Overview

overview

10

Static

static

8

4b1ac86cfe...4.docm

windows7_x64

10

4b1ac86cfe...4.docm

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b1ac86cfebab8327d47f884392b4b6b8d25fae64e5ba9ec700b94af1e816a04

  • Size

    448KB

  • Sample

    220520-1pqhxsebd9

  • MD5

    2e8b10ee2228eb3d3cbc92e0d12f2591

  • SHA1

    c404f2ebcc66a1d98ed95c3674af0d1fb115fb4e

  • SHA256

    4b1ac86cfebab8327d47f884392b4b6b8d25fae64e5ba9ec700b94af1e816a04

  • SHA512

    2d4114e2b1f2c05c1f5ae9069ef91fa85f7cf03e7c9867cb757edf4574f13c4ecc7d92b13e4290a875b3f21be24122e12a7b71e98e1ed8aba76197c17cc1b581

Score
10/10
macrosuricata

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://das2020.vlrlab.net/wp-content/themes/chigue/1BhcG3pS.exe
exe.dropper

http://deimos.preskubbs.com/nature-boon/wp-content/themes/chigue/1BhcG3pS.exe
exe.dropper

http://demo.martche.ca/wp-content/themes/chigue/1BhcG3pS.exe
exe.dropper

http://http//demo.wetech.digital/wp-content/themes/chigue/1BhcG3pS.exe
exe.dropper

http://demo.muzafferkadir.com/wordpress/wp-content/themes/chigue/1BhcG3pS.exe

Targets

    • Target

      4b1ac86cfebab8327d47f884392b4b6b8d25fae64e5ba9ec700b94af1e816a04

    • Size

      448KB

    • MD5

      2e8b10ee2228eb3d3cbc92e0d12f2591

    • SHA1

      c404f2ebcc66a1d98ed95c3674af0d1fb115fb4e

    • SHA256

      4b1ac86cfebab8327d47f884392b4b6b8d25fae64e5ba9ec700b94af1e816a04

    • SHA512

      2d4114e2b1f2c05c1f5ae9069ef91fa85f7cf03e7c9867cb757edf4574f13c4ecc7d92b13e4290a875b3f21be24122e12a7b71e98e1ed8aba76197c17cc1b581

    Score
    10/10
    suricata

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

      suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious

      suricata

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks