General
-
Target
3546e6340fcda875ab6bc3d3bcaf0c463e329618f1dce984832352694f6c10a8
-
Size
121KB
-
Sample
220520-1va1eshebq
-
MD5
f4b7643b9f08470d7918bcd7b22eb2d3
-
SHA1
c0d1d40e7adb0652964607fcc02c24e9a80155df
-
SHA256
3546e6340fcda875ab6bc3d3bcaf0c463e329618f1dce984832352694f6c10a8
-
SHA512
6a7a5e7c0b74b66904c51406a550282148770842e85cbabf9defaeface05c4d83c56c9404dc3b887deb06d9b6743c7b6f2d3efa26b2ccea1c15974ca5b480215
Static task
static1
Behavioral task
behavioral1
Sample
sample.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
sample.doc
Resource
win10v2004-20220414-en
Malware Config
Extracted
http://casaroomz.com/wp-includes/rPG/
http://necibekulac.com/wp-content/dTl4ul/
https://www.homeonetechnologies.com/blog/dcy/
http://todoparaelconfort.com/cgi-bin/wp/
http://aadarshitibhusawal.org/wp-includes/amI/
http://digiarmedia.com/wp-admin/8/
http://avcumda.com/huseyingulgec.com.tr/cO1DS8G/
Targets
-
-
Target
sample
-
Size
231KB
-
MD5
a4d8c5b0c24acf8720a677df680b2008
-
SHA1
790a4f11c8ba16ef6bbba50ddd369c79ae3eeee3
-
SHA256
5fd8fc414f220b6e97d691571980b241fd048568374890695dfcb9df97a6845c
-
SHA512
3280fa9b6021a0684f53b2d4450af2ef859c09b8f5a5d802e5b26f74b1c57f4814914f2054ea902d5b71c6dfa1531ce7e9499df24a87219e3796d2dd54b5bdda
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Drops file in System32 directory
-