Overview

overview

10

Static

static

8

詳細情å...±.xlsb

windows7_x64

10

詳細情å...±.xlsb

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    20210409_id7f076a2ecd.zip

  • Size

    321KB

  • Sample

    210409-gq6zykjt4a

  • MD5

    5302b421902b24b9064bd2a885c0359c

  • SHA1

    3d6af14c599b574e41093021336e1c0c5184cea0

  • SHA256

    3ec34f115754827e485cf6eece92db8051fd85c1ebfd104494f5e6c634d07b08

  • SHA512

    a5d11fb1d6054f46cf2dbc2603df9af112eda83224400c514bce1dfb63e7f8371487370597d4c7b8428b3472746515a16805d684866784486dbb3f25342cde94

Score
10/10
nloaderloadermacroupxxlm

Malware Config

Extracted

Language
xlm4.0
Source

Targets

    • Target

      詳細情報/詳細情報.xlsb

    • Size

      317KB

    • MD5

      169685039016891f5442292ad95e51c9

    • SHA1

      a2db74f9ab457c403e238cb2410848447f89548e

    • SHA256

      7d1ff39fc6daab153ad6477554415336578256257aa81fd796a48b89c7a8b2e8

    • SHA512

      7c990325b11c661fb3acd7a0f8ed312844b190d3211c2468aa7854271717c9ad96c77dd5e9fcf7042a2e5ce6001d7a6a4edc48265e052d93e128334de4e0e905

    Score
    10/10
    nloaderloaderupx

    • Nloader

      Simple loader that includes the keyword 'cambo' in the URL used to download other families.

      loadernloader

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Nloader Payload

    • Blocklisted process makes network request

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks