Overview

overview

10

Static

static

8

TXN.xls

windows7_x64

10

TXN.xls

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TXN.xls

  • Size

    138KB

  • Sample

    211022-wad45acghm

  • MD5

    c45ef81e3c2f06ee9e6eec6615c8af22

  • SHA1

    71ee9c48825816f1664cb923f606b4cc0a1f8cc2

  • SHA256

    7841313327d7e973e4edfb59245d7a403a5d7f59174f83f37fb139d537bdbf17

  • SHA512

    c50673b5dc2c1651aaac48ceb803ef99816195a0c1256b57a33bcb8338ac102d85cd32171331a8dd0304d52a3d86479a335906ec604dc27b37c7caa094e11af2

Score
10/10
macromacro_on_action

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://190.14.37.226/44491.8190982639.dat
xlm40.dropper

http://5.149.248.24/44491.8190982639.dat
xlm40.dropper

http://176.31.87.211/44491.8190982639.dat

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://190.14.37.226/44485.9802664352.dat
xlm40.dropper

http://5.149.248.24/44485.9802664352.dat
xlm40.dropper

http://176.31.87.211/44485.9802664352.dat

Targets

    • Target

      TXN.xls

    • Size

      138KB

    • MD5

      c45ef81e3c2f06ee9e6eec6615c8af22

    • SHA1

      71ee9c48825816f1664cb923f606b4cc0a1f8cc2

    • SHA256

      7841313327d7e973e4edfb59245d7a403a5d7f59174f83f37fb139d537bdbf17

    • SHA512

      c50673b5dc2c1651aaac48ceb803ef99816195a0c1256b57a33bcb8338ac102d85cd32171331a8dd0304d52a3d86479a335906ec604dc27b37c7caa094e11af2

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks