Overview

overview

10

Static

static

tmpahe342sy.xls

windows7_x64

10

tmpahe342sy.xls

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    tmpahe342sy
  • Size 144KB
  • Sample220125-te4jgaaddn
  • SHA256 eaacbf5824487ddc63b5b58f4e802bf6d3ca43b403bb13b8bb0c28d9340e56ed
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://philiatek.com/wp-content/i6xZ9PESl4QAWL9O/
  • exe.dropper

    http://diademfinancial.com/oxly7sr/IfH/
  • exe.dropper

    http://khustle.com/cgi-bin/jz381CkM5gYgMH/
  • exe.dropper

    http://newalthyplane.com.althyplane.com/dmcbg7s/X4bbl6/
  • exe.dropper

    http://nostringsattachedrelationship.net/wp-content/xDuD8qnc/
  • exe.dropper

    https://acorngift.com/wp-content/YhNgI/
  • exe.dropper

    http://russian-coins.info/libraries/8oDzr/
  • exe.dropper

    http://daisy.sukoburu-secure.com/assets/qrwbWpSM/
  • exe.dropper

    http://ppdbsmp.insanrabbany.sch.id/assets/eofgaHjWVR9o/
  • exe.dropper

    http://harmonylifecare.vogomo.com/m113gvw/bsKtRYvTM/

Targets

    • Target
      tmpahe342sy
    • Size 144KB
    • SHA256 eaacbf5824487ddc63b5b58f4e802bf6d3ca43b403bb13b8bb0c28d9340e56ed
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks