Overview

overview

10

Static

static

8

9185810393...1.xlsm

windows7_x64

10

9185810393...1.xlsm

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9185810393-04012021.xlsm
  • Size 172KB
  • Sample210401-yt17dbeeaj
  • SHA256 468929d95e54416bbc7d6830b20e7f08f46001742fe9c3be1a2ec42a4dd79708
  • MD5 SHA1 SHA512
Score
10/10
macroxlm

Malware Config

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    http://45.150.67.243/44285,5327891204.dat
  • xlm40.dropper

    http://195.123.210.186/44285,5327891204.dat
  • xlm40.dropper

    http://91.211.89.28/44285,5327891204.dat

Targets

    • Target
      9185810393-04012021.xlsm
    • Size 172KB
    • SHA256 468929d95e54416bbc7d6830b20e7f08f46001742fe9c3be1a2ec42a4dd79708
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks