c33a0e5a3f9dbda26be1308945f8d41dea6bbbb6c612d32ebbd1ea5402370dc4 | Triage

Sharing

General

Target

c33a0e5a3f9dbda26be1308945f8d41dea6bbbb6c612d32ebbd1ea5402370dc4
Size

96KB
Sample

241120-s8stdstlfr
MD5

709b8e27028e51d6b4dc9df496bbca15
SHA1

c124723c34dac8c048cb44e19938143b514a5835
SHA256

c33a0e5a3f9dbda26be1308945f8d41dea6bbbb6c612d32ebbd1ea5402370dc4
SHA512

04722019c0f1a40ad6e9ee7ba5912bb5c86bb44877c338a4bf99f35b2a45136b084c9ffdabcb0266997c0c200b7145a9b66d08fe23c45116e953057f29e3804c
SSDEEP

1536:7kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2HuS4hcTO97v7UYdEJmE:IKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgA

Score

10^/10

discovery macro xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://atperson.com/campusvirtual/EOgFGo17w/

xlm40.dropper

https://eliteturismo.com/phpmailer-old/dafdBxQONtk5Uf9dxll/

xlm40.dropper

http://atici.net/c/JDFDBMIz/

xlm40.dropper

http://domesticuif.co.za/libraries/nbnH9dpd/

Targets

- Target
  
  c33a0e5a3f9dbda26be1308945f8d41dea6bbbb6c612d32ebbd1ea5402370dc4
- Size
  
  96KB
- MD5
  
  709b8e27028e51d6b4dc9df496bbca15
- SHA1
  
  c124723c34dac8c048cb44e19938143b514a5835
- SHA256
  
  c33a0e5a3f9dbda26be1308945f8d41dea6bbbb6c612d32ebbd1ea5402370dc4
- SHA512
  
  04722019c0f1a40ad6e9ee7ba5912bb5c86bb44877c338a4bf99f35b2a45136b084c9ffdabcb0266997c0c200b7145a9b66d08fe23c45116e953057f29e3804c
- SSDEEP
  
  1536:7kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg2HuS4hcTO97v7UYdEJmE:IKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgA
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2