IOC Report
Quotation_398893.xlam.xlsx

loading gif

Files

File Path
Type
Category
Malicious
Quotation_398893.xlam.xlsx
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\vss[1].exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\opponbvew.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\Desktop\~$Quotation_398893.xlam.xlsx
data
dropped
 malicious
C:\Users\user\Desktop\~$Quotation_398893.xlam.xls
data
dropped

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
 malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
 malicious
C:\Users\user\AppData\Local\Temp\opponbvew.exe
C:\Users\user\AppData\Local\Temp\opponbvew.exe
 malicious

URLs

Name
IP
Malicious
https://estqrow.com/rt/vss.exe
154.38.177.76
 malicious
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
http://crl.entrust.net/server1.crl0
unknown
http://ocsp.entrust.net03
unknown
https://estqrow.com/
unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
http://www.diginotar.nl/cps/pkioverheid0
unknown
http://ocsp.entrust.net0D
unknown
https://estqrow.com/rt/vss.exehhC:
unknown
https://secure.comodo.com/CPS0
unknown
https://estqrow.com/rt/vss.exej
unknown
http://crl.entrust.net/2048ca.crl0
unknown
https://estqrow.com/rt/vss.exeC:
unknown
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
estqrow.com
154.38.177.76
 malicious

IPs

IP
Domain
Country
Malicious
154.38.177.76
estqrow.com
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
 malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
t&/
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
Enabled
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
c+/
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
67CD000
stack
page read and write
1B795000
heap
page read and write
1CD5B000
heap
page read and write
2611000
trusted library allocation
page read and write
27EF000
stack
page read and write
680F000
heap
page read and write
6ACC000
stack
page read and write
36C000
heap
page read and write
1CD3E000
heap
page read and write
3610000
heap
page read and write
7FE8B5E2000
trusted library allocation
page read and write
1C8BF000
stack
page read and write
1B02F000
stack
page read and write
1EAE000
stack
page read and write
2DE000
heap
page read and write
2B60000
heap
page read and write
7FE8B686000
trusted library allocation
page read and write
3DF000
stack
page read and write
67D0000
heap
page read and write
7FE8B690000
trusted library allocation
page execute and read and write
7FE8B6B6000
trusted library allocation
page execute and read and write
2A0000
heap
page read and write
1D10000
heap
page read and write
7E6000
heap
page read and write
6B0F000
stack
page read and write
1CCF0000
heap
page read and write
36D000
heap
page read and write
2B20000
heap
page read and write
71D0000
heap
page read and write
C78000
heap
page read and write
2AAE000
stack
page read and write
1B5EB000
heap
page execute and read and write
6E4D000
stack
page read and write
18A000
stack
page read and write
282E000
stack
page read and write
70DF000
stack
page read and write
1B728000
heap
page read and write
10000
heap
page read and write
1B630000
heap
page read and write
1CD2D000
heap
page read and write
1B6EC000
heap
page read and write
6FD0000
heap
page read and write
3E7000
heap
page read and write
1D60000
heap
page read and write
1B0F5000
heap
page read and write
1ABBD000
stack
page read and write
CD2000
unkown
page execute read
2A0000
heap
page read and write
2A4000
heap
page read and write
1C49F000
stack
page read and write
7FE8B5F0000
trusted library allocation
page read and write
266000
stack
page read and write
1B12B000
heap
page read and write
1C69F000
stack
page read and write
CD6000
unkown
page write copy
7210000
heap
page read and write
7FE8B5ED000
trusted library allocation
page execute and read and write
2B00000
remote allocation
page read and write
316000
heap
page read and write
640000
heap
page read and write
1B0F0000
heap
page read and write
CD0000
unkown
page readonly
1D14000
heap
page read and write
2BA0000
heap
page read and write
10000
heap
page read and write
CD8000
unkown
page readonly
1CD79000
heap
page read and write
1F10000
heap
page read and write
7FE8B68C000
trusted library allocation
page execute and read and write
241F000
stack
page read and write
7FFFFF00000
trusted library allocation
page execute and read and write
1B5B5000
heap
page execute and read and write
1F0000
heap
page read and write
2C4000
heap
page read and write
1B6FB000
heap
page read and write
2BA8000
heap
page read and write
67ED000
heap
page read and write
7FE8B5DD000
trusted library allocation
page execute and read and write
2400000
heap
page execute and read and write
474000
heap
page read and write
22E0000
heap
page read and write
12618000
trusted library allocation
page read and write
1F20000
direct allocation
page read and write
7FE8B5D4000
trusted library allocation
page read and write
1C49E000
stack
page read and write | page guard
6814000
heap
page read and write
2BAB000
heap
page read and write
2316000
heap
page read and write
6F8F000
stack
page read and write
7FE8B770000
trusted library allocation
page read and write
260E000
stack
page read and write | page guard
1E6F000
stack
page read and write
CD0000
unkown
page readonly
7FE8B5D3000
trusted library allocation
page execute and read and write
7FE8B6F0000
trusted library allocation
page execute and read and write
7FE8B5F4000
trusted library allocation
page read and write
6F4F000
stack
page read and write
307000
heap
page read and write
365000
heap
page read and write
2BA4000
heap
page read and write
337000
heap
page read and write
67FF000
heap
page read and write
330000
heap
page read and write
3E0000
heap
page read and write
260F000
stack
page read and write
1D32000
heap
page read and write
39C000
heap
page read and write
644000
heap
page read and write
1B681000
heap
page read and write
3A4000
heap
page read and write
6A4E000
stack
page read and write
1AA8E000
stack
page read and write
1B71B000
heap
page read and write
2CF000
heap
page read and write
6D4C000
stack
page read and write
1B790000
heap
page read and write
12611000
trusted library allocation
page read and write
1B799000
heap
page read and write
89000
stack
page read and write
1CD54000
heap
page read and write
12613000
trusted library allocation
page read and write
7FE8B5E0000
trusted library allocation
page read and write
1CD0F000
heap
page read and write
6C4F000
stack
page read and write
6A8C000
stack
page read and write
1B6C3000
heap
page read and write
1B59D000
stack
page read and write
7FE8B5FD000
trusted library allocation
page execute and read and write
7FE8B62C000
trusted library allocation
page execute and read and write
39E000
heap
page read and write
2260000
heap
page read and write
470000
heap
page read and write
1CA2E000
stack
page read and write
6A0F000
stack
page read and write
BF4000
heap
page read and write
2B00000
remote allocation
page read and write
7FE8B780000
trusted library allocation
page execute and read and write
480000
heap
page read and write
292F000
stack
page read and write
7B0000
heap
page read and write
388000
heap
page read and write
7FE8B680000
trusted library allocation
page read and write
360F000
stack
page read and write
1EED000
stack
page read and write
690E000
stack
page read and write
4B6000
heap
page read and write
2A7000
heap
page read and write
100000
trusted library allocation
page read and write
1B817000
heap
page read and write
314000
heap
page read and write
1B810000
heap
page read and write
2AEE000
stack
page read and write
120000
trusted library allocation
page read and write
6B10000
heap
page read and write
1B5B0000
heap
page execute and read and write
There are 145 hidden memdumps, click here to show them.