Resubmissions
24-11-2021 17:59
211124-wk8rgsddbm 1022-11-2021 14:46
211122-r5n6csagd6 1022-11-2021 14:46
211122-r5csbsfgdp 1022-11-2021 14:44
211122-r4kfsafgdn 1022-11-2021 14:41
211122-r2x9vsfgcq 1022-11-2021 14:20
211122-rneklaffgr 1022-11-2021 14:15
211122-rkk8zaffgl 1017-11-2021 06:51
211117-hm1l1aeefm 1017-11-2021 06:37
211117-hdnk3seedn 10General
-
Target
865663204559_17_Nov_2021.xlsm
-
Size
44KB
-
Sample
211124-wk8rgsddbm
-
MD5
477fd718bb764ffe3c5afde16c6c8dd2
-
SHA1
eb932e19d95f88d64270d40cdc0b92c6d1cf63be
-
SHA256
ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3
-
SHA512
f7d0451ca3670179cc93a680b99f8982204c43054c55eb479c38dc8ea0ba6ba5b6ebea4508569091c07d95a759841455605e6daeab445146b29fc1af377ba267
Static task
static1
Behavioral task
behavioral1
Sample
865663204559_17_Nov_2021.xlsm
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
865663204559_17_Nov_2021.xlsm
Resource
win10-en-20211104
Malware Config
Extracted
https://evgeniys.ru/sap-logs/D6/
http://crownadvertising.ca/wp-includes/OxiAACCoic/
https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/
http://immoinvest.com.br/blog_old/wp-admin/luoT/
https://yoho.love/wp-content/e4laFBDXIvYT6O/
https://www.168801.xyz/wp-content/6J3CV4meLxvZP/
https://www.pasionportufuturo.pe/wp-content/XUBS/
Targets
-
-
Target
865663204559_17_Nov_2021.xlsm
-
Size
44KB
-
MD5
477fd718bb764ffe3c5afde16c6c8dd2
-
SHA1
eb932e19d95f88d64270d40cdc0b92c6d1cf63be
-
SHA256
ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3
-
SHA512
f7d0451ca3670179cc93a680b99f8982204c43054c55eb479c38dc8ea0ba6ba5b6ebea4508569091c07d95a759841455605e6daeab445146b29fc1af377ba267
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-