Overview

overview

10

Static

static

8

df8163211c...65.xls

windows7-x64

10

df8163211c...65.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    df8163211cd4768626393f3d28d44cb00475ae3f48ea03a4ed02fd5857ca7065

  • Size

    46KB

  • Sample

    241119-wj5cnsyhkg

  • MD5

    65179433a51e8629c43875b47944475f

  • SHA1

    792aca77182558d5e5c8f5a54bd14b2871afa842

  • SHA256

    df8163211cd4768626393f3d28d44cb00475ae3f48ea03a4ed02fd5857ca7065

  • SHA512

    c9ae7801651d8fe52421530665f3842e209adfa0b743a0102495f7ebaf74cc8b5c312ccdc01c458eeebc12179bfd4b0b910965b4f92c11254085b34e7d131d07

  • SSDEEP

    768:pDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VQTUs77quK7KtGu6Q:pYKpb8rGYrMPe3q7Q0XV5xtezE8vG8U2

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://zktecovn.com/wp-admin/xxfnYY4zwOpFOgu3g1t/
xlm40.dropper

http://zacharywythe.com/pb_index_bak/SkEGB2c/
xlm40.dropper

http://zonainformatica.es/aspnet_client/pVcppgi00Dk/

Targets

    • Target

      df8163211cd4768626393f3d28d44cb00475ae3f48ea03a4ed02fd5857ca7065

    • Size

      46KB

    • MD5

      65179433a51e8629c43875b47944475f

    • SHA1

      792aca77182558d5e5c8f5a54bd14b2871afa842

    • SHA256

      df8163211cd4768626393f3d28d44cb00475ae3f48ea03a4ed02fd5857ca7065

    • SHA512

      c9ae7801651d8fe52421530665f3842e209adfa0b743a0102495f7ebaf74cc8b5c312ccdc01c458eeebc12179bfd4b0b910965b4f92c11254085b34e7d131d07

    • SSDEEP

      768:pDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VQTUs77quK7KtGu6Q:pYKpb8rGYrMPe3q7Q0XV5xtezE8vG8U2

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks