File name:

CANKO DMC IMPORT ENQUIRY.xlam

Full analysis: https://app.any.run/tasks/d06d93dc-10b6-41a3-ba51-175dcbebb91e
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Analysis date: May 30, 2025, 23:12:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
cve-2017-11882
snake
keylogger
evasion
loader
telegram
stealer
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

C85A5A0F6CCBF61943F9C803AD0EF478

SHA1:

5CE9B4C21D9DB033E6166AE5834B59F69CC98615

SHA256:

4E2C43F533736D7CDD6C88BAAEEE33ABE8596FFE8FFE1F88E8D8C17B1A6B0ADC

SSDEEP:

98304:mxhMRSOeAQYTw/aX5BGqDN1iCAws2FxhpP54FH1Jp58y3otBxbOhiqaH1YpZaL9Z:CAFZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Equation Editor starts application (likely CVE-2017-11882)

      • EQNEDT32.EXE (PID: 3288)
    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 3288)
    • SNAKEKEYLOGGER has been detected (SURICATA)

      • RegSvcs.exe (PID: 3216)
    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 3216)
    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 3216)
    • SNAKE has been detected (YARA)

      • RegSvcs.exe (PID: 3216)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 3288)
    • Reads the Internet Settings

      • EQNEDT32.EXE (PID: 3288)
      • RegSvcs.exe (PID: 3216)
    • Reads security settings of Internet Explorer

      • EQNEDT32.EXE (PID: 3288)
    • Potential Corporate Privacy Violation

      • EQNEDT32.EXE (PID: 3288)
    • Checks for external IP

      • svchost.exe (PID: 1080)
      • RegSvcs.exe (PID: 3216)
    • Connects to the server without a host name

      • EQNEDT32.EXE (PID: 3288)
    • Process requests binary or script from the Internet

      • EQNEDT32.EXE (PID: 3288)
    • Reads settings of System Certificates

      • RegSvcs.exe (PID: 3216)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • RegSvcs.exe (PID: 3216)
    • Accesses Microsoft Outlook profiles

      • RegSvcs.exe (PID: 3216)
    • Connects to SMTP port

      • RegSvcs.exe (PID: 3216)
    • Loads DLL from Mozilla Firefox

      • RegSvcs.exe (PID: 3216)
  • INFO

    • Reads mouse settings

      • linkinexcel3589.exe (PID: 3408)
    • Disables trace logs

      • RegSvcs.exe (PID: 3216)
    • Creates files or folders in the user directory

      • EQNEDT32.EXE (PID: 3288)
    • Checks supported languages

      • EQNEDT32.EXE (PID: 3288)
      • linkinexcel3589.exe (PID: 3408)
      • RegSvcs.exe (PID: 3216)
    • Reads the computer name

      • EQNEDT32.EXE (PID: 3288)
      • RegSvcs.exe (PID: 3216)
    • Reads Environment values

      • RegSvcs.exe (PID: 3216)
    • Reads the machine GUID from the registry

      • EQNEDT32.EXE (PID: 3288)
      • RegSvcs.exe (PID: 3216)
    • Manual execution by a user

      • EXCEL.EXE (PID: 3924)
    • The sample compiled with english language support

      • EQNEDT32.EXE (PID: 3288)
    • Create files in a temporary directory

      • linkinexcel3589.exe (PID: 3408)
    • Checks proxy server information

      • EQNEDT32.EXE (PID: 3288)
    • Reads the software policy settings

      • RegSvcs.exe (PID: 3216)
    • Attempting to use instant messaging service

      • svchost.exe (PID: 1080)
      • RegSvcs.exe (PID: 3216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

SnakeKeylogger

(PID) Process(3216) RegSvcs.exe
Keys
DES6fc98cd68a1aab8b
Options
SMTP Userlinkings@tonicables.top
SMTP Password7213575aceACE@#
SMTP Hostmail.tonicables.top
SMTP SendTolinking@tonicables.top
SMTP Port587
No Malware configuration.

TRiD

.xlsx | Excel Microsoft Office Open XML Format document (61.2)
.zip | Open Packaging Conventions container (31.5)
.zip | ZIP compressed archive (7.2)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2025:05:29 03:37:12
ZipCRC: 0x60f273b5
ZipCompressedSize: 427
ZipUncompressedSize: 1751
ZipFileName: [Content_Types].xml

XMP

Creator: Modexcomm

XML

LastModifiedBy: Modexcomm
CreateDate: 2025:05:22 22:02:38Z
ModifyDate: 2025:05:22 22:26:53Z
Application: Microsoft Excel
DocSecurity: None
ScaleCrop: No
HeadingPairs:
  • Worksheets
  • 3
TitlesOfParts:
  • Sheet1
  • Sheet2
  • Sheet3
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
AppVersion: 12
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start excel.exe no specs excel.exe no specs eqnedt32.exe linkinexcel3589.exe no specs #SNAKE regsvcs.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2444"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3216"C:\Users\admin\AppData\Roaming\linkinexcel3589.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
linkinexcel3589.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
SnakeKeylogger
(PID) Process(3216) RegSvcs.exe
Keys
DES6fc98cd68a1aab8b
Options
SMTP Userlinkings@tonicables.top
SMTP Password7213575aceACE@#
SMTP Hostmail.tonicables.top
SMTP SendTolinking@tonicables.top
SMTP Port587
3288"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
Modules
Images
c:\program files\common files\microsoft shared\equation\eqnedt32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3408"C:\Users\admin\AppData\Roaming\linkinexcel3589.exe"C:\Users\admin\AppData\Roaming\linkinexcel3589.exeEQNEDT32.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\linkinexcel3589.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
3924"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\excel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
8 935
Read events
8 675
Write events
117
Delete events
143

Modification events

(PID) Process:(2444) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:+q"
Value:
2B7122008C090000010000000000000000000000
(PID) Process:(2444) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2444) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(2444) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(2444) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(2444) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(2444) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(2444) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(2444) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(2444) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
3
Suspicious files
5
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2444EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR551B.tmp.cvr
MD5:
SHA256:
3924EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR6E41.tmp.cvr
MD5:
SHA256:
3288EQNEDT32.EXEC:\Users\admin\AppData\Roaming\linkinexcel3589.exeexecutable
MD5:04D2FA86612FA7A35DEDE2A8BBC77103
SHA256:4AF47504549FA0D35684BAFB8276F3C8B0AE8A795B7026D53920E9505F1533B6
3288EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\linking2996[1].exeexecutable
MD5:04D2FA86612FA7A35DEDE2A8BBC77103
SHA256:4AF47504549FA0D35684BAFB8276F3C8B0AE8A795B7026D53920E9505F1533B6
3408linkinexcel3589.exeC:\Users\admin\AppData\Local\Temp\aut7759.tmpbinary
MD5:A46BB5BA5CD5405BA0E1DD2CED9F029D
SHA256:1CB3EA03269B50E02D7FDEA33B84979B836A3B54BEAA830A17EF9DE982D82E4C
3924EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:6D4CE7E97B6564B401AE5DE11EDFF07B
SHA256:C85294729BDA4C240CB3F7AB5D02802146F721607BB27138DF350FD0B2432279
3408linkinexcel3589.exeC:\Users\admin\AppData\Local\Temp\apostrophisetext
MD5:EC36ADDDF54DA8E4A6B1B508F4C17B88
SHA256:00A4E7C5FC86444AE2ED1FB5F56699E09599FA0C7A6024896D57C94F7A424EA0
3924EXCEL.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\CANKO DMC IMPORT ENQUIRY.xlam.LNKbinary
MD5:64D15EA52B9C2099CC231AF31DAF88FF
SHA256:1B4F55535A10C414B0DFF557457A7A8C2DE71C31482AF40DB1A3A0A52046F18B
3408linkinexcel3589.exeC:\Users\admin\AppData\Local\Temp\scrollbinary
MD5:651E418C78864E546589A43F5867A299
SHA256:8CE2C631AAF903AAFEB61138028A4E8B67E3F28F508993CA15D1C5C5AE8623AE
3408linkinexcel3589.exeC:\Users\admin\AppData\Local\Temp\aut7883.tmpbinary
MD5:E60ED418E75B4701AFAF186D440BFE97
SHA256:8EDD527B7DE3CB034A6D385E41C6D9142BCD30B06035125F8AF70B1471668FA1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
9
DNS requests
5
Threats
27

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3288
EQNEDT32.EXE
GET
200
213.209.150.249:80
http://213.209.150.249/linking2996.exe
unknown
malicious
3216
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
whitelisted
3216
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
whitelisted
3216
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
whitelisted
3216
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
whitelisted
3216
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
whitelisted
3216
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
whitelisted
3216
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
whitelisted
3216
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
whitelisted
3216
RegSvcs.exe
GET
200
132.226.8.169:80
http://checkip.dyndns.org/
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4
System
192.168.100.255:138
whitelisted
1080
svchost.exe
224.0.0.252:5355
whitelisted
3288
EQNEDT32.EXE
213.209.150.249:80
Alsycon B.V.
GB
malicious
3216
RegSvcs.exe
132.226.8.169:80
checkip.dyndns.org
ORACLE-BMC-31898
JP
whitelisted
3216
RegSvcs.exe
104.21.96.1:443
reallyfreegeoip.org
CLOUDFLARENET
malicious
3216
RegSvcs.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
whitelisted
3216
RegSvcs.exe
185.244.151.84:587
mail.tonicables.top
Host Sailor Ltd
RO
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
checkip.dyndns.org
  • 132.226.8.169
  • 193.122.130.0
  • 158.101.44.242
  • 132.226.247.73
  • 193.122.6.168
whitelisted
reallyfreegeoip.org
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.64.1
  • 104.21.80.1
  • 104.21.48.1
  • 104.21.32.1
  • 104.21.112.1
malicious
api.telegram.org
  • 149.154.167.220
whitelisted
mail.tonicables.top
  • 185.244.151.84
malicious

Threats

PID
Process
Class
Message
3288
EQNEDT32.EXE
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
3288
EQNEDT32.EXE
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1
3288
EQNEDT32.EXE
A Network Trojan was detected
ET MALWARE Possible Malicious Macro EXE DL AlphaNumL
3288
EQNEDT32.EXE
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 61
3288
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
3288
EQNEDT32.EXE
A Network Trojan was detected
ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2
3288
EQNEDT32.EXE
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
1080
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
3216
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
3216
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
No debug info