General
-
Target
CSOIYQRONAGPE1.xlsm
-
Size
102KB
-
Sample
211125-veh37sfhan
-
MD5
cc1439b54aa4b3db324fb921b94870ef
-
SHA1
33a4c8af524b8e37f290000c654d897b440fd86c
-
SHA256
95b3882e2ba6d5f35be8c35aa3d047e41ec110eb7f8aa69af7652f1cc29a6fb7
-
SHA512
a9fb3881f480ca8dd86bb707b8216b596f4a848e25c797c15fb6c57b517beafe1fb2ddeb2d56321faf17e049bae4147582fd4052e7e1153962c0f7a6085fd4dc
Static task
static1
Behavioral task
behavioral1
Sample
CSOIYQRONAGPE1.xlsm
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
CSOIYQRONAGPE1.xlsm
Resource
win10-en-20211014
Malware Config
Extracted
http://18.192.215.191/team/z/CSOIYQRONAGPE1.exe
Targets
-
-
Target
CSOIYQRONAGPE1.xlsm
-
Size
102KB
-
MD5
cc1439b54aa4b3db324fb921b94870ef
-
SHA1
33a4c8af524b8e37f290000c654d897b440fd86c
-
SHA256
95b3882e2ba6d5f35be8c35aa3d047e41ec110eb7f8aa69af7652f1cc29a6fb7
-
SHA512
a9fb3881f480ca8dd86bb707b8216b596f4a848e25c797c15fb6c57b517beafe1fb2ddeb2d56321faf17e049bae4147582fd4052e7e1153962c0f7a6085fd4dc
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-