573ff590094261cfe4e91
SHA512 c1f1b192db14e315fc3dc7230eb6e2dfa9612d938b5170d4da920146dfd6ebea3279e6a1402757d3f203fe985cd5d37be231e9389bbae04461b25f61814483ac

C:\Users\Admin\elv2.ooocccxxx

MD5 4e7d14eb59c3e63be0ce4d1b1af6a551
SHA1 594d9dceb37b5a61d1e9cf4ed1a6be2808ee730f
SHA256 89b29bad84ce0fa4d806b481a996c180a95e47e370d573ff590094261cfe4e91
SHA512 c1f1b192db14e315fc3dc7230eb6e2dfa9612d938b5170d4da920146dfd6ebea3279e6a1402757d3f203fe985cd5d37be231e9389bbae04461b25f61814483ac

memory/4852-156-0x0000000000000000-mapping.dmp

C:\Windows\System32\AZsAIR\ISuiZaCOWWt.dll

MD5 4e7d14eb59c3e63be0ce4d1b1af6a551
SHA1 594d9dceb37b5a61d1e9cf4ed1a6be2808ee730f
SHA256 89b29bad84ce0fa4d806b481a996c180a95e47e370d573ff590094261cfe4e91
SHA512 c1f1b192db14e315fc3dc7230eb6e2dfa9612d938b5170d4da920146dfd6ebea3279e6a1402757d3f203fe985cd5d37be231e9389bbae04461b25f61814483ac

memory/2256-161-0x0000000000000000-mapping.dmp

C:\Users\Admin\elv3.ooocccxxx

MD5 6867f2d861160fbfeed5b7c6d0208a8c
SHA1 ef8d76eeb4a1bf3500f2b0a75ecf8db9ec7755d8
SHA256 957505bbcf458e5b668d2c9ad930e7268f1edc16028c6e8547044963754d3d6d
SHA512 b86f9ce88fd416c34c858712349f6b857052f6e6b4c631c3637d8a611c299337d2de5d214dc4775ed9fe5b3e4f6de2715470e57b1d8d8022f37cb94faca958fb

C:\Users\Admin\elv3.ooocccxxx

MD5 6867f2d861160fbfeed5b7c6d0208a8c
SHA1 ef8d76eeb4a1bf3500f2b0a75ecf8db9ec7755d8
SHA256 957505bbcf458e5b668d2c9ad930e7268f1edc16028c6e8547044963754d3d6d
SHA512 b86f9ce88fd416c34c858712349f6b857052f6e6b4c631c3637d8a611c299337d2de5d214dc4775ed9fe5b3e4f6de2715470e57b1d8d8022f37cb94faca958fb

memory/2392-167-0x0000000000000000-mapping.dmp

C:\Windows\System32\AcyiPSNZc\VNJOWVVI.dll

MD5 6867f2d861160fbfeed5b7c6d0208a8c
SHA1 ef8d76eeb4a1bf3500f2b0a75ecf8db9ec7755d8
SHA256 957505bbcf458e5b668d2c9ad930e7268f1edc16028c6e8547044963754d3d6d
SHA512 b86f9ce88fd416c34c858712349f6b857052f6e6b4c631c3637d8a611c299337d2de5d214dc4775ed9fe5b3e4f6de2715470e57b1d8d8022f37cb94faca958fb

memory/2876-172-0x0000000000000000-mapping.dmp

C:\Users\Admin\elv4.ooocccxxx

MD5 3995fa09a20398b02e68d778b8f24f60
SHA1 1780771df76d11a5bb023ad2cb41728004743769
SHA256 134baf345332ba4de3b080a1fb3b72758c52e72c9896937921b0e92cc9fa3f34
SHA512 37f3ea200b7380e8f9426fbe8dbf29b6d94042e9a795b22ebd459e9da57e3b0b4462f94f00a6d43ebeb5cd2746a50631da7953071563f65023b6d790b528388a

C:\Users\Admin\elv4.ooocccxxx

MD5 3995fa09a20398b02e68d778b8f24f60
SHA1 1780771df76d11a5bb023ad2cb41728004743769
SHA256 134baf345332ba4de3b080a1fb3b72758c52e72c9896937921b0e92cc9fa3f34
SHA512 37f3ea200b7380e8f9426fbe8dbf29b6d94042e9a795b22ebd459e9da57e3b0b4462f94f00a6d43ebeb5cd2746a50631da7953071563f65023b6d790b528388a

memory/3416-178-0x0000000000000000-mapping.dmp

C:\Windows\System32\FGzPLzZXeyROMld\KKIZGakMKi.dll

MD5 3995fa09a20398b02e68d778b8f24f60
SHA1 1780771df76d11a5bb023ad2cb41728004743769
SHA256 134baf345332ba4de3b080a1fb3b72758c52e72c9896937921b0e92cc9fa3f34
SHA512 37f3ea200b7380e8f9426fbe8dbf29b6d94042e9a795b22ebd459e9da57e3b0b4462f94f00a6d43ebeb5cd2746a50631da7953071563f65023b6d790b528388a