General
-
Target
0d69e4f6_by_Libranalysis
-
Size
38KB
-
Sample
210503-cdq6q9w97a
-
MD5
0d69e4f684735cf4f187659ee0882fd8
-
SHA1
55a52f6971084224e3030b76cd44d13b0203b749
-
SHA256
0c856e57da034a8943b4065297d075365090d9eb925abb7ba74dd3df9acefc1f
-
SHA512
9bfc38689030d9100a52d192ffacf7afcf82ec64b40bb34613adaa109c1557959123ee4c261b4becaed28b99c28044cd410dc3f82fc18ab82276311e40464647
Behavioral task
behavioral1
Sample
0d69e4f6_by_Libranalysis.xls
Resource
win7v20210408
Malware Config
Extracted
formbook
4.1
http://www.111bjs.com/ccr/
abdullahlodhi.com
jevya.com
knoxvillerestaurant.com
mekarauroko7389.com
cricketspowder.net
johannchirinos.com
orangeorganical.com
libero-tt.com
lorenaegianluca.com
wintab.net
modernmillievintage.com
zgdqcyw.com
jeffabildgaardmd.com
nurulfikrimakassar.com
findyourchef.com
innovationsservicegroup.com
destek-taleplerimiz.com
whfqqco.icu
kosmetikmadeingermany.com
dieteticos.net
savarsineklik.com
newfashiontrends.com
e-mobilitysolutions.com
spaced.ltd
amjadalitrading.com
thejstutor.com
zzhqp.com
exoticomistico.com
oklahomasundayschool.com
grwfrog.com
elementsfitnessamdwellbeing.com
auldontoyworld.com
cumhuriyetcidemokratparti.kim
thetruthinternational.com
adimadimingilizce.com
retreatwinds.com
duoteshop.com
jasonkokrak.com
latindancextreme.com
agavedeals.com
motz.xyz
kspecialaroma.com
yuejinjc.com
print12580.com
ampsports.tennis
affordablebathroomsarizona.com
casnop.com
driftwestcoastmarket.com
bjsjygg.com
gwpjamshedpur.com
reserveacalifornia.com
caobv.com
culturaenmistacones.com
back-upstore.com
jjsmiths.com
iamxc.com
siobhankrittiya.com
digitalakanksha.com
koatku.com
shamushalkowich.com
merplerps.com
fishexpertise.com
sweetheartmart.com
nqs.xyz
Targets
-
-
Target
0d69e4f6_by_Libranalysis
-
Size
38KB
-
MD5
0d69e4f684735cf4f187659ee0882fd8
-
SHA1
55a52f6971084224e3030b76cd44d13b0203b749
-
SHA256
0c856e57da034a8943b4065297d075365090d9eb925abb7ba74dd3df9acefc1f
-
SHA512
9bfc38689030d9100a52d192ffacf7afcf82ec64b40bb34613adaa109c1557959123ee4c261b4becaed28b99c28044cd410dc3f82fc18ab82276311e40464647
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Formbook Payload
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Loads dropped DLL
-
Use of msiexec (install) with remote resource
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext
-