Loading... Additional Content is being loaded
Windows Analysis Report Sts Global Order.xlsx
Overview
General Information
| Sample Name: | Sts Global Order.xlsx |
| Analysis ID: | 508452 |
| MD5: | 32f28af7bfd53e685b4cb23daa435ac1 |
| SHA1: | 2b8161a2ff19950d6767cc1adbd7b85af04a335b |
| SHA256: | 52601a9c0c289aa1e3de03a32f2c7c2d47c94685e3bc58b06c6932f1b65a88ca |
| Tags: | VelvetSweatshopxlsx |
| Infos: | |
|
Most interesting Screenshot:  |
|
Detection
Nanocore
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Found malware configuration
Sigma detected: EQNEDT32.EXE connecting to internet
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
Yara detected AntiVM3
Detected Nanocore Rat
Sigma detected: Droppers Exploiting CVE-2017-11882
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Yara detected Nanocore RAT
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Writes to foreign memory regions
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Allocates memory in foreign processes
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Sigma detected: Execution from Suspicious Folder
Office equation editor drops PE file
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
IP address seen in connection with other malware
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Installs a raw input device (often for capturing keystrokes)
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Uses a known web browser user agent for HTTP communication
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Detected TCP or UDP traffic on non-standard ports
Office Equation Editor has been started
Drops PE files to the user directory
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Classification
AV Detection: |
  |
|---|
| Found malware configuration |
| Source: |
Malware Configuration Extractor: |
||
| Antivirus detection for URL or domain |
| Source: |
Avira URL Cloud: |
||
| Source: |
Avira URL Cloud: |
||
| Multi AV Scanner detection for domain / URL |
| Source: |
Virustotal: |
Perma Link | ||
| Source: |
Virustotal: |
Perma Link | ||
| Source: |
Virustotal: |
Perma Link | ||
| Multi AV Scanner detection for dropped file |
| Source: |
Virustotal: |
Perma Link | ||
| Yara detected Nanocore RAT |
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Source: |
File source: |
||
| Machine Learning detection for dropped file |
| Source: |
Joe Sandbox ML: |
||
| Source: |
Joe Sandbox ML: |
||
| Source: |
Joe Sandbox ML: |
||
| Antivirus or Machine Learning detection for unpacked file |
| Source: |
Avira: |
||
| Source: |
Avira: |
||
Exploits: |
|
|---|
| Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) |
| Source: |
Process created: |
|||
| Source: |
Process created: |
Jump to behavior | ||
| Office Equation Editor has been started |
| Source: |
Process created: |
||
| Source: |
File opened: |
Jump to behavior | ||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
| Source: |
Binary string: |
||
Software Vulnerabilities: |
|
|---|
| Potential document exploit detected (performs DNS queries) |
| Source: |
DNS query: |
||
| Found inlined nop instructions (likely shell or obfuscated code) |
| Source: |
Code function: |
7_2_003CAF30 | |
| Potential document exploit detected (unknown TCP traffic) |
| Source: |
TCP traffic: |
||
| Potential document exploit detected (performs HTTP gets) |
| Source: |
TCP traffic: |
||
Networking: |
|
|---|
| C2 URLs / IPs found in malware configuration |
| Source: |
URLs: |
||
| Source: |
URLs: |
||
| Internet Provider seen in connection with other malware |
| Source: |
ASN Name: |
||
| Source: |
ASN Name: |
||
| IP address seen in connection with other malware |
| Source: |
IP Address: |
||
| Source: |
IP Address: |
||
| Downloads executable code via HTTP |
| Source: |
HTTP traffic detected: | ||