Overview

overview

8

Static

static

Hoa don ti...Na.exe

windows7_x64

8

Hoa don ti...Na.exe

windows10_x64

8

Hoa don ti...ib.dll

windows7_x64

8

Hoa don ti...ib.dll

windows10_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VN.rar

  • Size

    164KB

  • Sample

    210315-cdsrx2l47s

  • MD5

    3fae1d5f25020829edbb5e95cc7f7836

  • SHA1

    1535e05a1970423d70bdf7a03e2dd026e458b4b6

  • SHA256

    aa331051db461ff1dc760616f23770293a91257087fd079e2e76c122db7c0561

  • SHA512

    eff895290fe3929a5e73741d843326890df54cb761a0ae10e6765eeb8923c1bae46cab007b28cc5538da34921aa2d7649f632ee01a8972e799b747c6a9b39d4a

Score
8/10
macroxlm

Malware Config

Targets

    • Target

      Hoa don tien no/Noi dung chi tiet hoa don tien no gui chi Thuong . Cong hoa xa hoi chu nghia Viet Nam Doc lap tu do hanh phuc.exe

    • Size

      339KB

    • MD5

      ceaa5817a65e914aa178b28f12359a46

    • SHA1

      534a7ea9c67bab3e8f2d41977bf43d41dfe951cf

    • SHA256

      6c959cfb001fbb900958441dfd8b262fb33e052342948bab338775d3e83ef7f7

    • SHA512

      fef4c0b451d18a9eb73045b3ddcd44450294f06c616cc7175850e6315a6265bd077c8fd09782c486eea624145c7d4c18f8e00a94c0deb394900f9b3e70e60320

    Score
    8/10
    macroxlm

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm
    behavioral1behavioral2

    • Target

      Hoa don tien no/wwlib.dll

    • Size

      114KB

    • MD5

      c6423f8911ed975ffa735eb14573e9f7

    • SHA1

      2620e17b03d829a740960a2c4d907b2f7ea2219c

    • SHA256

      fa259f953cd319da9bdcd84d40b2a89869bd307e8f9206b5653e78666f08f5b8

    • SHA512

      d42f129421ed8678c2fa5cd152e1523747754cc07dcf60849e00e481e5ad601dfc80cd9624d5254235d077359f546395a2eec80f825da0733ec6e302789422c5

    Score
    8/10
    macroxlm

    • Blocklisted process makes network request

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

6
T1082

Query Registry

4
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks