7fbeb474f98198020a1190b79ad14dae98cf76fd40cc687887fd3b59110eca0d

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EXCELtoolVSTO.exe
Size

9.1MB
MD5

c748e7b27c235b096cef708310e6fa31
SHA1

aab05e4e9372b6eb4f38b44f2de84345fe0b86f2
SHA256

bf974d8a3689c5e30b4e6b5cc00abfac99c7a0591dd4e303a158b89827ca333e
SHA512

2a20c91d9cdf0025c8f1f0c06401173236cd8ca4748cd0f85ceca408aab69e8790a2699f28f69f0d1585ec6e20ecb2443d33180c4657952eab8f88eccbcb5ce5
SSDEEP

196608:wTlQawKlgcR4z7DZoZwhY0SCaHqnM08KLih:wFwRcu7HhIHqnM04h

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1256	EXCELtoolVSTO.tmp

Loads dropped DLL 4 IoCs

pid	Process
2308	EXCELtoolVSTO.exe
1256	EXCELtoolVSTO.tmp
1256	EXCELtoolVSTO.tmp
1256	EXCELtoolVSTO.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1256	EXCELtoolVSTO.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1256	2308	EXCELtoolVSTO.exe	28
PID 2308 wrote to memory of 1256	2308	EXCELtoolVSTO.exe	28
PID 2308 wrote to memory of 1256	2308	EXCELtoolVSTO.exe	28
PID 2308 wrote to memory of 1256	2308	EXCELtoolVSTO.exe	28

C:\Users\Admin\AppData\Local\Temp\EXCELtoolVSTO.exe
"C:\Users\Admin\AppData\Local\Temp\EXCELtoolVSTO.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\is-JBJM0.tmp\EXCELtoolVSTO.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JBJM0.tmp\EXCELtoolVSTO.tmp" /SL5="$30144,9223473,74752,C:\Users\Admin\AppData\Local\Temp\EXCELtoolVSTO.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-9RA3K.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-9RA3K.tmp\isxdl.dll

Filesize
49KB

MD5
02ecc74f7f91e9ffd84de708683236a6

SHA1
3532de0b77df8b0fc89e9c7eddec3fa71f98f5a2

SHA256
30ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e

SHA512
a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541

Download Submit
\Users\Admin\AppData\Local\Temp\is-JBJM0.tmp\EXCELtoolVSTO.tmp

Filesize
720KB

MD5
71f05c7a4daf1da7c9df96b87b74587c

SHA1
a0446c42ac644025b9e06180e880ba4b8fceec9e

SHA256
28041d160f694bba114a9fbce03aa790c1f7935429352472e2a827537b1890a1

SHA512
a8da58bd9213e4439b8e1da6b368089a09c4aff593f2d22d71412370530edb9f06fb5128afccba2132f3ac042f81cc8d6731b4566d7ccd50e3b97ff0487141a9

Download Submit
memory/1256-8-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1256-19-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/1256-22-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2308-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2308-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2308-18-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads