Overview

overview

10

Static

static

3

iroto.dll

windows7-x64

1

iroto.dll

windows10-2004-x64

3

iroto1.dll

windows7-x64

1

iroto1.dll

windows10-2004-x64

3

research-1...71.xls

windows7-x64

10

research-1...71.xls

windows10-2004-x64

10

Resubmissions

29-01-2024 04:39

240129-e973taabe9 10

29-01-2024 02:55

240129-dew7dshgep 10

29-01-2024 01:55

240129-ccg41sfdf2 10

29-01-2024 01:50

240129-b9jhnsgham 3

29-01-2024 01:26

240129-bts26sfaa4 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    excel40macroschallenge.zip

  • Size

    103KB

  • Sample

    240129-bts26sfaa4

  • MD5

    542ead021ed9ecab2f5b6ff0edaf2f74

  • SHA1

    f1a509cb6dc15534a0b7ee29486789557a434941

  • SHA256

    024ef55d8112d913021e2f8e38294052c40d177062afebc1b462f396c86c297b

  • SHA512

    d2e1514a891db86ec6275ffcb6f44503cedf9e4560d200eeefc3fe047e08c7769de1892b92ee71fe4663720652eb509a55c29e24e82d6deb8dbe5a741cd9cb95

  • SSDEEP

    1536:r6diRoyzKi0WAx5elOHwxvhuQcLE6/Q59VGqITfVuy03FD+/mUtzBxr:xutnmOQxvqEPHVZILVK1D+eUtX

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://nws.visionconsulting.ro/N1G1KCXA/dot.html
xlm40.dropper

https://royalpalm.sparkblue.lk/vCNhYrq3Yg8/dot.html

Targets

    • Target

      iroto.dll

    • Size

      434KB

    • MD5

      e03bde4862d4d93ac2ceed85abf50b18

    • SHA1

      7d7c288a8cf7d4e5f64d616da699712b82760303

    • SHA256

      055b9e9af987aec9ba7adb0eef947f39b516a213d663cc52a71c7f0af146a946

    • SHA512

      12e8ef09745a562567dc3d18e3be72dac09120e7756d47d23a605a82499b1ed8ff471578f0f85a35685de13c93f1ad0834a89dce5d136527f731b5e170a520f1

    • SSDEEP

      12:e9GSG2CTi/FfILQAu//6lgR0FWdzQ2VCARHUwOLe7EEe:e9GSnCTi9ALsQiQ296LG

    Score
    3/10
    behavioral1behavioral2

    • Target

      iroto1.dll

    • Size

      434KB

    • MD5

      8e6fbefcbac2a1967941fa692c82c3ca

    • SHA1

      242a7803adb19f638ef62077f1b76756f3a13a0d

    • SHA256

      e05c717b43f7e204f315eb8c298f9715791385516335acd8f20ec9e26c3e9b0b

    • SHA512

      bc6dc64fa5bc19f234e3df27f718a50f82f6f086da2cd761d81edda4cf9355b40115279ebc368a0f55cf651405e34988336f9f5c3577ce7a7433971194a7b179

    • SSDEEP

      12:e9GSG2CTi/FfILQAu//6lgR0FWdzQ2VCARHUwOLe7EEe:e9GSnCTi9ALsQiQ296LG

    Score
    3/10
    behavioral3behavioral4

    • Target

      research-1646684671.xls

    • Size

      648KB

    • MD5

      927005139a0be61efe849c715d875dd2

    • SHA1

      0f6a91916941d85b69e5320873a5d1c45055bc4e

    • SHA256

      b23491ede17f9a5b7d6ad27d3051a2224c214a5afa2139e5147bd26319577f85

    • SHA512

      30f40d913815f43395186b0957413e9f3f8999af97b3192372a4da86c6b5b32e3abd8adadb9623417521b57cff4e323d85d72e0e31c6be901b0926a0350c9b3e

    • SSDEEP

      6144:Hknl9oBdySAx76F6XeyTVtW/9Ny9ABnl5/PBgxOHjuM9Mq:jl5/WxIjL

    Score
    10/10

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks