| File name: | CANKO DMC IMPORT ENQUIRY.xlam |
| Full analysis: | https://app.any.run/tasks/d06d93dc-10b6-41a3-ba51-175dcbebb91e |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | May 30, 2025, 23:12:52 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.openxmlformats-officedocument.spreadsheetml.sheet |
| File info: | Microsoft Excel 2007+ |
| MD5: | C85A5A0F6CCBF61943F9C803AD0EF478 |
| SHA1: | 5CE9B4C21D9DB033E6166AE5834B59F69CC98615 |
| SHA256: | 4E2C43F533736D7CDD6C88BAAEEE33ABE8596FFE8FFE1F88E8D8C17B1A6B0ADC |
| SSDEEP: | 98304:mxhMRSOeAQYTw/aX5BGqDN1iCAws2FxhpP54FH1Jp58y3otBxbOhiqaH1YpZaL9Z:CAFZ |
| .xlsx | | | Excel Microsoft Office Open XML Format document (61.2) |
|---|---|---|
| .zip | | | Open Packaging Conventions container (31.5) |
| .zip | | | ZIP compressed archive (7.2) |
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | 0x0002 |
| ZipCompression: | Deflated |
| ZipModifyDate: | 2025:05:29 03:37:12 |
| ZipCRC: | 0x60f273b5 |
| ZipCompressedSize: | 427 |
| ZipUncompressedSize: | 1751 |
| ZipFileName: | [Content_Types].xml |
| Creator: | Modexcomm |
|---|
| LastModifiedBy: | Modexcomm |
|---|---|
| CreateDate: | 2025:05:22 22:02:38Z |
| ModifyDate: | 2025:05:22 22:26:53Z |
| Application: | Microsoft Excel |
| DocSecurity: | None |
| ScaleCrop: | No |
| HeadingPairs: |
|
| TitlesOfParts: |
|
| LinksUpToDate: | No |
| SharedDoc: | No |
| HyperlinksChanged: | No |
| AppVersion: | 12 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1080 | C:\Windows\system32\svchost.exe -k NetworkService | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2444 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Exit code: 0 Version: 14.0.6024.1000 Modules
| |||||||||||||||
| 3216 | "C:\Users\admin\AppData\Roaming\linkinexcel3589.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe | linkinexcel3589.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft .NET Services Installation Utility Version: 4.8.3761.0 built by: NET48REL1 Modules
SnakeKeylogger(PID) Process(3216) RegSvcs.exe Keys DES6fc98cd68a1aab8b Options SMTP Userlinkings@tonicables.top SMTP Password7213575aceACE@# SMTP Hostmail.tonicables.top SMTP SendTolinking@tonicables.top SMTP Port587 | |||||||||||||||
| 3288 | "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding | C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE | svchost.exe | ||||||||||||
User: admin Company: Design Science, Inc. Integrity Level: MEDIUM Description: Microsoft Equation Editor Exit code: 0 Version: 00110900 Modules
| |||||||||||||||
| 3408 | "C:\Users\admin\AppData\Roaming\linkinexcel3589.exe" | C:\Users\admin\AppData\Roaming\linkinexcel3589.exe | — | EQNEDT32.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3924 | "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde | C:\Program Files\Microsoft Office\Office14\EXCEL.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 14.0.6024.1000 Modules
| |||||||||||||||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems |
| Operation: | write | Name: | +q" |
Value: 2B7122008C090000010000000000000000000000 | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1041 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1046 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1036 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1031 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1040 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1049 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 3082 |
Value: Off | |||
| (PID) Process: | (2444) EXCEL.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1042 |
Value: Off | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2444 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR551B.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3924 | EXCEL.EXE | C:\Users\admin\AppData\Local\Temp\CVR6E41.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 3288 | EQNEDT32.EXE | C:\Users\admin\AppData\Roaming\linkinexcel3589.exe | executable | |
MD5:04D2FA86612FA7A35DEDE2A8BBC77103 | SHA256:4AF47504549FA0D35684BAFB8276F3C8B0AE8A795B7026D53920E9505F1533B6 | |||
| 3288 | EQNEDT32.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\linking2996[1].exe | executable | |
MD5:04D2FA86612FA7A35DEDE2A8BBC77103 | SHA256:4AF47504549FA0D35684BAFB8276F3C8B0AE8A795B7026D53920E9505F1533B6 | |||
| 3408 | linkinexcel3589.exe | C:\Users\admin\AppData\Local\Temp\aut7759.tmp | binary | |
MD5:A46BB5BA5CD5405BA0E1DD2CED9F029D | SHA256:1CB3EA03269B50E02D7FDEA33B84979B836A3B54BEAA830A17EF9DE982D82E4C | |||
| 3924 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:6D4CE7E97B6564B401AE5DE11EDFF07B | SHA256:C85294729BDA4C240CB3F7AB5D02802146F721607BB27138DF350FD0B2432279 | |||
| 3408 | linkinexcel3589.exe | C:\Users\admin\AppData\Local\Temp\apostrophise | text | |
MD5:EC36ADDDF54DA8E4A6B1B508F4C17B88 | SHA256:00A4E7C5FC86444AE2ED1FB5F56699E09599FA0C7A6024896D57C94F7A424EA0 | |||
| 3924 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\CANKO DMC IMPORT ENQUIRY.xlam.LNK | binary | |
MD5:64D15EA52B9C2099CC231AF31DAF88FF | SHA256:1B4F55535A10C414B0DFF557457A7A8C2DE71C31482AF40DB1A3A0A52046F18B | |||
| 3408 | linkinexcel3589.exe | C:\Users\admin\AppData\Local\Temp\scroll | binary | |
MD5:651E418C78864E546589A43F5867A299 | SHA256:8CE2C631AAF903AAFEB61138028A4E8B67E3F28F508993CA15D1C5C5AE8623AE | |||
| 3408 | linkinexcel3589.exe | C:\Users\admin\AppData\Local\Temp\aut7883.tmp | binary | |
MD5:E60ED418E75B4701AFAF186D440BFE97 | SHA256:8EDD527B7DE3CB034A6D385E41C6D9142BCD30B06035125F8AF70B1471668FA1 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3288 | EQNEDT32.EXE | GET | 200 | 213.209.150.249:80 | http://213.209.150.249/linking2996.exe | unknown | — | — | malicious |
3216 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
3216 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
3216 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
3216 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
3216 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
3216 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
3216 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
3216 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
3216 | RegSvcs.exe | GET | 200 | 132.226.8.169:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
3288 | EQNEDT32.EXE | 213.209.150.249:80 | — | Alsycon B.V. | GB | malicious |
3216 | RegSvcs.exe | 132.226.8.169:80 | checkip.dyndns.org | ORACLE-BMC-31898 | JP | whitelisted |
3216 | RegSvcs.exe | 104.21.96.1:443 | reallyfreegeoip.org | CLOUDFLARENET | — | malicious |
3216 | RegSvcs.exe | 149.154.167.220:443 | api.telegram.org | Telegram Messenger Inc | GB | whitelisted |
3216 | RegSvcs.exe | 185.244.151.84:587 | mail.tonicables.top | Host Sailor Ltd | RO | unknown |
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
checkip.dyndns.org |
| whitelisted |
reallyfreegeoip.org |
| malicious |
api.telegram.org |
| whitelisted |
mail.tonicables.top |
| malicious |
PID | Process | Class | Message |
|---|---|---|---|
3288 | EQNEDT32.EXE | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
3288 | EQNEDT32.EXE | A Network Trojan was detected | ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 |
3288 | EQNEDT32.EXE | A Network Trojan was detected | ET MALWARE Possible Malicious Macro EXE DL AlphaNumL |
3288 | EQNEDT32.EXE | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 61 |
3288 | EQNEDT32.EXE | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
3288 | EQNEDT32.EXE | A Network Trojan was detected | ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 |
3288 | EQNEDT32.EXE | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
1080 | svchost.exe | Device Retrieving External IP Address Detected | ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org) |
3216 | RegSvcs.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup - checkip.dyndns.org |
3216 | RegSvcs.exe | Device Retrieving External IP Address Detected | ET INFO 404/Snake/Matiex Keylogger Style External IP Check |