Overview

overview

10

Static

static

8

Attachment_98708.xlsb

windows7_x64

10

Attachment_98708.xlsb

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Attachment_98708.xlsb

  • Size

    197KB

  • Sample

    210302-c4trj9swea

  • MD5

    dd5169f2cfc9499eb9eef5ddf6862fb9

  • SHA1

    e3730d93ee0d88808dbe566c84bca090a3fe7dcc

  • SHA256

    56de3c08f5bebe5e57a644e893eb944479991c2bf3c9e814572b53313e16c28d

  • SHA512

    577d9a6c7eab62aa87e779ebba4e8451fcac7fd8c8b9d8cdc04ba1bd42b889fa1652fc30c72481cfde7c63722e0943202a576e6e37b165d6289413fb3c8c0434

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://195.123.219.21/campo/t3/t3

Targets

    • Target

      Attachment_98708.xlsb

    • Size

      197KB

    • MD5

      dd5169f2cfc9499eb9eef5ddf6862fb9

    • SHA1

      e3730d93ee0d88808dbe566c84bca090a3fe7dcc

    • SHA256

      56de3c08f5bebe5e57a644e893eb944479991c2bf3c9e814572b53313e16c28d

    • SHA512

      577d9a6c7eab62aa87e779ebba4e8451fcac7fd8c8b9d8cdc04ba1bd42b889fa1652fc30c72481cfde7c63722e0943202a576e6e37b165d6289413fb3c8c0434

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks