General

  • Target

    cf7c452c80ad1a90af51fb9584698d3cbd9455c1bb73bd38a982d5494edcae39

  • Size

    38KB

  • Sample

    241120-p3cnfaxkcw

  • MD5

    41852eea3bfe89ce1c7880818fa22ed1

  • SHA1

    57869d5281520420102361ab644feb0f25ceab70

  • SHA256

    cf7c452c80ad1a90af51fb9584698d3cbd9455c1bb73bd38a982d5494edcae39

  • SHA512

    17317d54b62b9f6afc31c910c8606ef88be16911699534a87323db23c3da039d0867b8bde4bac34ae4d4ca8486fd569a710f97b8d0d6bba687619a9758ef344f

  • SSDEEP

    768:RFWrwUNfWNkR5tKBDQovX+d3CTUqzEs2GiQvR2SID5Irae8abnaRSXRDPYFX5:RFWrwUcNotKyovXIktojGi+g563BEJ

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://f5ajans.com/merthel/vvWRK/KVVGB6o7SPoorfaI/

xlm40.dropper

http://emett.com/images/kk2l4zoRKwv2vIEK/

xlm40.dropper

https://www.duinrand-s.nl/Nieuws/S9Y8DumfrBU1r5unO/

xlm40.dropper

http://galileuconcursos.com.br/wp-admin/Pt8VGg/

Targets

    • Target

      Outstanding INVOICE DTQC-158641-173 04-07-2022_1402.xls

    • Size

      95KB

    • MD5

      fda9b005a725d9f698e24b16c3b0eb2a

    • SHA1

      a3bbffdd39f23b08035496f8d394354384e2397f

    • SHA256

      6fc29cee6754fe79ad16a2d1df7eccd43798c9a1bf4dad634cbd7697700c154e

    • SHA512

      169d4198776efb06b740f99d113825e446b522cb720d728029a8c1eb7594c7cdb6a30c645359ac9ac5579711870cde845c0e5b002c21c67a5bca2e3bae104703

    • SSDEEP

      1536:iFKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg0yHuS4hcTO97v7UYdEJmA/:cKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgH

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

MITRE ATT&CK Enterprise v15

Tasks