de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386

General
Target

de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386

Size

83KB

Sample

220115-brtwpabgc8

Score
10 /10
MD5

6b5fbfc62c3f736a188c3f614b14fbe3

SHA1

1ce7dd32aecf09f3b4683f9c3c005d0c6ae82b0a

SHA256

de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386

SHA512

ff04fc0017f3a39f777a8671fd030b210d8b99cb30202acc3cc0b0fee8e48f5f12c4b730576a2adfa43955c03e4a2a0e66e954cc8bacfa20963479010717e516

Malware Config

Extracted

Language xlm4.0
Source
URLs
xlm40.dropper

http://recont.com/n8xbqb/lwEORjcJYPKCNQ/

 xlm40.dropper

http://dichnghiatienganh.com/jvmqawn/2mdbSTjM1Lg/

 xlm40.dropper

https://www.moharrampartners.com/requestion/wiA/

Extracted

Language xlm4.0
Source
URLs
xlm40.dropper

http://recont.com/n8xbqb/lwEORjcJYPKCNQ/
Targets
Target

de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386

MD5

6b5fbfc62c3f736a188c3f614b14fbe3

Filesize

83KB

Score
10/10
SHA1

1ce7dd32aecf09f3b4683f9c3c005d0c6ae82b0a

SHA256

de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386

SHA512

ff04fc0017f3a39f777a8671fd030b210d8b99cb30202acc3cc0b0fee8e48f5f12c4b730576a2adfa43955c03e4a2a0e66e954cc8bacfa20963479010717e516

Signatures

  • Process spawned unexpected child process

    Description

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Drops file in System32 directory

Related Tasks

behavioral1behavioral2
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Tasks

                        static1

                        8/10

                        behavioral1

                        10/10

                        behavioral2

                        10/10