General
- Target Drawings HQ30-DM140.exe
- Size 819KB
- Sample211103-rcpanadhh9
- SHA256 f8d83d34e0fc406604af9a11462e8e8ad2b3cd5d3cebe4576e1792a3b861e84b
- MD5 9150940760194f5f4e608a66eed2d0a6
- SHA1 416e29c7a5f80968f7581a2fbf05fdd99fc212da
- SHA512 e0c05a5c8672444e4a01ce0b0b1bee1bdacd0c5f7636335b1ee5f5de1597f5d2613885a50fb5d85593eaa14ef9342c4a65de649140f61b88ebe7c43a09fee97a
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
Drawings HQ30-DM140.exe
Resource
win7-en-20211014
Malware Config
Extracted
-
formbook
-
4.1
-
wk31
-
http://www.firstho.com/wk31/
-
soroban.xyz
-
irfirstaid.com
-
irsaycollection.com
-
thebardownstairsasheville.com
-
facebookmeta.business
-
paypalsupportclient.com
-
metaversusfacebook.com
-
litakparuikamazon.com
-
rivianmotorcompany.com
-
metaversepro.us
-
ikramfamilypractice.com
-
bitcoinfuturesetfs.online
-
5donline.com
-
rosemount.us
-
nicole-steinfort.com
-
performanceautorepairsj.com
-
scrabblecheats.us
-
kjg67amazon.com
-
formerlyknownasfacebook.com
-
youtubeandgooglepay.online
-
alexaequipos.com
-
iboxmeta.com
-
metaverse-google.com
-
shadowinformedtherapist.com
-
com-ibb.co
-
blueapplesindia.com
-
globalsxports.com
-
myfirstxboxgame.com
-
irsaymuseum.net
-
alexanderbransoncommercial.com
-
akive.kr
-
facebooktometa.com
-
ko-bae.com
-
sunnyleoneporn.xyz
-
harborverse.com
-
metaversum.us
-
microsoftsingles.com
-
arcam.us
-
cannatomorrow.net
-
teslacarbattery.info
-
wellsfarrgorewards.com
-
rescuemefirstaid.com
-
blackdiamondwellingtonfl.com
-
solusvenator.com
-
managemylif.com
-
metafirstcoin.com
-
alexanderferency.com
-
mutfilms.com
-
fedex-express-parcels.com
-
wellnessfirst-pembroke.ca
-
authsecurre02.bid
-
meta-spacex.com
-
meta-nascar.com
-
stelladot.us
-
yaruky.xyz
-
bitfarms.xyz
-
airsoftmeta.com
-
firststepcenter.net
-
scottdunn.voyage
-
zenubium.us
-
healthplans2023.com
-
metamorphosisfacebook.com
-
facebooksecurity.cloud
-
sebaspfc.com
Targets
-
- Target Drawings HQ30-DM140.exe
- Size 819KB
- SHA256 f8d83d34e0fc406604af9a11462e8e8ad2b3cd5d3cebe4576e1792a3b861e84b
- MD5 9150940760194f5f4e608a66eed2d0a6
- SHA1 416e29c7a5f80968f7581a2fbf05fdd99fc212da
- SHA512 e0c05a5c8672444e4a01ce0b0b1bee1bdacd0c5f7636335b1ee5f5de1597f5d2613885a50fb5d85593eaa14ef9342c4a65de649140f61b88ebe7c43a09fee97a
- MD5 SHA1 SHA512
-
Formbook Payload
-
Deletes itself
-
Suspicious use of SetThreadContext