| File name: | Group 2& 3.xlam |
| Full analysis: | https://app.any.run/tasks/0f7ac196-85eb-4e33-86ac-bd1e6468e031 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | May 30, 2025, 20:32:06 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
| File info: | Microsoft Excel 2007+ |
| MD5: | 22CA449795946FD9AC57C725D1D5F9F5 |
| SHA1: | 5EEA1528BF8DC3D732817DC40A7E5224F26CA8DF |
| SHA256: | 00637520BE01BE57A8704B56C415B967B28C2EA5D58E4E70F2E9009A4767FB03 |
| SSDEEP: | 98304:9K5gqmVNzu/TUYZzkbmwUcOL5Wd7kAz0JZkfUPGCNQYbCG7f+25XHfoJJ55ZCG6O:I5gZIor9 |
MALICIOUS
Equation Editor starts application (likely CVE-2017-11882)
- EQNEDT32.EXE (PID: 3832)
Suspicious connection from the Equation Editor
- EQNEDT32.EXE (PID: 3832)
SNAKEKEYLOGGER has been detected (SURICATA)
- RegSvcs.exe (PID: 2664)
SNAKE has been detected (YARA)
- RegSvcs.exe (PID: 2664)
SUSPICIOUS
Reads security settings of Internet Explorer
- EQNEDT32.EXE (PID: 3832)
Potential Corporate Privacy Violation
- EQNEDT32.EXE (PID: 3832)
Reads the Internet Settings
- EQNEDT32.EXE (PID: 3832)
- RegSvcs.exe (PID: 2664)
Process requests binary or script from the Internet
- EQNEDT32.EXE (PID: 3832)
Executable content was dropped or overwritten
- EQNEDT32.EXE (PID: 3832)
Connects to the server without a host name
- EQNEDT32.EXE (PID: 3832)
Checks for external IP
- RegSvcs.exe (PID: 2664)
- svchost.exe (PID: 1080)
INFO
Manual execution by a user
- EXCEL.EXE (PID: 3924)
- EXCEL.EXE (PID: 2868)
Reads the computer name
- EQNEDT32.EXE (PID: 3832)
- RegSvcs.exe (PID: 2664)
Checks supported languages
- EQNEDT32.EXE (PID: 3832)
- ambiexcel342.exe (PID: 3660)
- RegSvcs.exe (PID: 2664)
Creates files or folders in the user directory
- EQNEDT32.EXE (PID: 3832)
Reads the machine GUID from the registry
- EQNEDT32.EXE (PID: 3832)
- RegSvcs.exe (PID: 2664)
Checks proxy server information
- EQNEDT32.EXE (PID: 3832)
Reads mouse settings
- ambiexcel342.exe (PID: 3660)
The sample compiled with english language support
- EQNEDT32.EXE (PID: 3832)
Create files in a temporary directory
- ambiexcel342.exe (PID: 3660)
Reads Environment values
- RegSvcs.exe (PID: 2664)
Disables trace logs
- RegSvcs.exe (PID: 2664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
SnakeKeylogger
(PID) Process(2664) RegSvcs.exe
Keys
DES6fc98cd68a1aab8b
Options
SMTP Userambis@leedelectronics.top
SMTP Password7213575aceACE@#
SMTP Hostmail.leedelectronics.top
SMTP SendToambi@leedelectronics.top
SMTP Port587
Telegram Bot Token7783104153:AAHSNrERDQS2NzJ45eSQXKJ1B2uwYNSeUQ4
Telegram Chat ID5630866666
TRiD
| .xlsx | | | Excel Microsoft Office Open XML Format document (61.2) |
|---|---|---|
| .zip | | | Open Packaging Conventions container (31.5) |
| .zip | | | ZIP compressed archive (7.2) |
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0002 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2025:05:29 03:33:20 |
| ZipCRC: | 0x96b4114a |
| ZipCompressedSize: | 428 |
| ZipUncompressedSize: | 1754 |
| ZipFileName: | [Content_Types].xml |
XMP
| Creator: | Modexcomm |
|---|
XML
| LastModifiedBy: | Modexcomm |
|---|---|
| CreateDate: | 2025:05:22 22:02:38Z |
| ModifyDate: | 2025:05:22 22:18:44Z |
| Application: | Microsoft Excel |
| DocSecurity: | None |
| ScaleCrop: | No |
| HeadingPairs: |
|
| TitlesOfParts: |
|
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| AppVersion: | 12 |
Total processes
45
Monitored processes
7
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1080 | C:\Windows\system32\svchost.exe -k NetworkService | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2444 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 2664 | "C:\Users\admin\AppData\Roaming\ambiexcel342.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | ambiexcel342.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Exit code: 3762504530 Version: 4.8.3761.0 built by: NET48REL1 Modules
SnakeKeylogger(PID) Process(2664) RegSvcs.exe Keys DES6fc98cd68a1aab8b Options SMTP Userambis@leedelectronics.top SMTP Password7213575aceACE@# SMTP Hostmail.leedelectronics.top SMTP SendToambi@leedelectronics.top SMTP Port587 Telegram Bot Token7783104153:AAHSNrERDQS2NzJ45eSQXKJ1B2uwYNSeUQ4 Telegram Chat ID5630866666 | |||||||||||||||
| 2868 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 3660 | "C:\Users\admin\AppData\Roaming\ambiexcel342.exe" | C:\Users\admin\AppData\Roaming\ambiexcel342.exe | — | EQNEDT32.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3832 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE | svchost.exe | ||||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
| 3924 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
Total events
7 592
Read events
7 271
Write events
164
Delete events
157
Modification events
| (PID) Process: | (1080) svchost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet |
| Operation: | write | Name: | {4040CF00-1B3E-486A-B407-FA14C56B6FC0} |
Value: D4DA6D7D270F | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | write | Name: | pe" |
Value: 706522008C090000010000000000000000000000 | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | delete value | Name: | pe" |
Value: 数"ঌ | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: Off | |||
Executable files
3
Suspicious files
5
Text files
1
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2444 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR49D0.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3924 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR93DA.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2868 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVRC75D.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3924 | EXCEL.EXE | C:\Users\admin\Desktop\~$Group 2& 3.xlam.xlsx | pgc | |
MD5:21E5D64E6DD2C94C577A61B0A25DE7A4 | SHA256:657F0604A7C1F6CFDC4E8A224F59BD6E1900A4A4DD8B3F61A20F67DEBE41F209 | |||
| 3660 | ambiexcel342.exe | C:\Users\admin\AppData\Local\Temp\autCF6D.tmp | binary | |
MD5:A86448CD4062F38CEF368BB0B3984F05 | SHA256:4D44670EF94E97AC2D65DAE49D6B0691B3954010B9295DD098DBFB600672A84B | |||
| 3832 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ambi2992[1].exe | executable | |
MD5:61C95E7F3184AC43BE98EAD97F1FC0B0 | SHA256:376D3DFD6F2D205E6A48BBEB3984D4B5F383D08C7CC71BD3D5487A633A13A0A5 | |||
| 3660 | ambiexcel342.exe | C:\Users\admin\AppData\Local\Temp\autCE52.tmp | binary | |
MD5:D68D1768BA69173C5242CB89D58E3EA2 | SHA256:807127856637849AD572076BCA516B1657D2370B48748280D762311320534EB6 | |||
| 3660 | ambiexcel342.exe | C:\Users\admin\AppData\Local\Temp\thixophobia | binary | |
MD5:FD12BF143D2BCE5A3FDDA89EA80E8FAB | SHA256:75EFE513288730213569ECC4D1FCE1384B745AD46696D6DEA42081B423707116 | |||
| 3660 | ambiexcel342.exe | C:\Users\admin\AppData\Local\Temp\cacostomia | text | |
MD5:933CE196E7875ACBA78CEFAF516E5C03 | SHA256:B58CF91530562624E48E2D4A266D5065B3D1C53DB86B02BB369D30E5CED580D7 | |||
| 2868 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Group 2& 3.xlam.LNK | binary | |
MD5:D3562A1A1F10923449CE299C60A9C050 | SHA256:AA92C01AC0043C131198B973B02591424B23974BC860B111CBB2D9A7F4ECB68F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
7
DNS requests
2
Threats
11
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3832 | EQNEDT32.EXE | GET | 200 | 213.209.150.249:80 | http://213.209.150.249/ambi2992.exe | unknown | — | — | malicious |
2664 | RegSvcs.exe | GET | 502 | 158.101.44.242:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3832 | EQNEDT32.EXE | 213.209.150.249:80 | — | Alsycon B.V. | GB | malicious |
2664 | RegSvcs.exe | 158.101.44.242:80 | checkip.dyndns.org | ORACLE-BMC-31898 | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
checkip.dyndns.org |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3832 | EQNEDT32.EXE | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
3832 | EQNEDT32.EXE | A Network Trojan was detected | ET MALWARE Possible Malicious Macro EXE DL AlphaNumL |
3832 | EQNEDT32.EXE | A Network Trojan was detected | ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 |
3832 | EQNEDT32.EXE | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 61 |
3832 | EQNEDT32.EXE | A Network Trojan was detected | ET MALWARE Possible Malicious Macro DL EXE Feb 2016 |
3832 | EQNEDT32.EXE | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
3832 | EQNEDT32.EXE | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
3832 | EQNEDT32.EXE | A Network Trojan was detected | ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 |
1080 | svchost.exe | Device Retrieving External IP Address Detected | ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org) |
2664 | RegSvcs.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup - checkip.dyndns.org |