Overview

overview

10

Static

static

8

Dat - 1348...20.doc

windows7_x64

10

Dat - 1348...20.doc

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Dat - 1348 22 Dezember 2020.doc
  • Size 201KB
  • Sample201224-hlynh9l6ea
  • SHA256 e1757b0f0980cca2afdf7bf366e1ae85afc7d2608565aa49c3581be6c7722244
  • MD5 SHA1 SHA512
Score
10/10
macro

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://accionistas.balneariodealange.com/rumus-jitu-wkg6v/SIGNUP/
  • exe.dropper

    http://andeanreach.com//System/
  • exe.dropper

    https://fresh-flowers-galore.com/wp-content/SSChBp8P/
  • exe.dropper

    https://travianbot.net/wp-admin/58Crtv/
  • exe.dropper

    https://italymining.eu/wp-includes/en-US/
  • exe.dropper

    http://biolandmedical.litofis.com/VGX/
  • exe.dropper

    http://ciroiluminacion.litofis.com/wp-includes/eKWy/

Targets

    • Target
      Dat - 1348 22 Dezember 2020.doc
    • Size 201KB
    • SHA256 e1757b0f0980cca2afdf7bf366e1ae85afc7d2608565aa49c3581be6c7722244
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Blocklisted process makes network request

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks