Overview

overview

10

Static

static

8

Debt-Detai...21.xls

windows7_x64

10

Debt-Detai...21.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Debt-Details-122785705-03052021.zip

  • Size

    13KB

  • Sample

    210306-fh84y2szae

  • MD5

    344af49a88e7a90f19e59549768c28fd

  • SHA1

    0642c587ec2f3925490b24c35d4b49ca1197de08

  • SHA256

    90571ef6228da3183da7fbc6bf5eff12933c7d2ec1cb460809b687c5e0996d21

  • SHA512

    791dcc2a105a8999ace320b9f10a18c0ac08bba75218d973793dd76c448512119895a8308570e3e8d0c9f93d63089d2e29c2b5b6a954d50314ca801ea9ac600a

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://kosherbansko.com/vozrhzftc/44261.3029569444.dat
xlm40.dropper

http://beautyhair.by/rkqhopvrb/44261.3029569444.dat
xlm40.dropper

http://trysaileggplants.com/xbbomazcknz/44261.3029569444.dat
xlm40.dropper

http://giftcard16.com/pghxph/44261.3029569444.dat
xlm40.dropper

http://www.ausfencing.org/jqikucbefrth/44261.3029569444.dat

Targets

    • Target

      Debt-Details-122785705-03052021.xls

    • Size

      78KB

    • MD5

      c33f14f5c08ce99c38ad91690d93a11b

    • SHA1

      bd0e5b60b542ad2031d05ec1113feb42b369c5a2

    • SHA256

      0d3109e046c61f2822e061343c360e0328feb6805c52b2e32146a122de253177

    • SHA512

      2333e54e2d9dbb6e7a300a5c4e91199d5fc344014f43c494ddd2c81637351c85a5a3a1382e99fd97aedd8ad367d7011eb0b0f0a92e478e048a600554e8ef2a69

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks