Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	948
Target ID:	0
Parent PID:	584
Name:	EXCEL.EXE
Class:	excel
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Size:	27641504
MD5:	5FB0A0F93382ECD19F5F499A5CAA59F0
Time:	02:19:34
Date:	20/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13f710000
Modulesize:	27758592
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary,
Allocates a big amount of memory (probably used for heap spraying)	Software Vulnerabilities,	Extra Window Memory Injection
Spawns processes	System Summary,	Process Injection

C:\Windows\System32\rundll32.exe

rundll32 ..\BASE.BABAA,DllRegisterServer

Details

Is windows:	true
Is dropped:	false
PID:	2552
Target ID:	3
Parent PID:	948
Name:	rundll32.exe
Class:	rundll32
Path:	C:\Windows\System32\rundll32.exe
Commandline:	rundll32 ..\BASE.BABAA,DllRegisterServer
Size:	45568
MD5:	DD81D91FF3B0763C392422865C9AC12E
Time:	02:19:40
Date:	20/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xffc50000
Modulesize:	61440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected Trickbot	Stealing of Sensitive Information, Remote Access Functionality
Document exploit detected (process start blacklist hit)	Software Vulnerabilities,	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary,
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Runs a DLL by calling functions	System Summary,	Rundll32
Spawns processes	System Summary,	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary,

C:\Windows\SysWOW64\rundll32.exe

rundll32 ..\BASE.BABAA,DllRegisterServer

Details

Is windows:	true
Is dropped:	false
PID:	2504
Target ID:	4
Parent PID:	2552
Name:	rundll32.exe
Class:	system-tools
Path:	C:\Windows\SysWOW64\rundll32.exe
Commandline:	rundll32 ..\BASE.BABAA,DllRegisterServer
Size:	44544
MD5:	51138BEEA3E2C21EC44D0932C71762A8
Time:	02:19:40
Date:	20/02/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x9b0000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected Trickbot	Stealing of Sensitive Information, Remote Access Functionality
Document exploit detected (process start blacklist hit)	Software Vulnerabilities,	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary,
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Runs a DLL by calling functions	System Summary,	Rundll32
Spawns processes	System Summary,	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary,

C:\Windows\System32\wermgr.exe

C:\Windows\system32\wermgr.exe

Details

Is windows:	true
Is dropped:	false
PID:	2352
Target ID:	5
Parent PID:	2504
Name:	wermgr.exe
Path:	C:\Windows\System32\wermgr.exe
Commandline:	C:\Windows\system32\wermgr.exe
Size:	50688
MD5:	41DF7355A5A907E2C1D7804EC028965D
Time:	02:19:42
Date:	20/02/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xffc40000
Modulesize:	69632
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Spawns processes	System Summary,	Process Injection

C:\Windows\System32\wermgr.exe

C:\Windows\system32\wermgr.exe

Details

Is windows:	true
Is dropped:	false
PID:	2348
Target ID:	6
Parent PID:	2504
Name:	wermgr.exe
Path:	C:\Windows\System32\wermgr.exe
Commandline:	C:\Windows\system32\wermgr.exe
Size:	50688
MD5:	41DF7355A5A907E2C1D7804EC028965D
Time:	02:19:42
Date:	20/02/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xffc40000
Modulesize:	69632
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Spawns processes	System Summary,	Process Injection

C:\Windows\System32\rundll32.exe

C:\Windows\system32\rundll32.EXE 'C:\Users\user\AppData\Roaming\QNetMonitor8751465376\kiBASEzv.rrd',DllRegisterServer

Details

Is windows:	true
Is dropped:	false
PID:	1360
Target ID:	9
Parent PID:	2228
Name:	rundll32.exe
Class:	rundll32
Path:	C:\Windows\System32\rundll32.exe
Commandline:	C:\Windows\system32\rundll32.EXE 'C:\Users\user\AppData\Roaming\QNetMonitor8751465376\kiBASEzv.rrd',DllRegisterServer
Size:	45568
MD5:	DD81D91FF3B0763C392422865C9AC12E
Time:	02:21:34
Date:	20/02/2021
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xff6c0000
Modulesize:	61440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected Trickbot	Stealing of Sensitive Information, Remote Access Functionality
Document exploit detected (process start blacklist hit)	Software Vulnerabilities,	Exploitation for Client Execution
Sigma detected: Microsoft Office Product Spawning Windows Shell	System Summary,
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion,	Process Injection
Runs a DLL by calling functions	System Summary,	Rundll32
Spawns processes	System Summary,	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary,

C:\Windows\System32\taskeng.exe

taskeng.exe {C999D15C-7BEE-4793-989A-0EF4E6A22007} S-1-5-18:NT AUTHORITY\System:Service:

Details

Is windows:	true
Is dropped:	false
PID:	2228
Target ID:	8
Parent PID:	860
Name:	taskeng.exe
Path:	C:\Windows\System32\taskeng.exe
Commandline:	taskeng.exe {C999D15C-7BEE-4793-989A-0EF4E6A22007} S-1-5-18:NT AUTHORITY\System:Service:
Size:	464384
MD5:	65EA57712340C09B1B0C427B4848AE05
Time:	02:21:33
Date:	20/02/2021
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xffa20000
Modulesize:	475136
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary,	Process Injection

URLs

Name

Malicious

http://www.chipmania.it/mails/open.php

185.81.0.78

http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check

unknown

http://www.windows.com/pctv.

unknown

http://investor.msn.com

unknown

http://www.msnbc.com/news/ticker.txt

unknown

http://crl.pkioverheid.nl/DomOvLatestCRL.crl0

unknown

http://www.icra.org/vocabulary/.

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.

unknown

http://crl.entrust.net/server1.crl0

unknown

http://ocsp.entrust.net03

unknown

https://36.94.62.207/rob60/971342_W617601.BB08CBD1CB3BE0D331A29013BDDA57AE/14/NAT%20status/client%20

unknown

http://investor.msn.com/

unknown

http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0

unknown

http://www.%s.comPA

unknown

http://www.diginotar.nl/cps/pkioverheid0

unknown

http://windowsmedia.com/redir/services.asp?WMPFriendly=true

unknown

http://www.hotmail.com/oe

unknown

http://ocsp.entrust.net0D

unknown

https://36.94.62.207/rob60/971342_W617601.BB

unknown

http://wtfismyip.com/text

95.217.228.176

https://secure.comodo.com/CPS0

unknown

http://servername/isapibackend.dll

unknown

http://crl.entrust.net/2048ca.crl0

unknown

https://103.61.101.11:447/rob60/971342_W617601.BB08CBD1CB3BE0D331A29013BDDA57AE/5/pwgrab64/

unknown

There are 14 hidden URLs, click here to show them.

Domains

Name

Malicious

38.52.17.84.dnsbl-1.uceprotect.net

unknown

www.chipmania.it

unknown

Details

Name:	www.chipmania.it
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities,	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking,	Application Layer Protocol
Downloads files from webservers via HTTP	Networking,	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking,	Application Layer Protocol Non-Application Layer Protocol

chipmania.it

185.81.0.78

Details

Name:	chipmania.it
IP:	185.81.0.78
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities,	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities,	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking,	Application Layer Protocol
Downloads files from webservers via HTTP	Networking,	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking,	Application Layer Protocol Non-Application Layer Protocol

wtfismyip.com

95.217.228.176

Details

Name:	wtfismyip.com
IP:	95.217.228.176
TargetID:	6
Current Path:	C:\Windows\System32\wermgr.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
May check the online IP address of the machine	Networking,	System Network Configuration Discovery
Downloads files from webservers via HTTP	Networking,	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

38.52.17.84.zen.spamhaus.org

unknown

38.52.17.84.cbl.abuseat.org

unknown

38.52.17.84.b.barracudacentral.org

unknown

38.52.17.84.spam.dnsbl.sorbs.net

unknown

IPs

Domain

Country

Active

Malicious

103.61.101.11

unknown

India

unknown

Details

IP:	103.61.101.11
TargetID:	6
Current Path:	C:\Windows\System32\wermgr.exe
Country:	India
Countrycode:	IND
ASN number:	133647
ASN name:	ELXIREDATA-AS-INELXIREDATASERVICESPVTLTDIN
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking,
Detected TCP or UDP traffic on non-standard ports	Networking,	Non-Standard Port
Connects to IPs without corresponding DNS lookups	Networking,
Urls found in memory or binary data	Networking,

142.202.191.164

unknown

Reserved

unknown

Details

IP:	142.202.191.164
TargetID:	6
Current Path:	C:\Windows\System32\wermgr.exe
Country:	Reserved
Countrycode:	ZZZ
ASN number:	398019
ASN name:	DYNUUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking,
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities,	Exploitation for Client Execution
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking,
Connects to IPs without corresponding DNS lookups	Networking,

36.94.62.207

unknown

Indonesia

unknown

Details

IP:	36.94.62.207
TargetID:	6
Current Path:	C:\Windows\System32\wermgr.exe
Country:	Indonesia
Countrycode:	IDN
ASN number:	7713
ASN name:	TELKOMNET-AS-APPTTelekomunikasiIndonesiaID
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)	Networking,
Uses insecure TLS / SSL version for HTTPS connection	Compliance, Networking,
Connects to IPs without corresponding DNS lookups	Networking,
Urls found in memory or binary data	Networking,

95.217.228.176

unknown

Germany

unknown

Details

IP:	95.217.228.176
TargetID:	6
Current Path:	C:\Windows\System32\wermgr.exe
Country:	Germany
Countrycode:	DEU
ASN number:	24940
ASN name:	HETZNER-ASDE
Private:	false

185.81.0.78

unknown

Italy

unknown

Details

IP:	185.81.0.78
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Country:	Italy
Countrycode:	ITA
ASN number:	52030
ASN name:	SERVERPLAN-ASIT
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities,	Exploitation for Client Execution

194.5.249.156

unknown

Romania

unknown

Details

IP:	194.5.249.156
TargetID:	6
Current Path:	C:\Windows\System32\wermgr.exe
Country:	Romania
Countrycode:	ROU
ASN number:	64398
ASN name:	NXTHOST-64398NXTHOSTCOM-NXTSERVERSSRLRO
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking,

134.119.186.202

unknown

Germany

unknown

Details

IP:	134.119.186.202
TargetID:	6
Current Path:	C:\Windows\System32\wermgr.exe
Country:	Germany
Countrycode:	DEU
ASN number:	29066
ASN name:	VELIANET-ASvelianetInternetdiensteGmbHDE
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Connects to IPs without corresponding DNS lookups	Networking,

Registry

Path

Value

Malicious

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

q.7

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

MTTT

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ReviewToken

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

EC5FE

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

VBAFiles

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DefaultSheetR2L

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

UseSystemSeparators

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

ThousandsSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

DecimalSeparator

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Max Display

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Item 1

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOCReport

Files

Processes

URLs

Domains

IPs

Registry