Excel launches an executable; a separate payload request lacks delivery proof
The spreadsheet’s sandbox records link Excel to local executable activity and a second matching-content filename targeted by a logon launch setting. They also show a request for an executable at bagsrad.com and contact with a separate, memory-configured Warzone-family endpoint, but do not prove the request supplied the binary that ran.
An Excel spreadsheet’s sandbox record contains a request for an executable at www.bagsrad.com and traffic to a different host’s configured TCP endpoint on port 5203. Are these two parts of one delivery-and-control sequence? The evidence establishes distinct roles for the destinations, but not every link between them. CTX Threat Intelligence’s records show Excel launching a local executable, a matching executable appearing under another name, and a logon launch setting pointing to that second…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read