Overview

overview

10

Static

static

8

comun_148.xlsb

windows7_x64

10

comun_148.xlsb

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    comun_148.xlsb

  • Size

    61KB

  • Sample

    210315-hqrkbf6stn

  • MD5

    9d400e455aa35dec498bffb77643cdef

  • SHA1

    c32a408e13b4db2c1a82253b1d6ed16131acbd12

  • SHA256

    752e76b62d3dd852a045c535d2cd0d1c6b47ef98e55526943738c221c933e166

  • SHA512

    5e36aaced588a14697cf073a7621b8a665d8715572f75b186b73d9e0e6d26e00c416f933682a552eb8ac57a003b59ad581d77cc791134198a1bfeb2f77aaf0f2

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://onlinestatis.bar/signup.jpg

Targets

    • Target

      comun_148.xlsb

    • Size

      61KB

    • MD5

      9d400e455aa35dec498bffb77643cdef

    • SHA1

      c32a408e13b4db2c1a82253b1d6ed16131acbd12

    • SHA256

      752e76b62d3dd852a045c535d2cd0d1c6b47ef98e55526943738c221c933e166

    • SHA512

      5e36aaced588a14697cf073a7621b8a665d8715572f75b186b73d9e0e6d26e00c416f933682a552eb8ac57a003b59ad581d77cc791134198a1bfeb2f77aaf0f2

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks