Overview

overview

10

Static

static

8

9d0a21ce53...d7.xls

windows7_x64

10

9d0a21ce53...d7.xls

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9d0a21ce53c6004f0caa583e2bcfbad4200eb7b3c9f5b2b68c8858592c7ec9d7
  • Size 1.6MB
  • Sample201006-atyeqxyfmn
  • SHA256 9d0a21ce53c6004f0caa583e2bcfbad4200eb7b3c9f5b2b68c8858592c7ec9d7
  • MD5 SHA1 SHA512
Score
10/10
ostapdownloadermacro

Malware Config

Targets

    • Target
      9d0a21ce53c6004f0caa583e2bcfbad4200eb7b3c9f5b2b68c8858592c7ec9d7
    • Size 1.6MB
    • SHA256 9d0a21ce53c6004f0caa583e2bcfbad4200eb7b3c9f5b2b68c8858592c7ec9d7
    • MD5 SHA1 SHA512
    Score
    10/10
    ostapdownloader

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ostap

      Ostap is a JS downloader, used to deliver other families.

      downloaderostap

    • Blocklisted process makes network request

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks