Automated Malware Analysis IOC Report for

Files

File Path

Type

Processes

Path

Cmdline

Malicious

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	1232
Target ID:	0
Parent PID:	576
Name:	WINWORD.EXE
Class:	word
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Size:	1423704
MD5:	9EE74859D22DAE61F1750B3A1BACB6F5
Time:	17:27:17
Date:	11/08/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x13f220000
Modulesize:	1437696
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Users\user\AppData\Local\Temp\r8F8A.tmp.exe

"C:\Users\user\AppData\Local\Temp\r8F8A.tmp.exe" "C:\Users\user\AppData\Local\Temp\y84FE.tmp.dll",#1

Details

Is windows:	false
Is dropped:	true
PID:	1364
Target ID:	4
Parent PID:	1232
Name:	r8F8A.tmp.exe
Path:	C:\Users\user\AppData\Local\Temp\r8F8A.tmp.exe
Commandline:	"C:\Users\user\AppData\Local\Temp\r8F8A.tmp.exe" "C:\Users\user\AppData\Local\Temp\y84FE.tmp.dll",#1
Size:	44544
MD5:	51138BEEA3E2C21EC44D0932C71762A8
Time:	17:27:28
Date:	11/08/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x40000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Document exploit detected (creates forbidden files)	Software Vulnerabilities	Exploitation for Client Execution
Document exploit detected (process start blacklist hit)	Software Vulnerabilities	Exploitation for Client Execution
Office process drops PE file	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Dropped file seen in connection with other malware	System Summary
Drops PE files	Persistence and Installation Behavior
Runs a DLL by calling functions	System Summary	Rundll32
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

C:\Windows\System32\rundll32.exe

"C:\Users\user\AppData\Local\Temp\r8F8A.tmp.exe" "C:\Users\user\AppData\Local\Temp\y84FE.tmp.dll",#1

Details

Is windows:	true
Is dropped:	false
PID:	1552
Target ID:	5
Parent PID:	1364
Name:	rundll32.exe
Class:	rundll32
Path:	C:\Windows\System32\rundll32.exe
Commandline:	"C:\Users\user\AppData\Local\Temp\r8F8A.tmp.exe" "C:\Users\user\AppData\Local\Temp\y84FE.tmp.dll",#1
Size:	45568
MD5:	DD81D91FF3B0763C392422865C9AC12E
Time:	17:27:29
Date:	11/08/2022
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xffbd0000
Modulesize:	61440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Yara detected IcedID	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Yara detected IcedID	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Runs a DLL by calling functions	System Summary	Rundll32
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

alexbionka.com

http://alexbionka.com/

64.227.108.27

http://45.8.146.139/fhfty/O-M--V4GO6516F-U91Z1DJNJ2U9D-823/rma

unknown

http://45.8.146

unknown

http://45.8.146.139/fhfty/O-M--V4GO6516F-U91Z1DJNJ2U9D-823/rm

45.8.146.139

http://45.8.146.139/fhfty/O-M--V4GO6516F-U91Z1DJNJ2U9D-823/rm&

unknown

http://45.8.146.139/fhfty/O-M--V4GO6516F-U91Z1DJNJ2U9D-823/rm516F-U91Z1DJNJ2U9D-823/rm3/rm3/rm

unknown

http://45.8.146.139/fhfty/O-M--V4GO6516F-U91Z1DJNJ2U9D-823/rmli

unknown

http://45.8.146.139/fhfty/O-M--V4GO6516F-U91Z1DJNJ2U9D-823/rmT&

unknown

http://45.8.146.139/fhfty/O-M--V4GO651

unknown

http://45.8.146.139/fhfty/O-M--V4GO6516F-U91Z1DJNJ2U9D-823/rmj

unknown

http://45.8.146.139/fhfty/O-M--V4GO6516F-U91Z1DJNJ2U9D-823/rmv&

unknown

There are 2 hidden URLs, click here to show them.

Domains

Name

Malicious

alexbionka.com

64.227.108.27

Details

Name:	alexbionka.com
IP:	64.227.108.27
TargetID:	5
Current Path:	C:\Windows\System32\rundll32.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
System process connects to network (likely due to code injection or exploit)	Networking, HIPS / PFW / Operating System Protection Evasion	Process Injection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
HTTP GET or POST without a user agent	Networking
Potential document exploit detected (performs DNS queries)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

64.227.108.27

alexbionka.com

United States

Details

IP:	64.227.108.27
TargetID:	5
Current Path:	C:\Windows\System32\rundll32.exe
Country:	United States
Countrycode:	USA
ASN number:	14061
ASN name:	DIGITALOCEAN-ASNUS
Private:	false
Domain:	alexbionka.com

Signature Hits	Behavior Group	Mitre Attack
System process connects to network (likely due to code injection or exploit)	Networking, HIPS / PFW / Operating System Protection Evasion	Process Injection
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution

45.8.146.139

unknown

Russian Federation

Details

IP:	45.8.146.139
TargetID:	0
Current Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Country:	Russian Federation
Countrycode:	RUS
ASN number:	44676
ASN name:	VMAGE-ASRU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Potential document exploit detected (performs HTTP gets)	Software Vulnerabilities	Exploitation for Client Execution
Potential document exploit detected (unknown TCP traffic)	Software Vulnerabilities	Exploitation for Client Execution
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word

MTTT

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

6,+

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

00+

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage

TCWP5FilesIntl_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage

TCWP6FilesIntl_1033

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\Recover

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\Recover

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\Recover

Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WrdPrfctDos

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WrdPrfctDos

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WrdPrfctDos

Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WordPerfect6x

Name

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WordPerfect6x

Path

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\14.0\Word\Text Converters\Import\WordPerfect6x

Extensions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage

VBAFiles

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle

ReviewToken

HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\6738A

6738A