IOCReport

loading gif

Files

File Path
Type
Category
Malicious
documents-2112491607.xlsm
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\index[1].htm
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
downloaded
 malicious
C:\Users\user\Desktop\~$documents-2112491607.xlsm
data
dropped
 malicious
C:\Users\user\oeiwkd4.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\45BFE498.png
PNG image data, 205 x 58, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\4647BF2F.png
PNG image data, 364 x 139, 8-bit/color RGBA, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\52AB2BB9.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\AB2DEE66.png
PNG image data, 24 x 24, 8-bit/color RGB, non-interlaced
dropped
 clean
C:\Users\user\AppData\Local\Temp\FBCE0000
data
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Wed Apr 7 15:14:37 2021, atime=Wed Apr 7 15:14:37 2021, length=8192, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\documents-2112491607.LNK
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:15 2020, mtime=Wed Apr 7 15:14:37 2021, atime=Wed Apr 7 15:14:37 2021, length=96847, window=hide
dropped
 clean
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat
ASCII text, with CRLF line terminators
dropped
 clean
C:\Users\user\Desktop\ECCE0000
data
dropped
 clean
There are 3 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
 malicious
C:\Windows\System32\regsvr32.exe
regsvr32 -s ..\oeiwkd
 malicious
C:\Windows\System32\regsvr32.exe
regsvr32 -s
malicious
C:\Windows\System32\regsvr32.exe
regsvr32 -s
malicious
C:\Windows\System32\regsvr32.exe
regsvr32 -s
malicious
C:\Windows\System32\regsvr32.exe
regsvr32 -s
malicious

URLs

Name
IP
Malicious
http://kautilyaclasses.com/ds/index.html
192.185.56.250
 malicious
http://bodylanguage.santulan.co.in/ds/index.html
111.118.215.222
 malicious
http://kullumanalitours.com/ds/index.html
103.211.216.55
 malicious
http://corwin-tommie06f.ru.com/index.html
8.211.4.209
 clean
http://katelynn9506a.ru.com/index.html
8.211.4.209
 clean
http://servername/isapibackend.dll
unknown
 clean

Domains

Name
IP
Malicious
bodylanguage.santulan.co.in
111.118.215.222
 malicious
kautilyaclasses.com
192.185.56.250
 clean
corwin-tommie06f.ru.com
8.211.4.209
 clean
katelynn9506a.ru.com
8.211.4.209
 clean
kullumanalitours.com
103.211.216.55
 clean

IPs

IP
Domain
Country
Malicious
111.118.215.222
bodylanguage.santulan.co.in
India
malicious
103.211.216.55
kullumanalitours.com
Seychelles
clean
192.185.56.250
kautilyaclasses.com
United States
clean
8.211.4.209
corwin-tommie06f.ru.com
Singapore
clean

Registry

Path
Value
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
d 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
MTTT
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ReviewToken
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EC800
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
VBAFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DefaultSheetR2L
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
UseSystemSeparators
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ThousandsSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
DecimalSeparator
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ECB2C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ECC92
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ECD7C
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
{E7E4BC40-E76A-11CE-A9BB-00AA004AE837} {000214E6-0000-0000-C000-000000000046} 0xFFFF
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
7*4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F693E
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Max Display
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 1
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 3
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 4
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 5
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 6
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 7
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 8
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 9
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 10
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 11
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 12
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 13
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 14
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 15
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 16
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 17
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 18
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 19
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Item 20
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
F79B2
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
LastPurgeTime
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
EXCELFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_3082
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1036
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SpellingAndGrammarFiles_1033
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
ProductFiles
 clean
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
SavedLegacySettings
 clean
There are 95 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
70000
unkown
page read and write
 clean
70000
unkown
page readonly
 clean
4F0000
unkown
page readonly
 clean
20000
unkown
page readonly
 clean
A4000
heap private
page read and write
 clean
506000
unkown
page read and write
 clean
28C000
unkown
page read and write
 clean
570000
unkown
page readonly
 clean
470000
heap default
page read and write
 clean
4C3000
heap default
page read and write
 clean
2CA000
heap default
page read and write
 clean
4CA000
heap default
page read and write
 clean
370000
unkown
page read and write
 clean
24A000
heap default
page read and write
 clean
477000
heap default
page read and write
 clean
2085000
heap private
page read and write
 clean
190000
heap private
page read and write
 clean
A0000
heap private
page read and write
 clean
F0000
unkown
page readonly
 clean
1CF0000
unkown
page readonly
 clean
247000
heap default
page read and write
 clean
5D0000
unkown
page readonly
 clean
80000
unkown
page read and write
 clean
1A0000
heap private
page read and write
 clean
1C90000
unkown
page readonly
 clean
510000
unkown
page read and write
 clean
790000
unkown
page readonly
 clean
243000
heap default
page read and write
 clean
4A6000
unkown
page read and write
 clean
1EE000
heap default
page read and write
 clean
4C0000
heap private
page read and write
 clean
BC000
unkown
page read and write
 clean
1B7000
heap default
page read and write
 clean
20000
unkown
page readonly
 clean
1D4000
heap private
page read and write
 clean
6F0000
unkown
page readonly
 clean
270000
heap default
page read and write
 clean
1D0000
heap private
page read and write
 clean
80000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
2C3000
heap default
page read and write
 clean
2100000
unkown
page readonly
 clean
2F0000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
3F0000
unkown
page read and write
 clean
4D0000
unkown
page read and write
 clean
326000
unkown
page read and write
 clean
446000
unkown
page read and write
 clean
20000
unkown
page readonly
 clean
20BB000
heap private
page read and write
 clean
136000
unkown
page read and write
 clean
610000
unkown
page readonly
 clean
410000
unkown
page read and write
 clean
90000
heap private
page read and write
 clean
130000
unkown
page readonly
 clean
320000
unkown
page read and write
 clean
27E000
heap default
page read and write
 clean
356000
unkown
page read and write
 clean
470000
unkown
page read and write
 clean
94000
heap private
page read and write
 clean
1F7000
heap default
page read and write
 clean
3A6000
unkown
page read and write
 clean
750000
unkown
page readonly
 clean
750000
heap private
page read and write
 clean
2080000
heap private
page read and write
 clean
29A000
heap default
page read and write
 clean
1E0000
heap private
page read and write
 clean
293000
heap default
page read and write
 clean
160000
unkown
page read and write
 clean
1D30000
unkown
page readonly
 clean
570000
unkown
page readonly
 clean
2AE000
heap default
page read and write
 clean
203000
heap default
page read and write
 clean
22E000
heap default
page read and write
 clean
277000
heap default
page read and write
 clean
400000
heap private
page read and write
 clean
426000
unkown
page read and write
 clean
6F0000
unkown
page readonly
 clean
546000
unkown
page read and write
 clean
170000
unkown
page read and write
 clean
1B0000
heap default
page read and write
 clean
E0000
unkown
page read and write
 clean
F0000
unkown
page read and write
 clean
2C6000
unkown
page read and write
 clean
70000
unkown
page read and write
 clean
424000
heap private
page read and write
 clean
15D000
unkown
page read and write
 clean
170000
unkown
page read and write
 clean
1C10000
unkown
page readonly
 clean
1A4000
heap private
page read and write
 clean
1CF0000
unkown
page readonly
 clean
290000
unkown
page read and write
 clean
160000
unkown
page read and write
 clean
2B0000
unkown
page readonly
 clean
1E4000
heap private
page read and write
 clean
240000
heap default
page read and write
 clean
754000
heap private
page read and write
 clean
4C4000
heap private
page read and write
 clean
1F0000
heap default
page read and write
 clean
70000
unkown
page readonly
 clean
12D000
unkown
page read and write
 clean
20A000
heap default
page read and write
 clean
194000
heap private
page read and write
 clean
100000
unkown
page read and write
 clean
4AE000
heap default
page read and write
 clean
404000
heap private
page read and write
 clean
420000
heap private
page read and write
 clean
670000
unkown
page readonly
 clean
21E0000
unkown
page write copy
 clean
14D000
unkown
page read and write
 clean
There are 100 hidden memdumps, click here to show them.