General
-
Target
PO0945.xlsx
-
Size
186KB
-
Sample
211102-jlztracac3
-
MD5
829b8d8b0cd21a5c5da2a4dee3ce93a6
-
SHA1
dc672309a13c1cd005fc06e2031e7e54b2bd3031
-
SHA256
04db053ddaf38c4d040e12c2ffdd19a98dbeb9cafb43e4ef397e95da97ba3036
-
SHA512
ca91d8ace393633ae4a9c92b70a32ab4f7717d4cf63e83a1e610db506c26e61dc5954d6281d922451ae0f6e650016fbc7e8195f05d06eb98bb7ccca77dacb625
Static task
static1
Behavioral task
behavioral1
Sample
PO0945.xlsx
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
PO0945.xlsx
Resource
win10-en-20210920
Malware Config
Extracted
xloader
2.5
kqna
http://www.surfsolutions.info/kqna/
achyutlifesciences.com
anthemmg.com
netkopat.com
generationgirlnaturals.com
novatel-network.com
craftstockco.com
thevishantiverse.art
elkerfly.com
haerotechs.com
candypalette.com
gregdokes.com
e-commerce.company
gratitudeland.com
companyintelcloud.com
publicyazilim.com
xc6811.com
aracsozluk.com
janesgalant.quest
fraserstephendop.com
ryan.rentals
wyse-solutions.com
reddishslouqb.xyz
rukygua.xyz
unlimitedrehab.com
fundafes.com
goodoffice.online
guserq.com
tigerstarmatka.com
ganleychevybuyscars.com
murrayforcongress.com
artistandfund.com
integritynotarial.com
cantomarbait.com
alifdanismanlik.com
meggisiegert.com
high-clicks3.com
xn--schwche-8wa.com
caffeiny.com
landsoftexasranchland.com
armmapp.com
cursosminharendaextra.com
globalmarineserv.com
lowestfars.com
finlayo.com
hautlescoeurscollection.com
cyclesforyou.com
bagwashs.com
medicaltrust-sd.com
passivemen.com
midatlanticbath.com
mchaskellproperties.com
facetofacewith.com
worldwidecorumuk.com
g632b.online
atozshoppingllc.com
jcswkj.net
czemi.com
minutemannetwork.net
hjku.xyz
uko7wuyj.xyz
amigasconesencia.com
hodgeandpartners.com
edfnu.com
corncobmeal.com
Targets
-
-
Target
PO0945.xlsx
-
Size
186KB
-
MD5
829b8d8b0cd21a5c5da2a4dee3ce93a6
-
SHA1
dc672309a13c1cd005fc06e2031e7e54b2bd3031
-
SHA256
04db053ddaf38c4d040e12c2ffdd19a98dbeb9cafb43e4ef397e95da97ba3036
-
SHA512
ca91d8ace393633ae4a9c92b70a32ab4f7717d4cf63e83a1e610db506c26e61dc5954d6281d922451ae0f6e650016fbc7e8195f05d06eb98bb7ccca77dacb625
-
Xloader Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-