General
-
Target
Inquiry PR11020204168.xlsx
-
Size
2.5MB
-
Sample
210121-xw98g42x4s
-
MD5
abcb38dee6d515f3e5b7c6bdbc179e84
-
SHA1
043024ce517bc4cd801103fe1fe7402f5c5e16f3
-
SHA256
9975a71837159cdfdf2dfd0a38a62ff8f8e90ada6e6a18e63cf143d861964d49
-
SHA512
fc55de5624d9a4c57bf553061710aef07f2f92a54785ae0002040c849967d9fadc4ce8cde0aaa37bba21884d33b3854d26d92ce3a0edd1e726d04382a646fd4c
Static task
static1
Behavioral task
behavioral1
Sample
Inquiry PR11020204168.xlsx
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Inquiry PR11020204168.xlsx
Resource
win10v20201028
Malware Config
Extracted
formbook
http://www.learnhour.net/eaud/
modshiro.com
mademarketingoss.com
austinjourls.info
wayupteam.com
crossingfinger.com
interseptors.com
gigashit.com
livetigo.com
halamankuningindonesia.com
windhammills.com
aylinahmet.com
mbacexonan.website
shopboxbarcelona.com
youyeslive.com
coonlinesportsbooks.com
guorunme.com
putlocker2.site
pencueaidnetwork.com
likevector.com
vulcanudachi-proclub.com
bestcollegelms.online
bosman-smm.online
maglex.info
tolentinestore.com
layaliskincare.com
pensionbackup.com
mettyapp.com
sun-microsoft.com
cheapcialisffx.com
egio.digital
syndicatesportspicks.com
pinnacle.international
realestatejewel.com
dajiankang.love
acaijunglegroup.com
youraircases.com
cdxxcenter.com
ndblife.com
mersinsimsek.com
modernofficeaccessories.com
opioidfactswalgreens.com
yesmywigs.com
lebaronfuneraire.com
missfoxie.com
minbarlibya.com
themalaysialife.com
glz-cc.com
go892.com
eriesbestcaterer.com
geraldreed.com
casinocerto.com
beambitioussummit.com
rfs.company
juliandehaas.com
enooga.com
sulpher.network
toords.com
breaking-news4u.com
erkdigitalmarketing.com
blazorstore.com
weoneqa.com
coalitionsentiment.win
atoidejuger.com
cumbiamba.com
Targets
-
-
Target
Inquiry PR11020204168.xlsx
-
Size
2.5MB
-
MD5
abcb38dee6d515f3e5b7c6bdbc179e84
-
SHA1
043024ce517bc4cd801103fe1fe7402f5c5e16f3
-
SHA256
9975a71837159cdfdf2dfd0a38a62ff8f8e90ada6e6a18e63cf143d861964d49
-
SHA512
fc55de5624d9a4c57bf553061710aef07f2f92a54785ae0002040c849967d9fadc4ce8cde0aaa37bba21884d33b3854d26d92ce3a0edd1e726d04382a646fd4c
-
Xloader Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Enumerates physical storage devices
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext
-