ff97c98d8df6b30abc71d3ee84bda58f48b330579554822adb57d058e9f0a6ec | Triage

Sharing

General

Target

ff97c98d8df6b30abc71d3ee84bda58f48b330579554822adb57d058e9f0a6ec
Size

46KB
Sample

241120-twmx2stpbr
MD5

a8114bda868bab2d3ca70b6fd78d20e3
SHA1

35b0399b61a87515d333d7ca0728eea27329757f
SHA256

ff97c98d8df6b30abc71d3ee84bda58f48b330579554822adb57d058e9f0a6ec
SHA512

2ca2f8d6bbb55ae3a456d2783c4d8bd8113aba017ae7c2669e9f7b4285051e3bcfbe8925e8dd880edec66fa6542b506a3f935fdf0128763197f9af81845314b6
SSDEEP

768:pDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VQTUs77quK7KtGu6A:pYKpb8rGYrMPe3q7Q0XV5xtezE8vG8UG

Score

10^/10

discovery macro xlm

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://zktecovn.com/wp-admin/xxfnYY4zwOpFOgu3g1t/

xlm40.dropper

http://zacharywythe.com/pb_index_bak/SkEGB2c/

xlm40.dropper

http://zonainformatica.es/aspnet_client/pVcppgi00Dk/

Targets

- Target
  
  ff97c98d8df6b30abc71d3ee84bda58f48b330579554822adb57d058e9f0a6ec
- Size
  
  46KB
- MD5
  
  a8114bda868bab2d3ca70b6fd78d20e3
- SHA1
  
  35b0399b61a87515d333d7ca0728eea27329757f
- SHA256
  
  ff97c98d8df6b30abc71d3ee84bda58f48b330579554822adb57d058e9f0a6ec
- SHA512
  
  2ca2f8d6bbb55ae3a456d2783c4d8bd8113aba017ae7c2669e9f7b4285051e3bcfbe8925e8dd880edec66fa6542b506a3f935fdf0128763197f9af81845314b6
- SSDEEP
  
  768:pDMPKpb8rGYrMPe3q7Q0XV5xtezE8vpI8UM+VQTUs77quK7KtGu6A:pYKpb8rGYrMPe3q7Q0XV5xtezE8vG8UG
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2