Analysis Report INV9698791470-20210111920647.xlsm

Overview

General Information

Sample Name: INV9698791470-20210111920647.xlsm
Analysis ID: 338095
MD5: 9b7c2b0abf5478ef9a23d9a9e87c7835
SHA1: 6931c4b845a8a952699d9cf85b316e3b3d826a41
SHA256: a463f9a8842a5c947abaa2bff1b621835ff35f65f9d3272bf1fa5197df9f07d0

Most interesting Screenshot:

Detection

Hidden Macro 4.0 Dridex
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected Dridex e-Banking trojan
Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: BlueMashroom DLL Load
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Document contains an embedded VBA macro which may execute processes
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Machine Learning detection for dropped file
Office process drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: Regsvr32 Anomaly
Adds / modifies Windows certificates
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to query network adapater information
Contains functionality to read the PEB
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Drops PE files
Drops certificate files (DER)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains sections with non-standard names
PE file contains strange resources
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the installation date of Windows
Registers a DLL
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)

Classification

AV Detection:

barindex
Found malware configuration
Source: 4.2.regsvr32.exe.460000.2.unpack Malware Configuration Extractor: Dridex {"Config: ": ["--------------------------------------------------", "BOT ID", "--------------------------------------------------", "Bot id : 10444", "--------------------------------------------------", "IP Address table", "--------------------------------------------------", "Address count 4", "77.220.64.37:443", "80.86.91.27:3308", "5.100.228.233:3389", "46.105.131.65:1512"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\eb3kd1le[1].zip ReversingLabs: Detection: 32%
Source: C:\Users\user\AppData\Local\Temp\deibsjhv.dll ReversingLabs: Detection: 32%
Multi AV Scanner detection for submitted file
Source: INV9698791470-20210111920647.xlsm Virustotal: Detection: 29% Perma Link
Source: INV9698791470-20210111920647.xlsm ReversingLabs: Detection: 17%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\deibsjhv.dll Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\eb3kd1le[1].zip Joe Sandbox ML: detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49177 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49185 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49189 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49193 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49197 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49201 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49205 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49209 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49213 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49217 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49221 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49226 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49231 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49235 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49239 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49243 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49247 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49251 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49255 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49259 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49263 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49267 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49271 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49275 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49279 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49283 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49287 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49291 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49295 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49299 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49303 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49307 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49311 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49315 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49319 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49323 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49327 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49331 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49335 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49339 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49343 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49347 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49351 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49355 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49359 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49363 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49367 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49371 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49375 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49379 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49383 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49387 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49391 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49395 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49399 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49403 version: TLS 1.2
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0048CEF8 FindFirstFileExW, 4_2_0048CEF8

Software Vulnerabilities:

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\deibsjhv.dll Jump to behavior
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: eb3kd1le[1].zip.0.dr Jump to dropped file
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe Jump to behavior
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: inmindppe.com
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49168 -> 77.220.64.37:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 160.153.133.116:80

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49168
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49170
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49171
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49171
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49173
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49174
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49175
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49175
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49177
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49178
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49179
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49179
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49181
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49182
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49183
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49183
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49185
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49186
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49187
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49187
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49189
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49190
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49191
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49191
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49193
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49194
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49195
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49195
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49197
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49198
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49199
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49199
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49201
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49202
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49203
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49203
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49205
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49206
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49207
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49207
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49209
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49210
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49211
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49211
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49213
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49214
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49215
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49215
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49217
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49218
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49219
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49219
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49221
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49222
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49223
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49223
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49226
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49228
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49229
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49229
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49231
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49232
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49233
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49233
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49235
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49236
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49237
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49237
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49239
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49240
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49241
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49241
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49243
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49244
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49245
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49245
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49247
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49248
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49249
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49249
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49251
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49252
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49253
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49253
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49255
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49256
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49257
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49257
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49259
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49260
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49261
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49261
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49263
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49264
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49265
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49265
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49267
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49268
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49269
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49269
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49271
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49272
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49273
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49273
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49275
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49276
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49277
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49277
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49279
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49280
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49281
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49281
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49283
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49284
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49285
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49285
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49287
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49288
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49289
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49289
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49291
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49292
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49293
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49293
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49295
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49296
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49297
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49297
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49299
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49300
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49301
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49301
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49303
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49304
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49305
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49305
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49307
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49308
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49309
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49309
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49311
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49312
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49313
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49313
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49315
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49316
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49317
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49317
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49319
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49320
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49321
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49321
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49323
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49324
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49325
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49325
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49327
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49328
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49329
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49329
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49331
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49332
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49333
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49333
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49335
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49336
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49337
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49337
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49339
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49340
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49341
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49341
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49343
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49344
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49345
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49345
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49347
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49348
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49349
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49349
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49351
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49352
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49353
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49353
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49355
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49356
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49357
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49357
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49359
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49360
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49361
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49361
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49363
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49364
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49365
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49365
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49367
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49368
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49369
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49369
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49371
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49372
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49373
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49373
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49375
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49376
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49377
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49377
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49379
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49380
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49381
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49381
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49383
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49384
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49385
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49385
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49387
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49388
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49389
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49389
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49391
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49392
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49393
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49393
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49395
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49396
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49397
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49397
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49399
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49400
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49401
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49401
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49403
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49404
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49405
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49405
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49170 -> 80.86.91.27:3308
Source: global traffic TCP traffic: 192.168.2.22:49171 -> 5.100.228.233:3389
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 46.105.131.65:1512
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 77.220.64.37 77.220.64.37
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SENTIANL SENTIANL
Source: Joe Sandbox View ASN Name: GD-EMEA-DC-SXB1DE GD-EMEA-DC-SXB1DE
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: eb88d0b3e1961a0562f006e5ce2a0b87
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /eb3kd1le.zip HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: inmindppe.comConnection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004939F9 InternetReadFile, 4_2_004939F9
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\28E159F7.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /eb3kd1le.zip HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: inmindppe.comConnection: Keep-Alive
Source: regsvr32.exe, 00000004.00000002.2382308141.00000000003F1000.00000004.00000020.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com$T equals www.linkedin.com (Linkedin)
Source: DWWIN.EXE, 00000006.00000002.2233596594.0000000003540000.00000002.00000001.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: regsvr32.exe, 00000004.00000002.2382308141.00000000003F1000.00000004.00000020.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230885971.0000000002904000.00000004.00000001.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: inmindppe.com
Source: 3C428B1A3E5F57D887EC4B864FAC5DCC.6.dr String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: DWWIN.EXE, 00000006.00000002.2230867623.00000000028E3000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: DWWIN.EXE, 00000006.00000003.2228827682.000000000292D000.00000004.00000001.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crtF
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000003.2228989819.0000000000538000.00000004.00000001.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000003.2228989819.0000000000538000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230885971.0000000002904000.00000004.00000001.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230885971.0000000002904000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230885971.0000000002904000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230885971.0000000002904000.00000004.00000001.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: DWWIN.EXE, 00000006.00000002.2230867623.00000000028E3000.00000004.00000001.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: DWWIN.EXE, 00000006.00000002.2230867623.00000000028E3000.00000004.00000001.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2229399297.00000000004F8000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.4.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: DWWIN.EXE, 00000006.00000003.2228898902.00000000004CE000.00000004.00000001.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enRa
Source: DWWIN.EXE, 00000006.00000002.2233596594.0000000003540000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com
Source: DWWIN.EXE, 00000006.00000002.2233596594.0000000003540000.00000002.00000001.sdmp String found in binary or memory: http://investor.msn.com/
Source: DWWIN.EXE, 00000006.00000002.2233949552.0000000003727000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: DWWIN.EXE, 00000006.00000002.2233949552.0000000003727000.00000002.00000001.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230885971.0000000002904000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230821082.0000000002898000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230885971.0000000002904000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230885971.0000000002904000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000003.2228989819.0000000000538000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: DWWIN.EXE, 00000006.00000002.2230867623.00000000028E3000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230885971.0000000002904000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000003.2228989819.0000000000538000.00000004.00000001.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.2382894388.0000000002180000.00000002.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2234299675.00000000041C0000.00000002.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.2382287592.0000000001CA0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2382544671.0000000001D80000.00000002.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2230070826.0000000002360000.00000002.00000001.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: DWWIN.EXE, 00000006.00000002.2233949552.0000000003727000.00000002.00000001.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: DWWIN.EXE, 00000006.00000002.2233949552.0000000003727000.00000002.00000001.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000004.00000002.2382894388.0000000002180000.00000002.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2234299675.00000000041C0000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000003.2228989819.0000000000538000.00000004.00000001.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000002.2230885971.0000000002904000.00000004.00000001.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: DWWIN.EXE, 00000006.00000002.2233596594.0000000003540000.00000002.00000001.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: DWWIN.EXE, 00000006.00000002.2233949552.0000000003727000.00000002.00000001.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: DWWIN.EXE, 00000006.00000002.2233596594.0000000003540000.00000002.00000001.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: DWWIN.EXE, 00000006.00000002.2233596594.0000000003540000.00000002.00000001.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp String found in binary or memory: https://46.105.131.65/
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp String found in binary or memory: https://46.105.131.65/D
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp String found in binary or memory: https://5.100.228.233/
Source: regsvr32.exe, 00000004.00000002.2382308141.00000000003F1000.00000004.00000020.sdmp String found in binary or memory: https://77.220.64.37/
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp String found in binary or memory: https://80.86.91.27/
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp String found in binary or memory: https://80.86.91.27/h
Source: regsvr32.exe, 00000004.00000002.2382325199.000000000041E000.00000004.00000020.sdmp, DWWIN.EXE, 00000006.00000003.2228989819.0000000000538000.00000004.00000001.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 49351 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49226
Source: unknown Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49347
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49189
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49343
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49221
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown Network traffic detected: HTTP traffic on port 49359 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown Network traffic detected: HTTP traffic on port 49339 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49279 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49271 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49339
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49217
Source: unknown Network traffic detected: HTTP traffic on port 49327 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49335
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49213
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49299
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49331
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49295
Source: unknown Network traffic detected: HTTP traffic on port 49319 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown Network traffic detected: HTTP traffic on port 49379 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49291
Source: unknown Network traffic detected: HTTP traffic on port 49371 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49213 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49259 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49209
Source: unknown Network traffic detected: HTTP traffic on port 49347 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49251 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49327
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49205
Source: unknown Network traffic detected: HTTP traffic on port 49267 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49399 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49323
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49201
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49287
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49283
Source: unknown Network traffic detected: HTTP traffic on port 49391 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49231 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49363 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49315 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49193 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49239 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49319
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49315
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49279
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49311
Source: unknown Network traffic detected: HTTP traffic on port 49295 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49399
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49275
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49395
Source: unknown Network traffic detected: HTTP traffic on port 49247 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49271
Source: unknown Network traffic detected: HTTP traffic on port 49335 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49391
Source: unknown Network traffic detected: HTTP traffic on port 49205 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49307 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49307
Source: unknown Network traffic detected: HTTP traffic on port 49383 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49303
Source: unknown Network traffic detected: HTTP traffic on port 49303 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49267
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49387
Source: unknown Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49263
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49383
Source: unknown Network traffic detected: HTTP traffic on port 49189 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49355 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49275 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49375 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49259
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49379
Source: unknown Network traffic detected: HTTP traffic on port 49323 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49255
Source: unknown Network traffic detected: HTTP traffic on port 49287 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49375
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49251
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49371
Source: unknown Network traffic detected: HTTP traffic on port 49255 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49343 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49217 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49247
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49367
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49243
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49363
Source: unknown Network traffic detected: HTTP traffic on port 49263 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49395 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49209 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49221 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49197 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49283 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49311 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49235 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49367 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49239
Source: unknown Network traffic detected: HTTP traffic on port 49243 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49359
Source: unknown Network traffic detected: HTTP traffic on port 49291 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49235
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49355
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49231
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49197
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49351
Source: unknown Network traffic detected: HTTP traffic on port 49331 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49193
Source: unknown Network traffic detected: HTTP traffic on port 49226 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49387 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49299 -> 443
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49173 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49177 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49181 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49185 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49189 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49193 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49197 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49201 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49205 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49209 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49213 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49217 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49221 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49226 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49231 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49235 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49239 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49243 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49247 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49251 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49255 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49259 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49263 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49267 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49271 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49275 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49279 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49283 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49287 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49291 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49295 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49299 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49303 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49307 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49311 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49315 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49319 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49323 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49327 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49331 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49335 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49339 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49343 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49347 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49351 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49355 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49359 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49363 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49367 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49371 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49375 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49379 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49383 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49387 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49391 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49395 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49399 version: TLS 1.2
Source: unknown HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49403 version: TLS 1.2

E-Banking Fraud:

barindex
Detected Dridex e-Banking trojan
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00465150 OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,LoadLibraryW, 4_2_00465150
Drops certificate files (DER)
Source: C:\Windows\System32\DWWIN.EXE File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC Jump to dropped file

System Summary:

barindex
Document contains an embedded VBA macro which may execute processes
Source: VBA code instrumentation OLE, VBA macro: Module Module1, Function pagesREviewsd, API Run("moreP_ab") Name: pagesREviewsd
Source: VBA code instrumentation OLE, VBA macro: Module Module1, Function pagesREviewsd, API Run("moreP_ab") Name: pagesREviewsd
Found Excel 4.0 Macro with suspicious formulas
Source: INV9698791470-20210111920647.xlsm Initial sample: CALL
Source: INV9698791470-20210111920647.xlsm Initial sample: CALL
Source: INV9698791470-20210111920647.xlsm Initial sample: CALL
Source: INV9698791470-20210111920647.xlsm Initial sample: CALL
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\eb3kd1le[1].zip Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\deibsjhv.dll Jump to dropped file
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Contains functionality to call native functions
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004722A0 NtDelayExecution, 4_2_004722A0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0048BE30 NtClose, 4_2_0048BE30
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001FB770 VirtualAlloc,VirtualAlloc,NtSetInformationProcess, 4_2_001FB770
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001FBA14 NtSetInformationProcess, 4_2_001FBA14
Detected potential crypto function
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00465150 4_2_00465150
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00481020 4_2_00481020
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047D030 4_2_0047D030
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004788C0 4_2_004788C0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00478CC0 4_2_00478CC0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0046ACD0 4_2_0046ACD0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047A0D0 4_2_0047A0D0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004798DA 4_2_004798DA
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047E0A0 4_2_0047E0A0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0048DCA0 4_2_0048DCA0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004850A0 4_2_004850A0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00484CA0 4_2_00484CA0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00485CB0 4_2_00485CB0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00477564 4_2_00477564
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00461570 4_2_00461570
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047FDD0 4_2_0047FDD0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004889F0 4_2_004889F0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004871F0 4_2_004871F0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047D980 4_2_0047D980
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0048D180 4_2_0048D180
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047C590 4_2_0047C590
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0046F9A0 4_2_0046F9A0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00481240 4_2_00481240
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047A660 4_2_0047A660
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00487660 4_2_00487660
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00482E60 4_2_00482E60
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00469E70 4_2_00469E70
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00479E70 4_2_00479E70
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0046CA10 4_2_0046CA10
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0048FA10 4_2_0048FA10
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00480220 4_2_00480220
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0048D620 4_2_0048D620
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00483EC0 4_2_00483EC0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0048FA10 4_2_0048FA10
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00466AD0 4_2_00466AD0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004796D0 4_2_004796D0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047F6E0 4_2_0047F6E0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047B6F0 4_2_0047B6F0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00478EF0 4_2_00478EF0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004862F0 4_2_004862F0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047AE80 4_2_0047AE80
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00478AB0 4_2_00478AB0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00481EB0 4_2_00481EB0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004826B0 4_2_004826B0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047BF50 4_2_0047BF50
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00475B60 4_2_00475B60
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00483B00 4_2_00483B00
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00489B10 4_2_00489B10
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00481730 4_2_00481730
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004783C0 4_2_004783C0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00477FC0 4_2_00477FC0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00487FC0 4_2_00487FC0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_004767C8 4_2_004767C8
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0047E3F0 4_2_0047E3F0
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: INV9698791470-20210111920647.xlsm OLE, VBA macro line: Private Sub view_1_a_Layout(ByVal Index As Long)
Source: VBA code instrumentation OLE, VBA macro: Module Sheet1, Function view_1_a_Layout Name: view_1_a_Layout
Document contains embedded VBA macros
Source: INV9698791470-20210111920647.xlsm OLE indicator, VBA macros: true
One or more processes crash
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1804
PE file contains strange resources
Source: eb3kd1le[1].zip.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: eb3kd1le[1].zip.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: eb3kd1le[1].zip.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: eb3kd1le[1].zip.0.dr Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DWWIN.EXE, 00000006.00000002.2233596594.0000000003540000.00000002.00000001.sdmp Binary or memory string: .VBPud<_
Source: classification engine Classification label: mal100.bank.expl.evad.winXLSM@9/21@1/5
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$INV9698791470-20210111920647.xlsm Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2432
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRD345.tmp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: INV9698791470-20210111920647.xlsm Virustotal: Detection: 29%
Source: INV9698791470-20210111920647.xlsm ReversingLabs: Detection: 17%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\deibsjhv.dll.
Source: unknown Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\deibsjhv.dll.
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1804
Source: unknown Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 1804
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\deibsjhv.dll. Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1804 Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\deibsjhv.dll. Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 1804 Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{713AACC8-3B71-435C-A3A1-BE4E53621AB1}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Automated click: OK
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: INV9698791470-20210111920647.xlsm Initial sample: OLE zip file path = xl/media/image2.png
Source: INV9698791470-20210111920647.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: INV9698791470-20210111920647.xlsm Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10002140 LoadLibraryA,GetProcAddress,VirtualAlloc,VirtualAlloc,VirtualAlloc, 4_2_10002140
PE file contains sections with non-standard names
Source: eb3kd1le[1].zip.0.dr Static PE information: section name: .rdata3
Source: eb3kd1le[1].zip.0.dr Static PE information: section name: .2
Source: eb3kd1le[1].zip.0.dr Static PE information: section name: .rdata2
Source: eb3kd1le[1].zip.0.dr Static PE information: section name: .text4
Registers a DLL
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\deibsjhv.dll.
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000400A push esi; retf 4_2_1000401D
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10010810 pushfd ; retf 4_2_1001084E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000D856 push ebp; retf 4_2_1000D85E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000E8F3 pushad ; iretd 4_2_1000E8F4
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10002140 push ecx; ret 4_2_100021B6
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1001CD9B push esp; retf 4_2_1001CDB0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000C265 push 588A19FDh; iretd 4_2_1000C278
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10020A73 push edx; iretd 4_2_10020A9C
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000FEBF push eax; iretd 4_2_1000FEC0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000FEFA push 00000000h; iretd 4_2_1000FF10
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10023EFF push eax; iretd 4_2_10023F64
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000C304 push 588A1BCDh; iretd 4_2_1000C314
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10010307 push esp; retf 4_2_10010308
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000CF15 push 0000002Dh; iretd 4_2_1000CF1C
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1001DB23 push eax; iretd 4_2_1001DB34
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10020B27 push eax; iretd 4_2_10020B28
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_1000DFC7 pushad ; iretd 4_2_1000DFC8
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10023FEB push edx; ret 4_2_10024001
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_100107FB pushfd ; retf 4_2_1001084E
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001FBFA0 push edx; ret 4_2_001FC259
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001C7172 push dword ptr [ebp+ecx*8-49h]; retf 4_2_001C7176
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001E62CD pushad ; iretd 4_2_001E62E5
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001DF6CD push esi; ret 4_2_001DF6D7
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001C899D push 00000369h; ret 4_2_001C8A28
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001C89CD push 00000369h; ret 4_2_001C8A28
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001EFB74 push esi; ret 4_2_001EFB8B
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001C1D11 push FFFFFFD5h; ret 4_2_001C1D18
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001C0E8F push esi; ret 4_2_001C0E94

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\eb3kd1le[1].zip Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\deibsjhv.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\eb3kd1le[1].zip Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\regsvr32.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001D88DD rdtsc 4_2_001D88DD
Contains functionality to query network adapater information
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,LoadLibraryW, 4_2_00465150
Found dropped PE file which has not been started or loaded
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\eb3kd1le[1].zip Jump to dropped file
Found evasive API chain checking for process token information
Source: C:\Windows\SysWOW64\regsvr32.exe Check user administrative privileges: GetTokenInformation,DecisionNodes
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2704 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -792000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -510000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -845000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -341000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -610000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -816000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -1169000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -351000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -146000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -306000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -304000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -354000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -414000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -314000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -335000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -474000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -840000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -586000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -260000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -519000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -248000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -512000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -484000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -328000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -660000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -462000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -447000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -307000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -1062000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -620000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -584000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -306000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -302000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -332000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -359000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -348000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -972000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -698000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -528000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -320000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -592000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -342000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -665000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -560000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -508000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -134000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -600000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -252000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -516000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -534000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -270000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -369000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -301000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -1011000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -342000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -429000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -252000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -664000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -310000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -384000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -284000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -426000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -179000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -250000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -245000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -278000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -1113000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -522000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -273000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -635000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -294000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -129000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -298000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -331000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -290000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -548000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -525000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -262000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -125000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -295000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -285000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -163000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -325000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -312000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -290000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -334000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -317000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -275000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -484000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -271000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -319000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -165000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -141000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -299000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -279000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -241000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -282000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1276 Thread sleep time: -288000s >= -30000s Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE TID: 2712 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_0048CEF8 FindFirstFileExW, 4_2_0048CEF8
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00473930 GetTokenInformation,GetTokenInformation,GetSystemInfo,GetTokenInformation, 4_2_00473930
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001D88DD rdtsc 4_2_001D88DD
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00476C50 LdrLoadDll, 4_2_00476C50
Contains functionality to dynamically determine API calls
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_10002140 LoadLibraryA,GetProcAddress,VirtualAlloc,VirtualAlloc,VirtualAlloc, 4_2_10002140
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001FB5D0 mov eax, dword ptr fs:[00000030h] 4_2_001FB5D0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_001FB6D0 mov eax, dword ptr fs:[00000030h] 4_2_001FB6D0
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00477A60 RtlAddVectoredExceptionHandler, 4_2_00477A60

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 80.86.91.27 236 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 5.100.228.233 61 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 46.105.131.65 232 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 77.220.64.37 187 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\deibsjhv.dll. Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 1804 Jump to behavior
Source: regsvr32.exe, 00000003.00000002.2382209582.00000000008A0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2382512922.0000000000980000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: regsvr32.exe, 00000003.00000002.2382209582.00000000008A0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2382512922.0000000000980000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: regsvr32.exe, 00000003.00000002.2382209582.00000000008A0000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2382512922.0000000000980000.00000002.00000001.sdmp Binary or memory string: !Progman

Language, Device and Operating System Detection:

barindex
Queries the installation date of Windows
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Code function: 4_2_00472980 GetUserNameW, 4_2_00472980
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Adds / modifies Windows certificates
Source: C:\Windows\SysWOW64\regsvr32.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 Blob Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 338095 Sample: INV9698791470-20210111920647.xlsm Startdate: 11/01/2021 Architecture: WINDOWS Score: 100 40 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->40 42 Found malware configuration 2->42 44 Multi AV Scanner detection for dropped file 2->44 46 9 other signatures 2->46 7 EXCEL.EXE 200 66 2->7         started        process3 dnsIp4 34 inmindppe.com 160.153.133.116, 49167, 80 GODADDY-AMSDE United States 7->34 22 C:\Users\user\AppData\Local\...\deibsjhv.dll, PE32 7->22 dropped 24 C:\Users\user\AppData\...\eb3kd1le[1].zip, PE32 7->24 dropped 26 C:\...\~$INV9698791470-20210111920647.xlsm, data 7->26 dropped 48 Document exploit detected (creates forbidden files) 7->48 50 Document exploit detected (process start blacklist hit) 7->50 52 Document exploit detected (UrlDownloadToFile) 7->52 12 regsvr32.exe 7->12         started        14 DW20.EXE 7->14         started        file5 signatures6 process7 process8 16 regsvr32.exe 11 12->16         started        20 DWWIN.EXE 4 6 14->20         started        dnsIp9 28 5.100.228.233, 3389, 49171, 49175 SENTIANL Netherlands 16->28 30 46.105.131.65, 1512, 49172, 49176 OVHFR France 16->30 32 2 other IPs or domains 16->32 36 System process connects to network (likely due to code injection or exploit) 16->36 38 Detected Dridex e-Banking trojan 16->38 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
5.100.228.233
 unknown Netherlands
8315 SENTIANL true
80.86.91.27
 unknown Germany
8972 GD-EMEA-DC-SXB1DE true
160.153.133.116
 unknown United States
21501 GODADDY-AMSDE false
46.105.131.65
 unknown France
16276 OVHFR true
77.220.64.37
 unknown Italy
44160 INTERNETONEInternetServicesProviderIT true

Contacted Domains

Name IP Active
cdn.digicertcdn.com 104.18.10.39 true
inmindppe.com 160.153.133.116 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://inmindppe.com/eb3kd1le.zip false
  • Avira URL Cloud: safe
 unknown