Overview

overview

10

Static

static

recital-12...46.xls

windows7_x64

10

recital-12...46.xls

windows10_x64

10

Resubmissions

29-09-2021 11:34

210929-npjzxsegd8 10

29-09-2021 11:21

210929-nf5j9sehdj 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    whatever.zip

  • Size

    193KB

  • Sample

    210929-nf5j9sehdj

  • MD5

    0fcc679ab6e866ef8a83eead78573dae

  • SHA1

    fa852f5739cf764984787decec49a8962adcfd31

  • SHA256

    9a163f08baa5283bf4b87e4a1d7eb2b83c5780ec7767a6af1359042138f63aaf

  • SHA512

    2190391be62c593020639e2c3c479aa45d624d4117edd51ca64d0de4c000d3cf920b12d75ff96f376e5f6d0edb949e9e76b8e202f3dbb1d3d05b8563509bb5cc

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://gillcart.com/Cdpmoyhr/key.xml
xlm40.dropper

https://geit.in/MeOlE9Xxd/key.xml
xlm40.dropper

https://mercanets.com/9DPZqAfZdq5z/key.xml

Targets

    • Target

      recital-1267320846.xls

    • Size

      244KB

    • MD5

      fa6369788a5f5490d4c506e65b82a166

    • SHA1

      f12d615a708cd6e83c669e3a16c1bebbf2510718

    • SHA256

      3f3f21189390158abe6d01848ce995c762f3b0e908ea27192778effb160a6014

    • SHA512

      a0cf692797d8a9c232de08f15fe251380cdeb54835f5025a5605782d5a55fe4975a0d3fc2174093350b7d533a55ac2bbbea7dbf443a3389abf8c559c1e0f63e9

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks