General
-
Target
PO08223.xlsx
-
Size
369KB
-
Sample
211020-g95nsshfdp
-
MD5
71bc14ae474980c5614b1b27e0e21adb
-
SHA1
21630c3537bee78767624ce23e416352aaa44bef
-
SHA256
ab3b9d1372510bb17297fdff6682033d3993617a74d7b00f9ab65912488a069f
-
SHA512
40fcc3d14a939e717d181392afcf7e6a1a54ad6f101d24de397a07120374c77ecd512170f68e908dd54615799dfcc3270ee2ac30ea0032a8151f6352e8636492
Static task
static1
Behavioral task
behavioral1
Sample
PO08223.xlsx
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
PO08223.xlsx
Resource
win10-en-20210920
Malware Config
Extracted
xloader
2.5
kqna
http://www.surfsolutions.info/kqna/
achyutlifesciences.com
anthemmg.com
netkopat.com
generationgirlnaturals.com
novatel-network.com
craftstockco.com
thevishantiverse.art
elkerfly.com
haerotechs.com
candypalette.com
gregdokes.com
e-commerce.company
gratitudeland.com
companyintelcloud.com
publicyazilim.com
xc6811.com
aracsozluk.com
janesgalant.quest
fraserstephendop.com
ryan.rentals
wyse-solutions.com
reddishslouqb.xyz
rukygua.xyz
unlimitedrehab.com
fundafes.com
goodoffice.online
guserq.com
tigerstarmatka.com
ganleychevybuyscars.com
murrayforcongress.com
artistandfund.com
integritynotarial.com
cantomarbait.com
alifdanismanlik.com
meggisiegert.com
high-clicks3.com
xn--schwche-8wa.com
caffeiny.com
landsoftexasranchland.com
armmapp.com
cursosminharendaextra.com
globalmarineserv.com
lowestfars.com
finlayo.com
hautlescoeurscollection.com
cyclesforyou.com
bagwashs.com
medicaltrust-sd.com
passivemen.com
midatlanticbath.com
mchaskellproperties.com
facetofacewith.com
worldwidecorumuk.com
g632b.online
atozshoppingllc.com
jcswkj.net
czemi.com
minutemannetwork.net
hjku.xyz
uko7wuyj.xyz
amigasconesencia.com
hodgeandpartners.com
edfnu.com
corncobmeal.com
Targets
-
-
Target
PO08223.xlsx
-
Size
369KB
-
MD5
71bc14ae474980c5614b1b27e0e21adb
-
SHA1
21630c3537bee78767624ce23e416352aaa44bef
-
SHA256
ab3b9d1372510bb17297fdff6682033d3993617a74d7b00f9ab65912488a069f
-
SHA512
40fcc3d14a939e717d181392afcf7e6a1a54ad6f101d24de397a07120374c77ecd512170f68e908dd54615799dfcc3270ee2ac30ea0032a8151f6352e8636492
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-