Overview

overview

10

Static

static

8

0ccfe68cc3...6b.xls

windows7-x64

10

0ccfe68cc3...6b.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0ccfe68cc329f6d6bb239baa2b7ba8d8d942733e24e27899f7387e6751bf9f6b

  • Size

    95KB

  • Sample

    241120-p9plksxkhw

  • MD5

    1a15d1e5ef70617b664a12371f939e1e

  • SHA1

    0d38458258519cc5214f48a7621e073986e5eaeb

  • SHA256

    0ccfe68cc329f6d6bb239baa2b7ba8d8d942733e24e27899f7387e6751bf9f6b

  • SHA512

    8ee7842e6208e2dbf8068222665b6b96a1d705c122d4f223fc12fcce306dde74a1b247a744a14beecbfae03191f6d5614b575d20d1b55e4880bba52741e455cb

  • SSDEEP

    1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4HuS4hcTO97v7UYdEJmA:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgO

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://cointrade.world/receipts/0LjXVwpQrhw/
xlm40.dropper

http://www.garantihaliyikama.com/wp-admin/jp64lssPHEe2ii/
xlm40.dropper

http://haircutbar.com/cgi-bin/BC3WAQ8zJY4ALXA4/
xlm40.dropper

http://airhobi.com/system/WLvH1ygkOYQO/

Targets

    • Target

      0ccfe68cc329f6d6bb239baa2b7ba8d8d942733e24e27899f7387e6751bf9f6b

    • Size

      95KB

    • MD5

      1a15d1e5ef70617b664a12371f939e1e

    • SHA1

      0d38458258519cc5214f48a7621e073986e5eaeb

    • SHA256

      0ccfe68cc329f6d6bb239baa2b7ba8d8d942733e24e27899f7387e6751bf9f6b

    • SHA512

      8ee7842e6208e2dbf8068222665b6b96a1d705c122d4f223fc12fcce306dde74a1b247a744a14beecbfae03191f6d5614b575d20d1b55e4880bba52741e455cb

    • SSDEEP

      1536:UkKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg4HuS4hcTO97v7UYdEJmA:bKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgO

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks