Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
18/02/2025, 21:33
General
-
Target
3217397c6b12d88b5039a4c42848d8a6b03c37ecf322d9cf0836eebacc81149f.xlam
-
Size
157KB
-
MD5
164f7996b586499ba1ebdb8e10f5581e
-
SHA1
72c005e12d9ee2c33c161c37eccbea2b7922be12
-
SHA256
3217397c6b12d88b5039a4c42848d8a6b03c37ecf322d9cf0836eebacc81149f
-
SHA512
c88a1c95dc83bf8bbacbd93cf9d9519a23de7e0158c8f39b2a371963e58eba25610562097c9d679f868e7aa0799cc4bb91e78acf8b82a9d8d09e7c8bdf6e0790
-
SSDEEP
3072:FMKu+tcIroKu3COaWgPn8/wa+5pbthx0cLKCFj8Q8YwzpsYc4o+1HBZGBG:FM3nIrhu3Pa//tLvmQopcnqhZ6G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 20 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3217397c6b12d88b5039a4c42848d8a6b03c37ecf322d9cf0836eebacc81149f.xlam"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Exl-9\jivarthr edis.exe"C:\Users\Admin\Exl-9\jivarthr edis.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5afc4e11b0d104ebdb0bfb869803e99bb
SHA1794e9a2f6dd374d0ff6d74faa1d87a7a2a7b6d30
SHA256d1d6b2dbb200321b0d69db262591a8ee2d7e2c7320d11fc67fc11244206736c2
SHA5123e46cd662af47e69623978e03158a2da59c6624acb37c67726c1377caf3d711498fec6bf3eafd4a76be6af3be887bd19d98d020b7e52fc69ec96854cf3398d44
-
Filesize
157KB
MD5164f7996b586499ba1ebdb8e10f5581e
SHA172c005e12d9ee2c33c161c37eccbea2b7922be12
SHA2563217397c6b12d88b5039a4c42848d8a6b03c37ecf322d9cf0836eebacc81149f
SHA512c88a1c95dc83bf8bbacbd93cf9d9519a23de7e0158c8f39b2a371963e58eba25610562097c9d679f868e7aa0799cc4bb91e78acf8b82a9d8d09e7c8bdf6e0790
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
15.8MB
MD5fed22809d70062733cd1c34e16b75c05
SHA14520676983fcc20cfc4ca5be1e2a7566f3491ffb
SHA256947e75dc1f9b8a6d74a6d55afa7513ed86db907965cf0935ebb26c17f0ec6c5d
SHA512b0f54b6e3d5917e9aebab614391ec8f1bb8c00ba9d366f707e02fa17582f4f7101aefa434291fd031d5bd0407c06dd2ed9fbabe5d7e8f5bd34bdb0240529c98d
-
Filesize
410KB
MD54eafa3bec4035e667774d517b2a2ebdb
SHA1d34821f5a1a44d67f2da23e10d8e3846dec1645e
SHA256edfe70cd0ebde54c87f6913958a66519c273b7f75dbd1dc4a3da9dd3a3e8e3e6
SHA512fcd7408ab154cb9a5f5fb66c2c3966ab8921dff8b1cb5dcb98ffa18bff2c069cd6b752695dfaed6398d4e248b455e8b151b5267a1f45d715227bfb9222306f42
-
Filesize
2.0MB
-
Filesize
32KB
-
Filesize
624KB
-
Filesize
4.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB