Overview

overview

10

Static

static

1cam.doc

windows7_x64

10

1cam.doc

windows10_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    1cam.doc
  • Size 501KB
  • Sample211207-p4mvsshcem
  • SHA256 0fef64eab9583e653f02f7fc28af21b9cc14265f8a6bbae518e2325d417994cd
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://91.92.109.142/roben.png
  • exe.dropper

    http://192.99.255.33/images/roben.png
  • exe.dropper

    http://185.183.98.15/roben.png
  • exe.dropper

    http://83.138.53.103/images/roben.png
  • exe.dropper

    http://172.96.189.216/images/roben.png

Targets

    • Target
      1cam.doc
    • Size 501KB
    • SHA256 0fef64eab9583e653f02f7fc28af21b9cc14265f8a6bbae518e2325d417994cd
    • MD5 SHA1 SHA512
    Score
    10/10

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks