General
-
Target
Invoice.xlsm
-
Size
399KB
-
Sample
200710-zaptq44q7a
-
MD5
f7b59e2d235fee9ba12ec42df07ce2b5
-
SHA1
587fa2772cd69bf5d136d9f459fd01a4db65e9ba
-
SHA256
ff4386a4ec4746d085fe2fa9cf974f39334fa3c64b27b2ab88468ea72c898fb2
-
SHA512
48344cc1b929d2a9cd3f5a713743c75b6591f0284ea8fae5f7995e49ddd5df4deba9a0070106f83751af835e61cce059097037c778b16153bcf9cb4de5206d9f
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.xlsm
Resource
win7
Malware Config
Extracted
http://comawhimplet.com/nxxt.exe
Targets
-
-
Target
Invoice.xlsm
-
Size
399KB
-
MD5
f7b59e2d235fee9ba12ec42df07ce2b5
-
SHA1
587fa2772cd69bf5d136d9f459fd01a4db65e9ba
-
SHA256
ff4386a4ec4746d085fe2fa9cf974f39334fa3c64b27b2ab88468ea72c898fb2
-
SHA512
48344cc1b929d2a9cd3f5a713743c75b6591f0284ea8fae5f7995e49ddd5df4deba9a0070106f83751af835e61cce059097037c778b16153bcf9cb4de5206d9f
-
NetWire RAT payload
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Blacklisted process makes network request
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-