Overview

overview

10

Static

static

catalog-247243045.xls

windows7_x64

10

catalog-247243045.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    catalog-247243045.zip

  • Size

    50KB

  • Sample

    210513-pstg4pjftn

  • MD5

    88d5a10563c70999e39f221043ed3883

  • SHA1

    04c2ccd5400949ed2f8b803ae23e659228e558b9

  • SHA256

    fd45756836d92f556fea7afda23a9e39f1f325ae388dd3e89170d8de55937ecc

  • SHA512

    315f45f5a78a1789920c6840f1f5ce6c26cd203d2e0432047c72fd204a69b8511f8baea94a521f16a03f1a850df28209a43cbafc33d2b7f9902a6693c96829fc

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://smartpalakatva.com/edQsUZOLlE/th.html
xlm40.dropper

https://pilstlcommodities.com/Ov4FlB3lpy/th.html

Targets

    • Target

      catalog-247243045.xls

    • Size

      367KB

    • MD5

      5a339b13301e1f65ca07773534dc13eb

    • SHA1

      15e6552112a87436b0e849f7c9800e94e8296e33

    • SHA256

      17f0dba4048c1f6809e831e08caed28a75d95eed377ef3855a7a01f740956aa7

    • SHA512

      f68548e4235ced77e3e224b38421955565e602ffed228948c8588398fd111dc381836bef6cf59ed71ea9d255d8c152ef6a1e9f045241ef367c0b80410d3df809

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks