General
-
Target
62693b6b06025484f7f9ef6c5639c942a879fbd49e87983c83541106f3566ad2
-
Size
83KB
-
Sample
220115-bp95wsbgc3
-
MD5
a5d6144a863e7ac8f56b2b6c88516eb2
-
SHA1
882cdbecc31ba88b223e54b15ca332221a6b58e5
-
SHA256
62693b6b06025484f7f9ef6c5639c942a879fbd49e87983c83541106f3566ad2
-
SHA512
c0dfe8c519d4acf1289f3f3bdf8612d7a879bc380fd7c22f32d5341ffe9e1f113fecd7823dfdbf8b813b7c5826dfa68c009cab2a72fa15ab6ce80a198d07f795
Behavioral task
behavioral1
Sample
62693b6b06025484f7f9ef6c5639c942a879fbd49e87983c83541106f3566ad2.xlsm
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
62693b6b06025484f7f9ef6c5639c942a879fbd49e87983c83541106f3566ad2.xlsm
Resource
win10-en-20211208
Malware Config
Extracted
http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/
https://wordpress.baishuweb.com/wp-includes/10q0ice6/
http://monorailegypt.com/wp-admin/6uBf9CCfZRMh/
Extracted
http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/
Targets
-
-
Target
62693b6b06025484f7f9ef6c5639c942a879fbd49e87983c83541106f3566ad2
-
Size
83KB
-
MD5
a5d6144a863e7ac8f56b2b6c88516eb2
-
SHA1
882cdbecc31ba88b223e54b15ca332221a6b58e5
-
SHA256
62693b6b06025484f7f9ef6c5639c942a879fbd49e87983c83541106f3566ad2
-
SHA512
c0dfe8c519d4acf1289f3f3bdf8612d7a879bc380fd7c22f32d5341ffe9e1f113fecd7823dfdbf8b813b7c5826dfa68c009cab2a72fa15ab6ce80a198d07f795
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Drops file in System32 directory
-