Overview
overview
3Static
static
3Odin Downl...s.xlsx
windows7-x64
3Odin Downl...s.xlsx
windows10-1703-x64
1Odin Downl...s.xlsx
windows10-2004-x64
1Odin Downl...s.xlsx
windows11-21h2-x64
1Odin3 v3.13.1.exe
windows7-x64
3Odin3 v3.13.1.exe
windows10-1703-x64
3Odin3 v3.13.1.exe
windows10-2004-x64
3Odin3 v3.13.1.exe
windows11-21h2-x64
3S1PlugIn.b...19.zip
windows7-x64
1S1PlugIn.b...19.zip
windows10-1703-x64
1S1PlugIn.b...19.zip
windows10-2004-x64
1S1PlugIn.b...19.zip
windows11-21h2-x64
1SS_DL.dll
windows7-x64
3SS_DL.dll
windows10-1703-x64
3SS_DL.dll
windows10-2004-x64
3SS_DL.dll
windows11-21h2-x64
3Resubmissions
29/09/2024, 15:11
240929-sk3npaseqc 329/09/2024, 15:08
240929-sh684aygkk 329/09/2024, 15:07
240929-shbr7ayfqn 7Analysis
-
max time kernel
300s -
max time network
202s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
29/09/2024, 15:08
Static task
static1
Behavioral task
behavioral1
Sample
Odin Downloader Release Notes.xlsx
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Odin Downloader Release Notes.xlsx
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Odin Downloader Release Notes.xlsx
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Odin Downloader Release Notes.xlsx
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
Odin3 v3.13.1.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Odin3 v3.13.1.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Odin3 v3.13.1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
Odin3 v3.13.1.exe
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
S1PlugIn.bundle_20171019.zip
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
S1PlugIn.bundle_20171019.zip
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
S1PlugIn.bundle_20171019.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
S1PlugIn.bundle_20171019.zip
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
SS_DL.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
SS_DL.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
SS_DL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
SS_DL.dll
Resource
win11-20240802-en
General
-
Target
Odin Downloader Release Notes.xlsx
-
Size
874KB
-
MD5
e792e1676d7127f5b5453ea8c2364e40
-
SHA1
ab59798f402ccdcf4a6502251d2bd92a386a17ca
-
SHA256
eb74fc58600168031c50a26262858afdd5427544d881fb6b45e707ffe9624d51
-
SHA512
71fdd50adcd178251a708a09c0ba283b508b27feb0494f3355325665e038e35078bf61b5a451a6fab298d0172842b46d0ee5f5b4f3b291ddb166458e5886ec1c
-
SSDEEP
24576:wO3vdVrGWYV3KFF1i4jhGx6TzUIDrt9oqc3Ssm9+:wGv7rGWY2F1t0xqrt9DCZn
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2832 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2832 EXCEL.EXE 2832 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2832 EXCEL.EXE 2832 EXCEL.EXE 2832 EXCEL.EXE 2832 EXCEL.EXE 2832 EXCEL.EXE 2832 EXCEL.EXE 2832 EXCEL.EXE 2832 EXCEL.EXE 2832 EXCEL.EXE 2832 EXCEL.EXE 2832 EXCEL.EXE 2832 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Odin Downloader Release Notes.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD54844d49ecb4e20d4594aaeb475f296ef
SHA150c8da266fc6f2ed49e98a6541fc0d6787c7b9db
SHA25609326cfcf99f074a2e0b87c17050aa1be5f03f371ae8b7f1a46b95b47fc3db9c
SHA512a697206e04248ef802b6b7f36ff7d41765ca29fcf2065c7f364c59d3710ad3aff5f80b26df47fc7a1bdfbad54296de744284947d60ce42fb09838636e44744d5