General
-
Target
abfe4c583168ef347612435e4a452cb19d1716caedaf134353db27a4e0efcfc2
-
Size
172KB
-
Sample
210122-xgr9fp9b4s
-
MD5
5d0469a5370cf24ffa74dc3110091cfb
-
SHA1
e6902e11caefe86d886a97d9abf4599cb6635625
-
SHA256
abfe4c583168ef347612435e4a452cb19d1716caedaf134353db27a4e0efcfc2
-
SHA512
6118c3f12c5f6c98e31c90fa20e81d267876cae36509cd929e6b416243f275621020b37151929e8f8fbb0eb8c20088fe5142c9bffd454662c720038c432be1ec
Behavioral task
behavioral1
Sample
abfe4c583168ef347612435e4a452cb19d1716caedaf134353db27a4e0efcfc2.doc
Resource
win10v20201028
Malware Config
Extracted
http://coworkingplus.es/wp-admin/FxmME/
http://silkonbusiness.matrixinfotechsolution.com/js/q26/
https://bbjugueteria.com/s6kscx/Z/
https://www.bimception.com/wp-admin/sHy5t/
http://armakonarms.com/wp-includes/fz/
http://alugrama.com.mx/t/2/
http://homecass.com/wp-content/iF/
Targets
-
-
Target
abfe4c583168ef347612435e4a452cb19d1716caedaf134353db27a4e0efcfc2
-
Size
172KB
-
MD5
5d0469a5370cf24ffa74dc3110091cfb
-
SHA1
e6902e11caefe86d886a97d9abf4599cb6635625
-
SHA256
abfe4c583168ef347612435e4a452cb19d1716caedaf134353db27a4e0efcfc2
-
SHA512
6118c3f12c5f6c98e31c90fa20e81d267876cae36509cd929e6b416243f275621020b37151929e8f8fbb0eb8c20088fe5142c9bffd454662c720038c432be1ec
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Loads dropped DLL
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-