Overview

overview

10

Static

static

8

Debt-Detai...21.xls

windows7_x64

10

Debt-Detai...21.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Debt-Details-2080450077-03052021.zip

  • Size

    13KB

  • Sample

    210306-lpkprwddm2

  • MD5

    3bb707dc28180eaa4417a0fe2bfccecd

  • SHA1

    8667a1bd814c4b1c20a897524737b0bacf8435a3

  • SHA256

    94dbf95c02cfc42c570b35aa665f67916254a371bf6f41c6653254dab54112e1

  • SHA512

    16cde8ef2684a9ffad8fe3565eab6c8756a99dd56c9057ea3fb4d3b72c5d4870ab0bedb1099aa7c0d7a691bd47d91347503802a87a3c5375cda90cd0ed9a21d8

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://kosherbansko.com/vozrhzftc/44261.1489456019.dat
xlm40.dropper

http://beautyhair.by/rkqhopvrb/44261.1489456019.dat
xlm40.dropper

http://trysaileggplants.com/xbbomazcknz/44261.1489456019.dat
xlm40.dropper

http://giftcard16.com/pghxph/44261.1489456019.dat
xlm40.dropper

http://www.ausfencing.org/jqikucbefrth/44261.1489456019.dat

Targets

    • Target

      Debt-Details-2080450077-03052021.xls

    • Size

      78KB

    • MD5

      bfca95292db7cd6268acda9b80721c36

    • SHA1

      1b4ed8603a2b350b1e1198869e111ed6a745220a

    • SHA256

      6efaa0712e8f7a9bb411df2045ba89f42e35c43cceb608bf56bd5ee14125d036

    • SHA512

      ad1ca784da33d733a17a9feb8e82c32c41efc31444ed55000fa71d268d0b4136c60f603c43c0c47e2f9cb0256309dcb94c24b37699b118f7e198f22eb436b6c1

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks