Overview

overview

10

Static

static

8

36790b80dd...cc.xls

windows7-x64

10

36790b80dd...cc.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36790b80dd1d66296f5c29898a90fe772f897641cbe15fc55f38bea96daf1bcc

  • Size

    91KB

  • Sample

    241120-e7h1xa1bke

  • MD5

    5c88a2ce0bd19e18be4d2fca5a8636dd

  • SHA1

    238ffe7741bd1c8f4584f2020746501fdaa0336d

  • SHA256

    36790b80dd1d66296f5c29898a90fe772f897641cbe15fc55f38bea96daf1bcc

  • SHA512

    efb10359db00b3c819265e32082f16bf675abf4d01e706aaad4da1d267752c7c5a31650913a48bd10814227af9b5ff4be5c1d0935cab3b270f868378060d7f03

  • SSDEEP

    1536:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgCbCXuZH4gb4CEn9J4ZmL5:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgF

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://helpeve.com/wp-admin/sOdeuF1c4DV2h/
xlm40.dropper

http://christplanet.com/wp-admin/maint/mtlsi/TxsAE7TAAb/
xlm40.dropper

http://www.chawkyfrenn.com/icon/LRWYSefRL7/
xlm40.dropper

http://chist.com/dir-/N5zALqqTmf/

Targets

    • Target

      36790b80dd1d66296f5c29898a90fe772f897641cbe15fc55f38bea96daf1bcc

    • Size

      91KB

    • MD5

      5c88a2ce0bd19e18be4d2fca5a8636dd

    • SHA1

      238ffe7741bd1c8f4584f2020746501fdaa0336d

    • SHA256

      36790b80dd1d66296f5c29898a90fe772f897641cbe15fc55f38bea96daf1bcc

    • SHA512

      efb10359db00b3c819265e32082f16bf675abf4d01e706aaad4da1d267752c7c5a31650913a48bd10814227af9b5ff4be5c1d0935cab3b270f868378060d7f03

    • SSDEEP

      1536:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgCbCXuZH4gb4CEn9J4ZmL5:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgF

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks