Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
07/06/2024, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
4a1e40508379562e5cfe14681fc7f17d647b158f00a1cdef8eb3f6d2e0f423a0.xlam
Resource
win7-20240508-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a1e40508379562e5cfe14681fc7f17d647b158f00a1cdef8eb3f6d2e0f423a0.xlam
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
4a1e40508379562e5cfe14681fc7f17d647b158f00a1cdef8eb3f6d2e0f423a0.xlam
-
Size
675KB
-
MD5
71e83cfe190375b478e42933ac4e1997
-
SHA1
bd4ce42a4599837b7a819e41ab740881f2f9bbd1
-
SHA256
4a1e40508379562e5cfe14681fc7f17d647b158f00a1cdef8eb3f6d2e0f423a0
-
SHA512
a7a1fb14380353be5200ab7360a7338b8fe93f93f614faa03cfc296a9f87a7c8188cd09ecc06ef30192ffcbd8d4da25b95dae77d70a12755769e232dd6d82bb3
-
SSDEEP
12288:DQnWa/bT29nrmgHgFSPn643Cyne30ZPN9P2X9CcDhZ28mGEWOVPJ9u0aJ2BrupA+:sMAs6A1e3of2XM01mtVxEpQBrdGDYw
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
resource yara_rule behavioral1/memory/756-108-0x0000000000A60000-0x0000000000AB4000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-109-0x0000000002060000-0x00000000020B2000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-115-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-129-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-127-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-125-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-123-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-121-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-119-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-117-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-113-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-111-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-110-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-151-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-169-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-167-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-165-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-163-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-161-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-159-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-157-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-155-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-153-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-149-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-147-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-145-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-143-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-141-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-139-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-137-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-135-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-133-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/756-131-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
resource yara_rule behavioral1/memory/756-108-0x0000000000A60000-0x0000000000AB4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-109-0x0000000002060000-0x00000000020B2000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-115-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-129-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-127-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-125-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-123-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-121-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-119-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-117-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-113-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-111-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-110-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-151-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-169-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-167-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-165-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-163-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-161-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-159-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-157-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-155-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-153-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-149-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-147-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-145-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-143-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-141-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-139-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-137-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-135-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-133-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/756-131-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
resource yara_rule behavioral1/memory/756-108-0x0000000000A60000-0x0000000000AB4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-109-0x0000000002060000-0x00000000020B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-115-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-129-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-127-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-125-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-123-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-121-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-119-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-117-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-113-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-111-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-110-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-151-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-169-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-167-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-165-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-163-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-161-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-159-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-157-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-155-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-153-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-149-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-147-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-145-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-143-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-141-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-139-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-137-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-135-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-133-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/756-131-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/756-108-0x0000000000A60000-0x0000000000AB4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-109-0x0000000002060000-0x00000000020B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-115-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-129-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-127-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-125-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-123-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-121-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-119-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-117-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-113-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-111-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-110-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-151-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-169-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-167-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-165-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-163-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-161-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-159-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-157-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-155-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-153-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-149-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-147-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-145-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-143-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-141-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-139-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-137-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-135-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-133-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/756-131-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/756-108-0x0000000000A60000-0x0000000000AB4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-109-0x0000000002060000-0x00000000020B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-115-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-129-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-127-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-125-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-123-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-121-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-119-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-117-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-113-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-111-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-110-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-151-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-169-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-167-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-165-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-163-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-161-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-159-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-157-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-155-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-153-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-149-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-147-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-145-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-143-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-141-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-139-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-137-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-135-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-133-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/756-131-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/756-108-0x0000000000A60000-0x0000000000AB4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-109-0x0000000002060000-0x00000000020B2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-115-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-129-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-127-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-125-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-123-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-121-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-119-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-117-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-113-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-111-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-110-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-151-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-169-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-167-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-165-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-163-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-161-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-159-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-157-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-155-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-153-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-149-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-147-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-145-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-143-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-141-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-139-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-137-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-135-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-133-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/756-131-0x0000000002060000-0x00000000020AD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Blocklisted process makes network request 4 IoCs
flow pid Process 3 2584 EQNEDT32.EXE 5 2584 EQNEDT32.EXE 7 2584 EQNEDT32.EXE 9 2584 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2840 KID.exe -
Loads dropped DLL 1 IoCs
pid Process 2584 EQNEDT32.EXE -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.ipify.org 11 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0009000000015ce8-89.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2840 set thread context of 756 2840 KID.exe 32 -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 2584 EQNEDT32.EXE -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3044 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 756 RegSvcs.exe 756 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2840 KID.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 756 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2840 KID.exe 2840 KID.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2840 KID.exe 2840 KID.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3044 EXCEL.EXE 3044 EXCEL.EXE 3044 EXCEL.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2584 wrote to memory of 2840 2584 EQNEDT32.EXE 29 PID 2584 wrote to memory of 2840 2584 EQNEDT32.EXE 29 PID 2584 wrote to memory of 2840 2584 EQNEDT32.EXE 29 PID 2584 wrote to memory of 2840 2584 EQNEDT32.EXE 29 PID 2840 wrote to memory of 756 2840 KID.exe 32 PID 2840 wrote to memory of 756 2840 KID.exe 32 PID 2840 wrote to memory of 756 2840 KID.exe 32 PID 2840 wrote to memory of 756 2840 KID.exe 32 PID 2840 wrote to memory of 756 2840 KID.exe 32 PID 2840 wrote to memory of 756 2840 KID.exe 32 PID 2840 wrote to memory of 756 2840 KID.exe 32 PID 2840 wrote to memory of 756 2840 KID.exe 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\4a1e40508379562e5cfe14681fc7f17d647b158f00a1cdef8eb3f6d2e0f423a0.xlam1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3044
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Roaming\KID.exe"C:\Users\Admin\AppData\Roaming\KID.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Roaming\KID.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572852c7998b7bd3cce965fe92c7b678f
SHA184bf7e46bfa562e7c940d659a8a4e8e7a8d946eb
SHA2563df153e0ab34b0eb1567ca4a6213c6a3799c4c83ac02d5a2d12837feba84e4f6
SHA5124ebd576b7a57d9d58d741fbb3356bd05acedb25556dcfada2a5e964cb51b0b462c6b175c98ec52194191911941ea2e6910727a9b45dc720cde814553eb09fb2f
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
262KB
MD57658871481cc047a9339fabea060c0f1
SHA1993b78228239b222a6245b30e9c85b8f9b374706
SHA2564d30d09098070fd1abb2634800954cb086e78c5c241043268128512069907039
SHA512c213a5160422716315a077e8979dd447ecab028142986093872bcec7547a1050700bf3418237604778b62617b87d49f1f8267b9915ce5388eb0380aea5001b74
-
Filesize
1.1MB
MD59e42c4140a5252b2ea2a32fe7d3eeb9d
SHA111f732f8ef065611f4007212f1de2713f42679d3
SHA2560bf33cf8fff7fe087a86e590f03f16409f000519c71db0b50e955ef4112e338a
SHA51212d72040108a85bfb8cd2d9d2ca0569b5bd937b29c59b2fccaf6f3b0436b55b86e6012af2a076df447393b67f826dd876e2f0010a89fa257dc8cc04ce56b916c