Overview

overview

10

Static

static

8

Debt-Detai...21.xls

windows7_x64

10

Debt-Detai...21.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Debt-Details-1527793772-02252021.zip

  • Size

    28KB

  • Sample

    210225-j6qev4eana

  • MD5

    dceef3d61d83959b6f290ab4b5642d60

  • SHA1

    13313eb52e92b5b0f42cec69f670b9152fd35937

  • SHA256

    20216257e83112cb3eca30d88f4824f553e0f557126a3cdf1dfb9be45e1707e4

  • SHA512

    2a45e3305fed88a799a10435c090e9decd7a6aeef1e50a06501240eca8fdf2ed57e6b250aa17942b84ea0e2ae99b8cef210417da389ccbc262b2b2d5ed12a3ac

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://oxcoz.com/nydprgwf/44252854339699100000.dat
xlm40.dropper

http://sharonbrockway.com/favohwn/44252854339699100000.dat
xlm40.dropper

http://outgrowmeinie.com/wcuiugnrebpk/44252854339699100000.dat
xlm40.dropper

http://sarayutseena-001-site1.gtempurl.com/kecljmkhyl/44252854339699100000.dat
xlm40.dropper

http://gtrans.group/prduod/44252854339699100000.dat

Targets

    • Target

      Debt-Details-1527793772-02252021.xls

    • Size

      144KB

    • MD5

      de8ff1c066ee81de11ef836d96bfc75d

    • SHA1

      cfcf197bb22f00fdb232003c6811826da3a4a035

    • SHA256

      d9db49a3ae43c585dc2d9ce9d41a1e284aa69bf74d3959f6406a22f86934a2d8

    • SHA512

      e881a2588eb5e74d09cb1c670c034d3c159e7e3d084401d319fa282bb965bf4a18e9fe4e5666a83d32fde7e3dcd6526846031aa9e6138f6d318b8c76d0119f6c

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks