Overview

overview

10

Static

static

8

Debt-Detai...21.xls

windows7_x64

10

Debt-Detai...21.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Debt-Details-787008390-03052021.zip

  • Size

    13KB

  • Sample

    210307-s9mj2jv7re

  • MD5

    375e19bd570c6cd28bb84cf97e4b99dd

  • SHA1

    5431f0b3cd4002c070b272686efc53eeeea88173

  • SHA256

    b143c00769598454abbfa30d2a0f2fe14f1a34c890078650488dffeff7c6c775

  • SHA512

    6edd61ee06f0978b15f9681219b1c9d1e96391f1c7a6ed081cd7e060da77c7e960c6f3698363ecdd0a232c8f47b4ffad2f0854016c0c56e41cb1efb25f725a3c

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://kosherbansko.com/vozrhzftc/44262.7839484954.dat
xlm40.dropper

http://beautyhair.by/rkqhopvrb/44262.7839484954.dat
xlm40.dropper

http://trysaileggplants.com/xbbomazcknz/44262.7839484954.dat
xlm40.dropper

http://giftcard16.com/pghxph/44262.7839484954.dat
xlm40.dropper

http://www.ausfencing.org/jqikucbefrth/44262.7839484954.dat

Targets

    • Target

      Debt-Details-787008390-03052021.xls

    • Size

      78KB

    • MD5

      ab7e7cdb468d760257367c21c25966d4

    • SHA1

      7aafff3ff5184cd65cddfe50b3438648c5a2ec55

    • SHA256

      ad987b8df15faf669433887679d2884eba2eae7c62a2c2af6c78c991cf275128

    • SHA512

      b53543c22a298427dee74eb1019d51742eba67aeb5af58cdcfdb1da244d25d8084a16e2c3c68b2b65b756ded025d07f50cb21429de993f0f4ecfb09692122e61

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks