General
-
Target
de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386
-
Size
83KB
-
Sample
220115-brtwpabgc8
-
MD5
6b5fbfc62c3f736a188c3f614b14fbe3
-
SHA1
1ce7dd32aecf09f3b4683f9c3c005d0c6ae82b0a
-
SHA256
de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386
-
SHA512
ff04fc0017f3a39f777a8671fd030b210d8b99cb30202acc3cc0b0fee8e48f5f12c4b730576a2adfa43955c03e4a2a0e66e954cc8bacfa20963479010717e516
Behavioral task
behavioral1
Sample
de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386.xlsm
Resource
win10-en-20211208
Behavioral task
behavioral2
Sample
de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386.xlsm
Resource
win10-en-20211208
Malware Config
Extracted
http://recont.com/n8xbqb/lwEORjcJYPKCNQ/
http://dichnghiatienganh.com/jvmqawn/2mdbSTjM1Lg/
https://www.moharrampartners.com/requestion/wiA/
Extracted
http://recont.com/n8xbqb/lwEORjcJYPKCNQ/
Targets
-
-
Target
de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386
-
Size
83KB
-
MD5
6b5fbfc62c3f736a188c3f614b14fbe3
-
SHA1
1ce7dd32aecf09f3b4683f9c3c005d0c6ae82b0a
-
SHA256
de54a7c99135db230ba151e513f7813ccca74b08201d7592958e82c51b152386
-
SHA512
ff04fc0017f3a39f777a8671fd030b210d8b99cb30202acc3cc0b0fee8e48f5f12c4b730576a2adfa43955c03e4a2a0e66e954cc8bacfa20963479010717e516
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Drops file in System32 directory
-