Overview

overview

10

Static

static

8

18111bb5b0...e2.xls

windows7-x64

10

18111bb5b0...e2.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18111bb5b0349953fba7a685b82b1e8e37ba15a81f32c1cddf5e7152ed94efe2

  • Size

    60KB

  • Sample

    241120-mwn2sawjc1

  • MD5

    14e3c7df61c1f715cc4e43645869ad80

  • SHA1

    aa4beac6efeb0a52765ba7f2101188be5359a678

  • SHA256

    18111bb5b0349953fba7a685b82b1e8e37ba15a81f32c1cddf5e7152ed94efe2

  • SHA512

    8f7d33481617f615226a1513599d326c19eba33a25d67332255223b6f18914b5eeaaa465228643d31bc292bc8a83ce3ce8d964b24b30344bdc141b6e813a34a4

  • SSDEEP

    1536:NpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgUDOJiA6Cv/UGLI36yOAR5N:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgQ

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://www.valyval.com/pun/VAYL/
xlm40.dropper

http://cabans.com/CeudWYRQEzZgrHPcI/
xlm40.dropper

http://calzadoyuyin.com/cgj-bin/jZPff/
xlm40.dropper

http://cagranus.com/slide/mcqAFuMhaekn/

Targets

    • Target

      18111bb5b0349953fba7a685b82b1e8e37ba15a81f32c1cddf5e7152ed94efe2

    • Size

      60KB

    • MD5

      14e3c7df61c1f715cc4e43645869ad80

    • SHA1

      aa4beac6efeb0a52765ba7f2101188be5359a678

    • SHA256

      18111bb5b0349953fba7a685b82b1e8e37ba15a81f32c1cddf5e7152ed94efe2

    • SHA512

      8f7d33481617f615226a1513599d326c19eba33a25d67332255223b6f18914b5eeaaa465228643d31bc292bc8a83ce3ce8d964b24b30344bdc141b6e813a34a4

    • SSDEEP

      1536:NpKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgUDOJiA6Cv/UGLI36yOAR5N:rKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgQ

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks