Overview

overview

10

Static

static

8

e0ca8c2fa1...1f.xls

windows7-x64

10

e0ca8c2fa1...1f.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0ca8c2fa19a0a8f7ab7f69ee18fce0f196c662f4bb810950cb5d4150e6a571f

  • Size

    94KB

  • Sample

    241120-1wbckstrbs

  • MD5

    0c740931177e11a60872cd4923bc38c5

  • SHA1

    b23e21af7e824e4e302090c3c461cc847cf9dbe8

  • SHA256

    e0ca8c2fa19a0a8f7ab7f69ee18fce0f196c662f4bb810950cb5d4150e6a571f

  • SHA512

    71c69a5707762b7bae48cf059c11b40c5028717a9d5e9bc173bd3ef82d6dc0def8c8782f0bae093ffe89efd6ef4f6fccf1088aa92b02ac1896b03d3694dc4bc1

  • SSDEEP

    1536:nFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgiHuS4hcTO97v7UYdEJmFCy:FKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgz

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://ewingconsulting.com/wp-includes/1sqrshC/
xlm40.dropper

http://www.llev.com.br/app/W2ehSSGWXTBpOf/
xlm40.dropper

http://digital21.cl/genchile/Pp1LDfwHR0IJPWHpq3R/
xlm40.dropper

http://nellydwiputri.co.id/images/lZfuoNe2vyr/

Targets

    • Target

      e0ca8c2fa19a0a8f7ab7f69ee18fce0f196c662f4bb810950cb5d4150e6a571f

    • Size

      94KB

    • MD5

      0c740931177e11a60872cd4923bc38c5

    • SHA1

      b23e21af7e824e4e302090c3c461cc847cf9dbe8

    • SHA256

      e0ca8c2fa19a0a8f7ab7f69ee18fce0f196c662f4bb810950cb5d4150e6a571f

    • SHA512

      71c69a5707762b7bae48cf059c11b40c5028717a9d5e9bc173bd3ef82d6dc0def8c8782f0bae093ffe89efd6ef4f6fccf1088aa92b02ac1896b03d3694dc4bc1

    • SSDEEP

      1536:nFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgiHuS4hcTO97v7UYdEJmFCy:FKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgz

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks