Overview

overview

10

Static

static

8

30e9dd429a...21.xls

windows7-x64

10

30e9dd429a...21.xls

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30e9dd429aa7ad4ea6f07f3a640ab2d47ca1531ffa845503f283ec291d81a621

  • Size

    91KB

  • Sample

    241120-vhycastrfn

  • MD5

    f19fcbb2a949c5ec8b6c6caf1266582d

  • SHA1

    d15e7743fe318eb4abcb9298aa4e6f28d89d68ea

  • SHA256

    30e9dd429aa7ad4ea6f07f3a640ab2d47ca1531ffa845503f283ec291d81a621

  • SHA512

    234a0292448eeb01dd513898d935f4cf40c95ca34ba2f9bb60c84f1858f45fb26078238b45da6f422bc6f6d567dc63d241ca3838067196fa4e054bf48aa4e393

  • SSDEEP

    1536:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgCbCXuZH4gb4CEn9J4ZCL5:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgJ

Score
10/10
discoverymacroxlm

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://helpeve.com/wp-admin/sOdeuF1c4DV2h/
xlm40.dropper

http://christplanet.com/wp-admin/maint/mtlsi/TxsAE7TAAb/
xlm40.dropper

http://www.chawkyfrenn.com/icon/LRWYSefRL7/
xlm40.dropper

http://chist.com/dir-/N5zALqqTmf/

Targets

    • Target

      30e9dd429aa7ad4ea6f07f3a640ab2d47ca1531ffa845503f283ec291d81a621

    • Size

      91KB

    • MD5

      f19fcbb2a949c5ec8b6c6caf1266582d

    • SHA1

      d15e7743fe318eb4abcb9298aa4e6f28d89d68ea

    • SHA256

      30e9dd429aa7ad4ea6f07f3a640ab2d47ca1531ffa845503f283ec291d81a621

    • SHA512

      234a0292448eeb01dd513898d935f4cf40c95ca34ba2f9bb60c84f1858f45fb26078238b45da6f422bc6f6d567dc63d241ca3838067196fa4e054bf48aa4e393

    • SSDEEP

      1536:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgCbCXuZH4gb4CEn9J4ZCL5:eKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgJ

    Score
    10/10
    discovery

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks