General
-
Target
SPS8623121050508150.docx
-
Size
10KB
-
Sample
210525-kq5xyxkmxx
-
MD5
a9afdac1e8cbe1f1c65bc0794b38b4a1
-
SHA1
7fc460104106e798537c2b8ddfbf1c21192eca78
-
SHA256
82a250d066480fbade78fb2498bfd6cd26a5487705e82a2cc16c6b34627cdfb4
-
SHA512
fd5247de795705aae434a20d9f63a746e6d62a4b92a39ce4cc74936587704bbace17d51ddd15663f880186f9e76981f9150b577a5f2b8a3d29b34e3f40975393
Static task
static1
Behavioral task
behavioral1
Sample
SPS8623121050508150.docx
Resource
win7v20210410
Behavioral task
behavioral2
Sample
SPS8623121050508150.docx
Resource
win10v20210408
Malware Config
Extracted
https://stepup.pt/sugar6/ww/se.dot
Targets
-
-
Target
SPS8623121050508150.docx
-
Size
10KB
-
MD5
a9afdac1e8cbe1f1c65bc0794b38b4a1
-
SHA1
7fc460104106e798537c2b8ddfbf1c21192eca78
-
SHA256
82a250d066480fbade78fb2498bfd6cd26a5487705e82a2cc16c6b34627cdfb4
-
SHA512
fd5247de795705aae434a20d9f63a746e6d62a4b92a39ce4cc74936587704bbace17d51ddd15663f880186f9e76981f9150b577a5f2b8a3d29b34e3f40975393
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
StormKitty Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Abuses OpenXML format to download file from external location
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-