Overview

overview

10

Static

static

8

societ_1965.xlsb

windows7_x64

10

societ_1965.xlsb

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    societ_1965.xlsb

  • Size

    68KB

  • Sample

    210315-s69c4272sj

  • MD5

    58e423c70460ff2e8d8b1ffe2b16400f

  • SHA1

    c48df391a979e4db06d05f70962ef828beb51dd0

  • SHA256

    dbb9b1dff45c110189b9a553a73457e2143173cfa0ae82ffa176d490b2c33212

  • SHA512

    b2a6fa2d590841796d03f2c66d23deeb121c8e29caa257197c9d24a150690489a80f99f94206c34b64cd7145a676a67564bd883fe59c46e5b4f06c922f1852c6

Score
10/10
macroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://linestata.bar/register.jpg

Targets

    • Target

      societ_1965.xlsb

    • Size

      68KB

    • MD5

      58e423c70460ff2e8d8b1ffe2b16400f

    • SHA1

      c48df391a979e4db06d05f70962ef828beb51dd0

    • SHA256

      dbb9b1dff45c110189b9a553a73457e2143173cfa0ae82ffa176d490b2c33212

    • SHA512

      b2a6fa2d590841796d03f2c66d23deeb121c8e29caa257197c9d24a150690489a80f99f94206c34b64cd7145a676a67564bd883fe59c46e5b4f06c922f1852c6

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks