General
-
Target
0f2701f8a2887d860bdb0dfe233f7e25ee8852103dc87658ff1b67b34a1c30b7
-
Size
157KB
-
Sample
210112-ylptpnmzt2
-
MD5
b1864357f770d51b756a5f201c56853c
-
SHA1
f099888af34b20feb794d711892675062f8298a4
-
SHA256
0f2701f8a2887d860bdb0dfe233f7e25ee8852103dc87658ff1b67b34a1c30b7
-
SHA512
64827b71e07842f54bc669908cacc259d6c9081eb73030d9bc00b00286f41802a6e8c8adc64ea51fdfdd74b4cda5df857eb9b6b827d5db08bda9db6d56ad541b
Static task
static1
Behavioral task
behavioral1
Sample
0f2701f8a2887d860bdb0dfe233f7e25ee8852103dc87658ff1b67b34a1c30b7.doc
Resource
win10v20201028
Malware Config
Extracted
https://altrashift.com/wp-includes/I/
https://ojodetigremezcal.com/wp/i62s/
https://snowremoval-services.com/wp-content/P3Z/
http://kitsunecomplements.com/too-much-phppq/n65U/
https://imperioone.com/content/WOBq/
http://www.autoeck-baden.at/wp-content/w0Vb/
https://shop.animewho.com/content/Tj/
Targets
-
-
Target
0f2701f8a2887d860bdb0dfe233f7e25ee8852103dc87658ff1b67b34a1c30b7
-
Size
157KB
-
MD5
b1864357f770d51b756a5f201c56853c
-
SHA1
f099888af34b20feb794d711892675062f8298a4
-
SHA256
0f2701f8a2887d860bdb0dfe233f7e25ee8852103dc87658ff1b67b34a1c30b7
-
SHA512
64827b71e07842f54bc669908cacc259d6c9081eb73030d9bc00b00286f41802a6e8c8adc64ea51fdfdd74b4cda5df857eb9b6b827d5db08bda9db6d56ad541b
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Drops file in System32 directory
-