General
-
Target
Payment Ref $24,845.docx
-
Size
10KB
-
Sample
210622-v31d1z9gaj
-
MD5
ccd4c28726088c338206933392b234cb
-
SHA1
0f2a9d2e7804e793afcc6e8e7a3a561f75bf4bea
-
SHA256
c92aaf449b1938cb5918e73f02936eab06b7974fa441492bea95e9c68c5e5084
-
SHA512
328ce30627e667a5a3431bb6cdb127c24d8e3202a6e771b0f438022f55a4e7a743afaf4c3fb7d75875a60815427882e784f124521721fd79161dfb58712da26a
Static task
static1
Behavioral task
behavioral1
Sample
Payment Ref $24,845.docx
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Payment Ref $24,845.docx
Resource
win10v20210410
Malware Config
Extracted
https://itsssl.com/vyQCm
Extracted
formbook
4.1
http://www.dragonpalcenk.com/k8n/
foxynailserie.com
thenoyzees.com
waterrising.xyz
allmister.com
theguyscave.com
erkitap.com
spyder-club.com
raskrutisam.com
giantledlights.com
wowbeautynails.com
youmovies.site
abjms.com
enso-solutions.com
seasonalcampgroundsmn.com
lukeprater.com
mufasacapital.com
idi360.com
mask-cleaner.com
aeruswilmde.com
venkatlifecoach.com
crochetandgabbana.com
onlineshreecollection.com
gwenythportillowightman.com
nexuspropertycare.com
progress.solutions
parkerut.com
achebones.com
jiazhengfu.com
chlamydiadeetz.com
thiele-concept.com
bayareataxattorney.com
geopainterdecorators.com
makemybuild.com
headsleepinstrument.online
finevinum.com
alphaworkoutgear.com
8765pk.com
rikonchat.com
gitchat.net
showy1.net
tellurideminer.com
triliumbrewing.com
fioriapartment.com
salubrigems.com
sctsmney.com
betgobar1.com
thomaspurcell.com
araket.com
parisfilmfestival.online
treepik.com
artemisnaturalhealing.com
littlehouseofhoarders.com
buyselllm.com
levnakava.com
mygolfbetter.com
vinlancer.com
beetalkmobile.press
gocampultralightmattress.com
direk99.net
nivxros.com
cbgdenver.com
datarock.net
docondemand.net
smithvilletexashistory.com
Targets
-
-
Target
Payment Ref $24,845.docx
-
Size
10KB
-
MD5
ccd4c28726088c338206933392b234cb
-
SHA1
0f2a9d2e7804e793afcc6e8e7a3a561f75bf4bea
-
SHA256
c92aaf449b1938cb5918e73f02936eab06b7974fa441492bea95e9c68c5e5084
-
SHA512
328ce30627e667a5a3431bb6cdb127c24d8e3202a6e771b0f438022f55a4e7a743afaf4c3fb7d75875a60815427882e784f124521721fd79161dfb58712da26a
-
Formbook Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Abuses OpenXML format to download file from external location
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-