Overview

overview

10

Static

static

8

b19a4ec73e...b6.xls

windows7-x64

10

b19a4ec73e...b6.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b19a4ec73e374b0421fcdd7696627d06b4aee40e2d97bf52efbac119d9495bb6

  • Size

    95KB

  • Sample

    241120-1lstwavcpj

  • MD5

    ce5192e9eeffe14da3030106d61ff4de

  • SHA1

    90033ab3aa5cfe11d82180f92f513d5cb20ba212

  • SHA256

    b19a4ec73e374b0421fcdd7696627d06b4aee40e2d97bf52efbac119d9495bb6

  • SHA512

    54d31d3e5fa683178f87474cf7bb62f841b79a1f587327f5cd53c0184210a0fcc04cd44df108dd6c68b066380935d6c8c438d8913e0134cb8f383ee44aacf0c5

  • SSDEEP

    1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgcHuS4hcTO97v7UYdEJm0t:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgE

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://dazzlecollections.co.za/THDXpHbk3YwA/HTolLw1ams3x/
xlm40.dropper

http://www.daxberger.at/stats/NfxCfPkIhjZqEvLMN2Ul/
xlm40.dropper

http://k-s-j.jp/contact/r3a9keM/
xlm40.dropper

http://kentandcowines.com.au/wp-content/nkz1FRU9Y5i/L/

Targets

    • Target

      b19a4ec73e374b0421fcdd7696627d06b4aee40e2d97bf52efbac119d9495bb6

    • Size

      95KB

    • MD5

      ce5192e9eeffe14da3030106d61ff4de

    • SHA1

      90033ab3aa5cfe11d82180f92f513d5cb20ba212

    • SHA256

      b19a4ec73e374b0421fcdd7696627d06b4aee40e2d97bf52efbac119d9495bb6

    • SHA512

      54d31d3e5fa683178f87474cf7bb62f841b79a1f587327f5cd53c0184210a0fcc04cd44df108dd6c68b066380935d6c8c438d8913e0134cb8f383ee44aacf0c5

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgcHuS4hcTO97v7UYdEJm0t:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgE

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks