Overview

overview

10

Static

static

8

?i=1fgkbemie.xls

windows7_x64

10

?i=1fgkbemie.xls

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ?i=1fgkbemie
  • Size 113KB
  • Sample220512-tybykafbal
  • SHA256 aa65a34067b0c50e89c1078d0c7ff08de43e5036241404574f846265de6ff6bd
  • MD5 SHA1 SHA512
Score
10/10
macroxlm

Malware Config

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    http://ordinateur.ogivart.us/editor/Qpo7OAOnbe/

Extracted

Language

  • xlm4.0

Source
URLs
  • xlm40.dropper

    http://ordinateur.ogivart.us/editor/Qpo7OAOnbe/
  • xlm40.dropper

    http://old.liceum9.ru/images/0/
  • xlm40.dropper

    http://ostadsarma.com/wp-admin/pYk64Hh3z5hjnMziZ/

Targets

    • Target
      ?i=1fgkbemie
    • Size 113KB
    • SHA256 aa65a34067b0c50e89c1078d0c7ff08de43e5036241404574f846265de6ff6bd
    • MD5 SHA1 SHA512
    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks