Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
ebe0db47f3d58129ded5690057c586c10adba99f5efea70eb2defd4be879d204.xlam
Resource
win7-20240215-en
windows7-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
ebe0db47f3d58129ded5690057c586c10adba99f5efea70eb2defd4be879d204.xlam
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
ebe0db47f3d58129ded5690057c586c10adba99f5efea70eb2defd4be879d204.xlam
-
Size
743KB
-
MD5
0bae405b6cbbd6f2a51b6c8f3d3229d4
-
SHA1
c883182707d44204007d65a270f4f5794dd9328b
-
SHA256
ebe0db47f3d58129ded5690057c586c10adba99f5efea70eb2defd4be879d204
-
SHA512
98b5371a3e3dfd61e190db23a0fe246b2b2073eaa3f13424f6690cdeed48bc04e661bf361144968b028b72bdd47f68cdab4d56a0816128aa0f27db06c24d8c0f
-
SSDEEP
12288:k2nWqZIWl17AxZ1AibfuOXwLeLCmBeJmxZIjza2rVHIaKLdGfT3wxWv0gONA+/:R3BAxFrvIQLesDIjzEaKhiUhNL
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 33 IoCs
resource yara_rule behavioral1/memory/2404-25-0x0000000000980000-0x00000000009D4000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-26-0x0000000000A20000-0x0000000000A72000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-42-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-86-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-84-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-80-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-78-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-76-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-74-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-70-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-68-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-66-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-62-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-60-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-58-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-56-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-54-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-52-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-50-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-48-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-46-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-40-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-38-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-36-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-34-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-30-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-82-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-72-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-64-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-44-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-32-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-28-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral1/memory/2404-27-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 33 IoCs
resource yara_rule behavioral1/memory/2404-25-0x0000000000980000-0x00000000009D4000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-26-0x0000000000A20000-0x0000000000A72000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-42-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-86-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-84-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-80-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-78-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-76-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-74-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-70-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-68-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-66-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-62-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-60-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-58-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-56-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-54-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-52-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-50-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-48-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-46-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-40-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-38-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-36-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-34-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-30-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-82-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-72-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-64-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-44-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-32-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-28-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral1/memory/2404-27-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 33 IoCs
resource yara_rule behavioral1/memory/2404-25-0x0000000000980000-0x00000000009D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-26-0x0000000000A20000-0x0000000000A72000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-42-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-86-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-84-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-80-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-78-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-76-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-74-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-70-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-68-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-66-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-62-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-60-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-58-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-56-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-54-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-52-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-50-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-48-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-46-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-40-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-38-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-36-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-34-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-30-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-82-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-72-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-64-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-44-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-32-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-28-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral1/memory/2404-27-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/2404-25-0x0000000000980000-0x00000000009D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-26-0x0000000000A20000-0x0000000000A72000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-42-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-86-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-84-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-80-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-78-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-76-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-74-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-70-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-68-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-66-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-62-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-60-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-58-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-56-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-54-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-52-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-50-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-48-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-46-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-40-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-38-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-36-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-34-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-30-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-82-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-72-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-64-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-44-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-32-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-28-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral1/memory/2404-27-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/2404-25-0x0000000000980000-0x00000000009D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-26-0x0000000000A20000-0x0000000000A72000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-42-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-86-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-84-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-80-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-78-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-76-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-74-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-70-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-68-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-66-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-62-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-60-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-58-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-56-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-54-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-52-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-50-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-48-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-46-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-40-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-38-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-36-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-34-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-30-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-82-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-72-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-64-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-44-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-32-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-28-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral1/memory/2404-27-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 33 IoCs
resource yara_rule behavioral1/memory/2404-25-0x0000000000980000-0x00000000009D4000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-26-0x0000000000A20000-0x0000000000A72000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-42-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-86-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-84-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-80-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-78-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-76-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-74-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-70-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-68-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-66-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-62-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-60-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-58-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-56-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-54-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-52-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-50-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-48-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-46-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-40-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-38-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-36-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-34-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-30-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-82-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-72-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-64-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-44-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-32-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-28-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral1/memory/2404-27-0x0000000000A20000-0x0000000000A6D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Blocklisted process makes network request 3 IoCs
flow pid Process 3 2616 EQNEDT32.EXE 5 2616 EQNEDT32.EXE 6 2616 EQNEDT32.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2104 KUD.exe -
Loads dropped DLL 6 IoCs
pid Process 2616 EQNEDT32.EXE 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe 2428 WerFault.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 api.ipify.org 10 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000a0000000133a3-6.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2104 set thread context of 2404 2104 KUD.exe 31 -
Program crash 1 IoCs
pid pid_target Process procid_target 2428 2104 WerFault.exe 29 -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 2616 EQNEDT32.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2876 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2404 RegSvcs.exe 2404 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2104 KUD.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2404 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2104 KUD.exe 2104 KUD.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2104 KUD.exe 2104 KUD.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2876 EXCEL.EXE 2876 EXCEL.EXE 2876 EXCEL.EXE 2876 EXCEL.EXE 2876 EXCEL.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2104 2616 EQNEDT32.EXE 29 PID 2616 wrote to memory of 2104 2616 EQNEDT32.EXE 29 PID 2616 wrote to memory of 2104 2616 EQNEDT32.EXE 29 PID 2616 wrote to memory of 2104 2616 EQNEDT32.EXE 29 PID 2104 wrote to memory of 2404 2104 KUD.exe 31 PID 2104 wrote to memory of 2404 2104 KUD.exe 31 PID 2104 wrote to memory of 2404 2104 KUD.exe 31 PID 2104 wrote to memory of 2404 2104 KUD.exe 31 PID 2104 wrote to memory of 2404 2104 KUD.exe 31 PID 2104 wrote to memory of 2404 2104 KUD.exe 31 PID 2104 wrote to memory of 2404 2104 KUD.exe 31 PID 2104 wrote to memory of 2404 2104 KUD.exe 31 PID 2104 wrote to memory of 2428 2104 KUD.exe 32 PID 2104 wrote to memory of 2428 2104 KUD.exe 32 PID 2104 wrote to memory of 2428 2104 KUD.exe 32 PID 2104 wrote to memory of 2428 2104 KUD.exe 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\ebe0db47f3d58129ded5690057c586c10adba99f5efea70eb2defd4be879d204.xlam1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2876
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Roaming\KUD.exe"C:\Users\Admin\AppData\Roaming\KUD.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Roaming\KUD.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 3163⤵
- Loads dropped DLL
- Program crash
PID:2428
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5ec3c46f793725d1ea03f9deb51455826
SHA166579dc2c1dce7b893124701df33079518af4d4c
SHA256ecb481c8a4b459b75e7678555f28e7cd693d8d7a5798516d5c2f7c3c2f93cfb6
SHA5122dd8cd8a7135e1175b527346ffe0139b4698d28885fc6e004c8b6732d8090c1d080489aaf6896930728f43af256409d2031ff2f488cbd83cac9b1b934aaa6bc8