General

  • Target

    Overdue-Debt-362804077-03042021.xls

  • Size

    76KB

  • Sample

    210305-ej94h679yx

  • MD5

    a5ce788938ede1feac694ca1bd819792

  • SHA1

    76921b6a68d2ea6ac336c03e3303eb2463f9020c

  • SHA256

    be481b1e185c71d87c8f3b68f6c3bb8d09cc30e9ff735f97c474ce89187dd627

  • SHA512

    0cec65ffa96a5177c8af308623baf989baf17c59afdc3d5490f845252a70cc477bec3511da26562ff51d61fc939c63f0b0f4de1e78944b2e06cd41c5f6a7f4c2

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://depositcontact.com/sjhqomzn/44260.3427619213.jpg

xlm40.dropper

http://maverickcracks.com/evcxweyir/44260.3427619213.jpg

xlm40.dropper

http://bladdercracks.com/yxxqegof/44260.3427619213.jpg

xlm40.dropper

http://formulateaccountant.com/lrzxajo/44260.3427619213.jpg

xlm40.dropper

http://classifylost.com/pkcdvvngsums/44260.3427619213.jpg

Targets

    • Target

      Overdue-Debt-362804077-03042021.xls

    • Size

      76KB

    • MD5

      a5ce788938ede1feac694ca1bd819792

    • SHA1

      76921b6a68d2ea6ac336c03e3303eb2463f9020c

    • SHA256

      be481b1e185c71d87c8f3b68f6c3bb8d09cc30e9ff735f97c474ce89187dd627

    • SHA512

      0cec65ffa96a5177c8af308623baf989baf17c59afdc3d5490f845252a70cc477bec3511da26562ff51d61fc939c63f0b0f4de1e78944b2e06cd41c5f6a7f4c2

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks