12a3bd739b931614da626b320973016a0b532439059071736df7e258b33e98ba | Triage

Sharing

General

Target

catalog-2097704966.zip
Size

50KB
Sample

210513-pqyck8pk42
MD5

b7d1e77895c90abe3b2ce5a04fdb35de
SHA1

3d5b020510b8b3c3c6cf99e0c8ac78cfe2c78826
SHA256

12a3bd739b931614da626b320973016a0b532439059071736df7e258b33e98ba
SHA512

418f47ec237a5ab24bd11cd7345b3e9803458e2c65d70b4ab0b5803c003ab8ca18ce72b8cfca4292c730784e74104d3c67999b0851bf1735be46c97c77bde098

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://smartpalakatva.com/edQsUZOLlE/th.html

xlm40.dropper

https://pilstlcommodities.com/Ov4FlB3lpy/th.html

Targets

- Target
  
  catalog-2097704966.xls
- Size
  
  367KB
- MD5
  
  0e176677de88cf7386da5966e193f625
- SHA1
  
  8ae207b65d1fb18d53f70739a122ca149844ec04
- SHA256
  
  f4083089ebee6a2ffd3060a4dcb38ace244323975f1da010ea0d90ef33ff9166
- SHA512
  
  32d1691d5353b0392a2b5534cfb079117429282089636617e30eab011f141519cf149c2727b240611c29c14f233765361e02a42e85115919b675212794b40565
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2