analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

f668c9065095c2b45801fe01e6e924576bc55513ea3779dfb8cafcacd1776abb.xlsx

Full analysis: https://app.any.run/tasks/de5bbb05-0d2e-4993-b136-e487bcdb1615
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 15, 2019, 01:39:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exploit
CVE-2017-11882
loader
trojan
rat
njrat
bladabindi
Indicators:
MIME: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info: Microsoft Excel 2007+
MD5:

FC43D7C7A204B693C291EBC3BCD2225B

SHA1:

320CC1530BE00F6D9C5F64C49D6866697FEE03E5

SHA256:

F668C9065095C2B45801FE01E6E924576BC55513EA3779DFB8CAFCACD1776ABB

SSDEEP:

192:ak+axK111iRcOffOVmL1ui/CF10sxozGdBnidfaqSpy1mwZhX9fKIKLpIoa2I0pB:5VQ1greI1Xsx1LKfytw/9ILloUB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Equation Editor starts application (CVE-2017-11882)

      • EQNEDT32.EXE (PID: 2552)

    • Suspicious connection from the Equation Editor

      • EQNEDT32.EXE (PID: 2552)

    • Application was dropped or rewritten from another process

      • IntelOpteronDriver21993NEW-CLIENT.exe (PID: 4064)
      • svhost.exe (PID: 2268)
      • tmp3441.tmp.exe (PID: 2684)
      • IntelOpteronDriver21852server.exe (PID: 3204)

    • Downloads executable files from the Internet

      • EQNEDT32.EXE (PID: 2552)

    • Writes to a start menu file

      • svhost.exe (PID: 2268)
      • tmp3441.tmp.exe (PID: 2684)
      • IntelOpteronDriver21993NEW-CLIENT.exe (PID: 4064)

    • NJRAT was detected

      • IntelOpteronDriver21993NEW-CLIENT.exe (PID: 4064)

    • Changes the autorun value in the registry

      • IntelOpteronDriver21852server.exe (PID: 3204)

    • Connects to CnC server

      • IntelOpteronDriver21993NEW-CLIENT.exe (PID: 4064)

    • Loads dropped or rewritten executable

      • IntelOpteronDriver21993NEW-CLIENT.exe (PID: 4064)

    • Actions looks like stealing of personal data

      • IntelOpteronDriver21993NEW-CLIENT.exe (PID: 4064)

  • SUSPICIOUS

    • Creates files in the program directory

      • EQNEDT32.EXE (PID: 2552)

    • Executable content was dropped or overwritten

      • EQNEDT32.EXE (PID: 2552)
      • svhost.exe (PID: 2268)
      • IntelOpteronDriver21993NEW-CLIENT.exe (PID: 4064)
      • tmp3441.tmp.exe (PID: 2684)
      • vbc.exe (PID: 2988)

    • Creates files in the user directory

      • EQNEDT32.EXE (PID: 2552)
      • svhost.exe (PID: 2268)
      • tmp3441.tmp.exe (PID: 2684)
      • IntelOpteronDriver21852server.exe (PID: 3204)
      • vbc.exe (PID: 2988)
      • IntelOpteronDriver21993NEW-CLIENT.exe (PID: 4064)

    • Connects to unusual port

      • IntelOpteronDriver21993NEW-CLIENT.exe (PID: 4064)
      • IntelOpteronDriver21852server.exe (PID: 3204)

    • Executes scripts

      • IntelOpteronDriver21993NEW-CLIENT.exe (PID: 4064)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xlsx | Excel Microsoft Office Open XML Format document (61.2)
.zip | Open Packaging Conventions container (31.5)
.zip | ZIP compressed archive (7.2)

EXIF

XML

AppVersion: 12
HyperlinksChanged: No
SharedDoc: No
LinksUpToDate: No
Company: -
TitlesOfParts:
  • Hoja1
  • Hoja2
  • Hoja3
HeadingPairs:
  • Hojas de cálculo
  • 3
ScaleCrop: No
DocSecurity: None
Application: Microsoft Excel
ModifyDate: 2017:11:16 16:01:11Z
CreateDate: 2006:09:12 12:46:56Z
LastModifiedBy: -

XMP

Creator: -

ZIP

ZipFileName: [Content_Types].xml
ZipUncompressedSize: 1777
ZipCompressedSize: 402
ZipCRC: 0x52547938
ZipModifyDate: 2019:03:13 06:48:02
ZipCompression: Deflated
ZipBitFlag: 0x0002
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start excel.exe no specs eqnedt32.exe svhost.exe #NJRAT intelopterondriver21993new-client.exe tmp3441.tmp.exe intelopterondriver21852server.exe regasm.exe no specs msbuild.exe no specs vbc.exe cvtres.exe no specs vbc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2812"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /ddeC:\Program Files\Microsoft Office\Office14\EXCEL.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Excel
Version:
14.0.6024.1000
2552"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
svchost.exe
User:
admin
Company:
Design Science, Inc.
Integrity Level:
MEDIUM
Description:
Microsoft Equation Editor
Exit code:
0
Version:
00110900
2268C:\ProgramData\svhost.exeC:\ProgramData\svhost.exe
EQNEDT32.EXE
User:
admin
Company:
Motorola
Integrity Level:
MEDIUM
Description:
MotoService
Exit code:
0
Version:
3.4.3
4064"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelOpteronDriver21993NEW-CLIENT.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelOpteronDriver21993NEW-CLIENT.exe
svhost.exe
User:
admin
Integrity Level:
MEDIUM
2684"C:\Users\admin\AppData\Local\Temp\tmp3441.tmp.exe" C:\Users\admin\AppData\Local\Temp\tmp3441.tmp.exe
IntelOpteronDriver21993NEW-CLIENT.exe
User:
admin
Company:
Simon Tatham
Integrity Level:
MEDIUM
Description:
PuTTY suite
Exit code:
0
Version:
Release 0.70
3204"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelOpteronDriver21852server.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelOpteronDriver21852server.exe
tmp3441.tmp.exe
User:
admin
Integrity Level:
MEDIUM
3268"C:\Windows\Microsoft.NET\Framework\v2.0.50727\Regasm.exe" -B --donate-level=0 -t -a cryptonight --url= -u -p -R --variant=-1 --max-cpu-usage=50C:\Windows\Microsoft.NET\Framework\v2.0.50727\Regasm.exe—IntelOpteronDriver21993NEW-CLIENT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
2
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
2124"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelOpteronDriver21993NEW-CLIENT.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—IntelOpteronDriver21993NEW-CLIENT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.6.1055.0 built by: NETFXREL2
2988"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\admin\AppData\Local\Temp\wy2vxj3t.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
IntelOpteronDriver21993NEW-CLIENT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual Basic Command Line Compiler
Exit code:
0
Version:
8.0.50727.5420
3700C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES660A.tmp" "C:\Users\admin\AppData\Local\Temp\vbc6609.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—vbc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Total events
6 196
Read events
6 112
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
0
Text files
4
Unknown types
5

Dropped files

PID
Process
Filename
Type
2812EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVR99C5.tmp.cvr —
MD5:—
SHA256:—
2268svhost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelOpteronDriver21993EncedFile.aes —
MD5:—
SHA256:—
2684tmp3441.tmp.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelOpteronDriver21852EncedFile.aes —
MD5:—
SHA256:—
2988vbc.exeC:\Users\admin\AppData\Local\Temp\vbc6609.tmp —
MD5:—
SHA256:—
3700cvtres.exeC:\Users\admin\AppData\Local\Temp\RES660A.tmp —
MD5:—
SHA256:—
2988vbc.exeC:\Users\admin\AppData\Local\Temp\wy2vxj3t.out —
MD5:—
SHA256:—
2268svhost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelOpteronDriver21993NEW-CLIENT.exeexecutable
MD5:2CED46FF7E75CE5ABE664C7B57521705
SHA256:1150E39644CADF3B5DEB15C0D645C8A48528C21B7E89B102123755CAC149BA75
2552EQNEDT32.EXEC:\ProgramData\svhost.exeexecutable
MD5:7669F45A1B3C84AE5CDEDA2E1E1229DA
SHA256:A5ABD5441AE317ED5AEA4975BF520520DB4A5DC72913FAF53F1902ECB4E3E896
2684tmp3441.tmp.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IntelOpteronDriver21852server.exeexecutable
MD5:37A93BE944160E322CF7E89405C013DE
SHA256:38BCA9583C66BBA445A1C52A0CC92BD3AC7DC6009C7A0553DE117CF9968133D9
2552EQNEDT32.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\lime[1].exeexecutable
MD5:7669F45A1B3C84AE5CDEDA2E1E1229DA
SHA256:A5ABD5441AE317ED5AEA4975BF520520DB4A5DC72913FAF53F1902ECB4E3E896
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2552
EQNEDT32.EXE
GET
200
202.71.110.22:80
http://www.jbee.my/lime.exe
MY
executable
112 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4064
IntelOpteronDriver21993NEW-CLIENT.exe
103.53.199.253:3338
—
NewMedia Express Pte Ltd
HK
malicious
3204
IntelOpteronDriver21852server.exe
103.53.199.253:3339
—
NewMedia Express Pte Ltd
HK
malicious
2552
EQNEDT32.EXE
202.71.110.22:80
www.jbee.my
TM-VADS DC Hosting
MY
suspicious
4064
IntelOpteronDriver21993NEW-CLIENT.exe
114.143.31.216:443
www.netvidya.com
Tata Teleservices Maharashtra Ltd
IN
unknown

DNS requests

Domain
IP
Reputation
www.jbee.my
  • 202.71.110.22
suspicious
www.netvidya.com
  • 114.143.31.216
unknown

Threats

PID
Process
Class
Message
2552
EQNEDT32.EXE
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2552
EQNEDT32.EXE
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
4064
IntelOpteronDriver21993NEW-CLIENT.exe
A Network Trojan was detected
MALWARE [PTsecurity] njRAT/Bladabindi (Lime-RAT)
3204
IntelOpteronDriver21852server.exe
A Network Trojan was detected
MALWARE [PTsecurity] Ozone RAT connection
3204
IntelOpteronDriver21852server.exe
A Network Trojan was detected
MALWARE [PTsecurity] Ozone RAT connection
4064
IntelOpteronDriver21993NEW-CLIENT.exe
A Network Trojan was detected
MALWARE [PTsecurity] Lime-RAT (Gen.NjRAT)
3204
IntelOpteronDriver21852server.exe
A Network Trojan was detected
MALWARE [PTsecurity] Ozone RAT connection
4064
IntelOpteronDriver21993NEW-CLIENT.exe
A Network Trojan was detected
MALWARE [PTsecurity] Lime-RAT (Gen.NjRAT)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
f668c9065095c2b45801fe01e6e924576bc55513ea3779dfb8cafcacd1776abb.xlsx