Analysis
-
max time kernel
55s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
18/03/2025, 21:12
General
-
Target
9fc9ab72085405111c0613da38febc307a5b6522bdc80148aa24b6cf6efb58a4.xls
-
Size
231KB
-
MD5
6fc2ce494c726d2c5f336ceaa03d2584
-
SHA1
fddecbf75cf406c61285126cff6cd6ab290e09ea
-
SHA256
9fc9ab72085405111c0613da38febc307a5b6522bdc80148aa24b6cf6efb58a4
-
SHA512
5c73880d370360416cf5b60d11c6f82751a2d7cea041e8edc71823dc417f61b5d1393071639dc9fe099eba8c23941cf180cadba90bc003c47a97484f956bfa09
-
SSDEEP
6144:4Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dgJ2IS7FgiJsJ4BR5043yVuBCMmnqLsCv:OzGiK4504Sy/mnqoCv
Malware Config
Extracted
http://188.127.235.244/45734.8835635417.dat
http://193.38.54.244/45734.8835635417.dat
http://185.82.217.213/45734.8835635417.dat
http://45734.8835635417.dat
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9fc9ab72085405111c0613da38febc307a5b6522bdc80148aa24b6cf6efb58a4.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\Rundll32.exeRundll32 ..\Kiod.hod,DllRegisterServer2⤵
- Process spawned unexpected child process
-
-
C:\Windows\SYSTEM32\Rundll32.exeRundll32 ..\Kiod.hod1,DllRegisterServer2⤵
- Process spawned unexpected child process
-
-
C:\Windows\SYSTEM32\Rundll32.exeRundll32 ..\Kiod.hod2,DllRegisterServer2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD583523e57af8b6bca69ab456f9fe55a8d
SHA174d23ef2df1dff747f3c9e6a0ea5e65128177ab9
SHA256c00a5205d34594d0f7b8b48cfd5c6796640be1b58d0db8841be5b8ab253ac0a9
SHA512e3509a49b3bd81b86acf5a556d8d672932aa681bb24b132ce094859e5e8aabb1598b5d62e558cdd7a27e3d1f15bb5d81587705ac2e435b9273c6dec056318d4f
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB