8f99cab09eb9674d602d903701978b39bbe6bf9eb123a358837b44e4076a5e86

General

Target

8f99cab09eb9674d602d903701978b39bbe6bf9eb123a358837b44e4076a5e86
Size

84KB
Sample

220112-znbgyadhgn
MD5

92fcad2ae760b160b5a7d239afa4cc49
SHA1

ff853bd7c88b967f39ac30c5146070562aecdc2c
SHA256

8f99cab09eb9674d602d903701978b39bbe6bf9eb123a358837b44e4076a5e86
SHA512

da562099ce4ab8e0956312730c997ce84254b21c77ed19c0112783f3ab6f55ab1ee2a7fb3345e36bded663c6ef080b0cf281f13ed954c818136832ff03ad26ae

Score

10^/10

macro xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://insertcatherreview.xyz/wp-includes/o23k5ted/

xlm40.dropper

https://mewb.org/wp-admin/2fcpQyzanzkiO1/

xlm40.dropper

http://easybuy22.xyz/wp-includes/css/zdFH32O6JV6lk3/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://insertcatherreview.xyz/wp-includes/o23k5ted/

Targets

- Target
  
  8f99cab09eb9674d602d903701978b39bbe6bf9eb123a358837b44e4076a5e86
- Size
  
  84KB
- MD5
  
  92fcad2ae760b160b5a7d239afa4cc49
- SHA1
  
  ff853bd7c88b967f39ac30c5146070562aecdc2c
- SHA256
  
  8f99cab09eb9674d602d903701978b39bbe6bf9eb123a358837b44e4076a5e86
- SHA512
  
  da562099ce4ab8e0956312730c997ce84254b21c77ed19c0112783f3ab6f55ab1ee2a7fb3345e36bded663c6ef080b0cf281f13ed954c818136832ff03ad26ae
Score

10^/10
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Process spawned unexpected child process

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2