General
- Target 6660020210712_0-00010.XLS.exe
- Size 819KB
- Sample210713-2ra5nexcg2
- SHA256 031af74c61339ca40eda7563268d9e2e2803064c141d3c46eb20acad3764f4cc
- MD5 67d0321312650b71e1796cffd0ae3998
- SHA1 b60db519dc222dbc60da3115572537b274a88c92
- SHA512 3a921ebdf51babc2c43b70ac1380848b3cf5471a0e35e92a6e3ee56dddce2ead2ecc3d3edcb14dd170d5f3f4dc9066ee53837a03fd8f63ee19414294b08308ca
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
6660020210712_0-00010.XLS.exe
Resource
win7v20210410
Malware Config
Extracted
-
formbook
-
4.1
-
http://www.setuseny.site/wz6a/
-
commonebisu.com
-
onlinedatingforyou.com
-
nomoreink.com
-
directcare.doctor
-
protego1.com
-
buvettechamonix.com
-
dissertationshelp.net
-
theawakenedmother.life
-
leonwickham.com
-
renaultstoreiran.com
-
lsxwsj.com
-
uniontattoosupply.com
-
herfitnessandbeauty.com
-
jesselynleephotography.com
-
imaginebyccp.com
-
athomeproductive.com
-
laratome.com
-
smoothsailingexpress.com
-
freedrumlessons4u.com
-
easylivego.com
-
peekypetshop.com
-
suachuanha123.com
-
hamdiistanbullutv.com
-
economicsfortoddlers.com
-
donaldbichonfrise.com
-
ahhazu.com
-
fallincoffee.com
-
ospfenetres.com
-
mybusinessdoor.com
-
unfreecitizens.com
-
sofahaven.com
-
angelicmichele.com
-
boroda.codes
-
creationsbyba.com
-
324518.com
-
adventuresindiy3dprinting.com
-
onehitwonderthemusical.com
-
valsinvoguenails.com
-
inclusionpractitioner.com
-
downbytheriverside.online
-
pengpengcooking.com
-
tricket24.com
-
hanyajadi.com
-
iinntenna.com
-
basicallyindia.com
-
qfjg.net
-
lawartcultureweekly.com
-
whjmglj.com
-
mijnwebaanvraag.info
-
biancacannavoslp.com
-
brurodrigues.com
-
zebratrainer.info
-
8146confluencept.com
-
inshaabytdh.com
-
ossierugs.com
-
smacey.com
-
performancehut.com
-
fostermarketing.energy
-
rama.fans
-
spotonspecialed.com
-
krushiaadhaar.com
-
betgobar8.com
-
lkstau.com
-
thaikeittio.com
Targets
-
- Target 6660020210712_0-00010.XLS.exe
- Size 819KB
- SHA256 031af74c61339ca40eda7563268d9e2e2803064c141d3c46eb20acad3764f4cc
- MD5 67d0321312650b71e1796cffd0ae3998
- SHA1 b60db519dc222dbc60da3115572537b274a88c92
- SHA512 3a921ebdf51babc2c43b70ac1380848b3cf5471a0e35e92a6e3ee56dddce2ead2ecc3d3edcb14dd170d5f3f4dc9066ee53837a03fd8f63ee19414294b08308ca
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext