IOC Report
Rechnung.xls

loading gif

Files

File Path
Type
Category
Malicious
Rechnung.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 16:15:56 2022, Security: 0
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\klJrMZJhgldiJr6j0XWPeZOiGs[1].dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\RD05UTHGkitvIJt[1].dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\me435CErJsFGw1q[1].dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
downloaded
 malicious
C:\Users\user\Desktop\Rechnung.xls
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Dream, Last Saved By: TYHRETH, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:19:34 2015, Last Saved Time/Date: Fri May 20 16:15:56 2022, Security: 0
dropped
 malicious
C:\Users\user\uxevr1.ocx
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\uxevr2.ocx
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\uxevr3.ocx
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 61480 bytes, 1 file
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\lJWa95VlQ[1]
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\CabC624.tmp
Microsoft Cabinet archive data, 61480 bytes, 1 file
dropped
C:\Users\user\AppData\Local\Temp\TarC625.tmp
data
modified
C:\Users\user\AppData\Local\Temp\~DF87842D0B1D415996.TMP
data
dropped
C:\Windows\System32\GistaKepWrpVA\oAaDhgd.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Windows\System32\ITAzDMJQNXvQb\pSYwk.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Windows\System32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
There are 7 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\uxevr1.ocx
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ITAzDMJQNXvQb\pSYwk.dll"
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\uxevr2.ocx
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\MTAKuNEHAAsvRsb\hgVDSaDXChbCzdU.dll"
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\uxevr3.ocx
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\GistaKepWrpVA\oAaDhgd.dll"
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\System32\regsvr32.exe /S ..\uxevr4.ocx
 malicious

URLs

Name
IP
Malicious
https://173.82.82.196:8080/
unknown
 malicious
https://173.82.82.196/C01-
unknown
 malicious
http://salledemode.com/tgroup.ge/x4bc2kL4BzGAeUsVi/
160.153.40.1
 malicious
https://173.82.82.196/
unknown
 malicious
https://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/
188.114.97.10
 malicious
http://www.kabeonet.pl/wp-admin/VWlAz5vWJNHDb/
193.143.77.34
 malicious
http://vipteck.com/wp-admin/user/B8d6jr4pBND2HExAmI/lJWa95VlQ/
188.114.97.10
 malicious
http://kabeonet.pl/wp-admin/VWlAz5vWJNHDb/
193.143.77.34
 malicious
https://173.82.82.196:8080/H
unknown
 malicious
https://173.82.82.196:8080/L
unknown
 malicious
https://173.82.82.196/l
unknown
 malicious
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
http://crl.entrust.net/server1.crl0
unknown
http://ocsp.entrust.net03
unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
http://www.diginotar.nl/cps/pkioverheid0
unknown
http://ocsp.entrust.net0D
unknown
https://secure.comodo.com/CPS0
unknown
http://crl.entrust.net/2048ca.crl0
unknown
https://airliftlimo.com/wp-admin/iMc/
159.203.19.2
There are 10 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
salledemode.com
160.153.40.1
 malicious
kabeonet.pl
193.143.77.34
vipteck.com
188.114.97.10
airliftlimo.com
159.203.19.2
windowsupdatebg.s.llnwi.net
95.140.236.128
www.kabeonet.pl
unknown

IPs

IP
Domain
Country
Malicious
173.82.82.196
unknown
United States
malicious
160.153.40.1
salledemode.com
United States
malicious
159.203.19.2
airliftlimo.com
United States
188.114.97.10
vipteck.com
European Union
193.143.77.34
kabeonet.pl
Poland

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
h<,
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\67178
67178
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
1z,
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
There are 13 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3D0000
direct allocation
page execute and read and write
 malicious
1D0000
direct allocation
page execute and read and write
 malicious
180001000
direct allocation
page execute read
 malicious
180001000
direct allocation
page execute read
 malicious
1FE0000
direct allocation
page execute and read and write
 malicious
150000
direct allocation
page execute and read and write
 malicious
180001000
direct allocation
page execute read
 malicious
180001000
direct allocation
page execute read
 malicious
180001000
direct allocation
page execute read
 malicious
2F0000
direct allocation
page execute and read and write
 malicious
2E0000
direct allocation
page execute and read and write
 malicious
180001000
direct allocation
page execute read
 malicious
2EC8000
heap
page read and write
3DA000
heap
page read and write
5C0000
heap
page read and write
2EFC000
heap
page read and write
366000
heap
page read and write
7FEF74D0000
unkown
page readonly
2242000
heap
page read and write
3C6000
heap
page read and write
294E000
unkown
page read and write
2EE0000
heap
page read and write
3361000
heap
page read and write
7FEF9D20000
unkown
page readonly
28D0000
heap
page read and write
516000
heap
page read and write
3FE000
heap
page read and write
2B9E000
stack
page read and write
330000
trusted library allocation
page read and write
35E000
heap
page read and write
3387000
heap
page read and write
18002C000
direct allocation
page readonly
2EA0000
heap
page read and write
2E7000
heap
page read and write
2C2000
heap
page read and write
2C0000
heap
page read and write
425000
heap
page read and write
2F55000
heap
page read and write
10000
heap
page read and write
2100000
remote allocation
page read and write
33CD000
heap
page read and write
7FEF74FB000
unkown
page read and write
43E000
heap
page read and write
18002E000
direct allocation
page readonly
26ED000
stack
page read and write
180000000
direct allocation
page read and write
260000
heap
page read and write
4E0000
heap
page read and write
211B000
heap
page read and write
2030000
trusted library allocation
page read and write
3A6000
heap
page read and write
140000
direct allocation
page execute and read and write
214B000
heap
page read and write
C9000
stack
page read and write
2EB0000
heap
page read and write
434000
heap
page read and write
2B4000
heap
page read and write
18002D000
direct allocation
page read and write
2B7E000
stack
page read and write
2E0000
heap
page read and write
400000
heap
page read and write
2EE3000
heap
page read and write
10000
heap
page read and write
380000
heap
page read and write
4A8000
heap
page read and write
31E000
heap
page read and write
2F22000
heap
page read and write
34D5000
heap
page read and write
204B000
stack
page read and write
120000
heap
page read and write
3010000
heap
page read and write
548000
heap
page read and write
7FEF7552000
unkown
page readonly
1F0000
heap
page read and write
2F6000
heap
page read and write
180000000
direct allocation
page read and write
2215000
heap
page read and write
2D60000
heap
page read and write
2C0000
heap
page read and write
333000
heap
page read and write
476000
heap
page read and write
372000
heap
page read and write
2F3C000
heap
page read and write
18002D000
direct allocation
page read and write
23D0000
heap
page read and write
209B000
heap
page read and write
7FEF7531000
unkown
page execute read
1A5000
heap
page read and write
2115000
heap
page read and write
2EC0000
heap
page read and write
DE000
heap
page read and write
237000
heap
page read and write
18002E000
direct allocation
page readonly
224000
heap
page read and write
428000
heap
page read and write
7FEF7552000
unkown
page readonly
7FEF74D1000
unkown
page execute read
4F0000
heap
page read and write
3140000
heap
page read and write
180000000
direct allocation
page read and write
7FEF74FF000
unkown
page readonly
18002E000
direct allocation
page readonly
3416000
heap
page read and write
20E0000
heap
page read and write
20000
heap
page read and write
7FEF74FF000
unkown
page readonly
3F0000
heap
page read and write
38C000
heap
page read and write
2065000
heap
page read and write
2060000
heap
page read and write
2AE000
heap
page read and write
1C0000
direct allocation
page execute and read and write
413000
heap
page read and write
180000
heap
page read and write
2F3D000
heap
page read and write
2D0000
direct allocation
page execute and read and write
2130000
heap
page read and write
277000
heap
page read and write
F3000
heap
page read and write
2F3C000
heap
page read and write
33F5000
heap
page read and write
5A4000
heap
page read and write
580000
remote allocation
page read and write
2040000
heap
page read and write
421000
heap
page read and write
4C0000
heap
page read and write
470000
remote allocation
page read and write
2F25000
heap
page read and write
33A000
heap
page read and write
34A0000
heap
page read and write
209B000
heap
page read and write
2110000
heap
page read and write
22CE000
stack
page read and write
2AFE000
stack
page read and write
420000
heap
page read and write
179000
stack
page read and write
7FEF7530000
unkown
page readonly
10000
heap
page read and write
4E4000
heap
page read and write
428000
heap
page read and write
5A0000
heap
page read and write
18002D000
direct allocation
page read and write
421000
heap
page read and write
7FEF74D0000
unkown
page readonly
3416000
heap
page read and write
684000
heap
page read and write
314000
heap
page read and write
20BD000
stack
page read and write
2C1B000
stack
page read and write
2A00000
heap
page read and write
156000
heap
page read and write
580000
remote allocation
page read and write
7FEF7530000
unkown
page readonly
7FEF755F000
unkown
page readonly
2F2D000
heap
page read and write
470000
heap
page read and write
39E000
heap
page read and write
7FEF755B000
unkown
page read and write
2B6C000
stack
page read and write
7FEF9D4F000
unkown
page readonly
2100000
remote allocation
page read and write
3482000
heap
page read and write
7FEF755F000
unkown
page readonly
2C70000
heap
page read and write
33CE000
heap
page read and write
2B5000
heap
page read and write
3C4000
heap
page read and write
196000
heap
page read and write
20E5000
heap
page read and write
A7000
heap
page read and write
207B000
heap
page read and write
2C3000
heap
page read and write
3C9000
heap
page read and write
2D30000
heap
page read and write
2B8E000
stack
page read and write
2C2E000
stack
page read and write
2EA2000
heap
page read and write
160000
heap
page read and write
470000
remote allocation
page read and write
2360000
heap
page read and write
416000
heap
page read and write
580000
heap
page read and write
10000
heap
page read and write
25ED000
stack
page read and write
3480000
heap
page read and write
7FEF9D4B000
unkown
page read and write
440000
heap
page read and write
40A000
heap
page read and write
10000
heap
page read and write
2BB000
heap
page read and write
3E0000
heap
page read and write
22DF000
stack
page read and write
37E000
heap
page read and write
220F000
stack
page read and write
460000
heap
page read and write
1A0000
heap
page read and write
224B000
heap
page read and write
FC000
stack
page read and write
3BA000
heap
page read and write
37A000
heap
page read and write
E9000
stack
page read and write
2F2D000
heap
page read and write
27D0000
heap
page read and write
39F000
heap
page read and write
400000
heap
page read and write
18002D000
direct allocation
page read and write
24000
heap
page read and write
2C0C000
stack
page read and write
18002E000
direct allocation
page readonly
33A8000
heap
page read and write
26EE000
stack
page read and write
18002C000
direct allocation
page readonly
18002C000
direct allocation
page readonly
2CA000
heap
page read and write
318000
heap
page read and write
430000
heap
page read and write
2C5B000
stack
page read and write
3B3000
heap
page read and write
135000
heap
page read and write
2D7E000
stack
page read and write
2E7000
heap
page read and write
2EB0000
heap
page read and write
2EC2000
heap
page read and write
2060000
heap
page read and write
7FEF74F2000
unkown
page readonly
180000000
direct allocation
page read and write
31E000
heap
page read and write
2EFA000
heap
page read and write
7FEF74F2000
unkown
page readonly
26E000
heap
page read and write
330000
heap
page read and write
38D000
heap
page read and write
7FEF74D1000
unkown
page execute read
21C0000
heap
page read and write
3E0000
heap
page read and write
2F3C000
heap
page read and write
360000
heap
page read and write
7FEF9D20000
unkown
page readonly
230F000
stack
page read and write
27D0000
heap
page read and write
A0000
heap
page read and write
18002D000
direct allocation
page read and write
496000
heap
page read and write
373000
heap
page read and write
230000
heap
page read and write
222F000
stack
page read and write
7FEF9D42000
unkown
page readonly
40B000
heap
page read and write
10000
heap
page read and write
2DF0000
heap
page read and write
43E000
heap
page read and write
425000
heap
page read and write
217E000
stack
page read and write
680000
heap
page read and write
198000
heap
page read and write
2F45000
heap
page read and write
FA000
heap
page read and write
7FEF755B000
unkown
page read and write
2D0000
direct allocation
page execute and read and write
263E000
stack
page read and write
327000
heap
page read and write
237F000
stack
page read and write
124000
heap
page read and write
18002E000
direct allocation
page readonly
21FE000
stack
page read and write
2EA6000
heap
page read and write
3EC000
heap
page read and write
164000
heap
page read and write
3BD000
heap
page read and write
2240000
heap
page read and write
4E0000
heap
page read and write
226000
heap
page read and write
416000
heap
page read and write
2F53000
heap
page read and write
310000
heap
page read and write
7FEF9D42000
unkown
page readonly
220000
trusted library allocation
page read and write
7FEF7531000
unkown
page execute read
2210000
heap
page read and write
18002C000
direct allocation
page readonly
2ABF000
stack
page read and write
228000
stack
page read and write
7FEF74FB000
unkown
page read and write
1B0000
heap
page read and write
528000
heap
page read and write
18002D000
direct allocation
page read and write
3360000
heap
page read and write
4B8000
heap
page read and write
3CB000
heap
page read and write
5C4000
heap
page read and write
33A000
heap
page read and write
32A000
heap
page read and write
3FE000
heap
page read and write
18002E000
direct allocation
page readonly
1A8000
heap
page read and write
2362000
heap
page read and write
21B0000
heap
page read and write
268C000
stack
page read and write
2970000
heap
page read and write
498000
heap
page read and write
54D000
heap
page read and write
1BD000
heap
page read and write
2E0000
heap
page read and write
5AE000
heap
page read and write
33CD000
heap
page read and write
2C83000
heap
page read and write
10000
heap
page read and write
18002C000
direct allocation
page readonly
2EFA000
heap
page read and write
2B5E000
stack
page read and write
21B5000
heap
page read and write
40A000
heap
page read and write
2F22000
heap
page read and write
270000
heap
page read and write
4A6000
heap
page read and write
1E8000
stack
page read and write
18B000
heap
page read and write
3C7000
heap
page read and write
33CE000
heap
page read and write
2D7000
heap
page read and write
2065000
heap
page read and write
267000
heap
page read and write
26EE000
stack
page read and write
288000
stack
page read and write
3F0000
heap
page read and write
18002C000
direct allocation
page readonly
7FEF9D4B000
unkown
page read and write
2E70000
heap
page read and write
456000
heap
page read and write
370000
heap
page read and write
1B4000
heap
page read and write
2B0000
heap
page read and write
2EFC000
heap
page read and write
21EB000
heap
page read and write
341D000
heap
page read and write
3B3000
heap
page read and write
2045000
heap
page read and write
1B8000
heap
page read and write
2A40000
heap
page read and write
7FEF9D21000
unkown
page execute read
2E78000
heap
page read and write
4BD000
heap
page read and write
333000
heap
page read and write
3C0000
direct allocation
page execute and read and write
27BE000
stack
page read and write
180000000
direct allocation
page read and write
235F000
stack
page read and write
2D0E000
stack
page read and write
526000
heap
page read and write
283000
heap
page read and write
367000
heap
page read and write
28A000
heap
page read and write
161000
heap
page read and write
413000
heap
page read and write
22CF000
stack
page read and write
7FEF9D4F000
unkown
page readonly
7FEF9D21000
unkown
page execute read
283E000
stack
page read and write
538000
heap
page read and write
130000
direct allocation
page execute and read and write
160000
heap
page read and write
2F42000
heap
page read and write
2B0000
heap
page read and write
264000
heap
page read and write
145000
heap
page read and write
3E2000
heap
page read and write
220000
heap
page read and write
277B000
stack
page read and write
1B6000
heap
page read and write
180000000
direct allocation
page read and write
276F000
stack
page read and write
582000
heap
page read and write
320000
heap
page read and write
There are 363 hidden memdumps, click here to show them.