24cff46b3f8ca1ece34b0821c6e406ada62b4c739a937674ec4699d4fe751c76 | Triage

Sharing

General

Target

24cff46b3f8ca1ece34b0821c6e406ada62b4c739a937674ec4699d4fe751c76
Size

77KB
Sample

241120-rss9jsydlq
MD5

2b04cbe50b4f3fa5e47f777888a45d1b
SHA1

58b2a8464b8f76eae893778334757f2fd3439395
SHA256

24cff46b3f8ca1ece34b0821c6e406ada62b4c739a937674ec4699d4fe751c76
SHA512

6e187417a39ce12e08a78b25dc977d1df7a28732057136521150c3b1e394a1a42483868b7e3e7c00792dbaa8f2c767720adf50f3aab5116484d85a378cf8a9b4
SSDEEP

1536:ASKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgew+hD8nTLqQrRrZws8Eau:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5

Score

10^/10

discovery macro xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://natdemo.natrixsoftware.com/wp-admin/QyqiN/

xlm40.dropper

http://luisangeja.com/COPYRIGHT/BJljffG6/

xlm40.dropper

http://nerz.net/stats/KVIyooM/

Targets

- Target
  
  24cff46b3f8ca1ece34b0821c6e406ada62b4c739a937674ec4699d4fe751c76
- Size
  
  77KB
- MD5
  
  2b04cbe50b4f3fa5e47f777888a45d1b
- SHA1
  
  58b2a8464b8f76eae893778334757f2fd3439395
- SHA256
  
  24cff46b3f8ca1ece34b0821c6e406ada62b4c739a937674ec4699d4fe751c76
- SHA512
  
  6e187417a39ce12e08a78b25dc977d1df7a28732057136521150c3b1e394a1a42483868b7e3e7c00792dbaa8f2c767720adf50f3aab5116484d85a378cf8a9b4
- SSDEEP
  
  1536:ASKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgew+hD8nTLqQrRrZws8Eau:LKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg5
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2