General
- Target INQUIRY SUBMITTAL_ADM SWITZERLAND.exe
- Size 542KB
- Sample211110-wza4rsaaa5
- SHA256 fcaa502268e22400e98ae6f0842b7cf3598cf5a920c09a0d74996bdb64add249
- MD5 8b1b41a27076e994863828472dc801c7
- SHA1 ad34c455b8152cfb261970db63b812f3b74e7d93
- SHA512 9807ab20d5657e5905b3d9837b6face00c2a751f832964876d49af3d9f6b2eef5d22d21543f813fcd8ac668605208e93f6690e3c4b5c0f717d9175a4ab5a3926
- MD5 SHA1 SHA512
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY SUBMITTAL_ADM SWITZERLAND.exe
Resource
win7-en-20211104
Malware Config
Extracted
-
formbook
-
4.1
-
g8ni
-
http://www.er5544.com/g8ni/
-
nickmowat.com
-
garethjame.biz
-
colibrilift.com
-
vulnerabilitylabs.one
-
neuro-ai-web-ru.website
-
16mcnaestreetmooneeponds.com
-
bestofstmaarten.net
-
meditelier.com
-
ragnarduke.com
-
escueladecampo.com
-
vongtayvn.com
-
inmemoriamaan.com
-
yourpeoplemanager.com
-
r6-gytr.com
-
agreeablebeauty.com
-
snpconfirms.com
-
tribalurq.quest
-
purafuse.com
-
cisco-training-course.com
-
wery.top
-
haiyaa.tech
-
schtefo.net
-
kenytc.com
-
energypopcorn.com
-
0urls.top
-
artiatec.com
-
enqum.com
-
nextcloud.solutions
-
stateaffairsng.com
-
727bpay.com
-
matchmakerfiji.com
-
qingdouge.com
-
nusrattelbdoffical.xyz
-
seo-clicks7.com
-
aspirateurs.net
-
autosandmorestore.com
-
moje-akvarium.net
-
uehddw.com
-
geschmacksakademie.com
-
gendarmerie.email
-
buynftinc.com
-
mission-nao.com
-
webmakers.xyz
-
federationwholesale.com
-
tjbieying.com
-
finestpoints.com
-
premiersloyko.xyz
-
carlislepartssurvey.com
-
hackernfts.com
-
abitvip.com
-
iphone13mini.supplies
-
thenorthfacedeal.online
-
swlhvipbj.com
-
elguije.com
-
auto2pl.com
-
route112mitsubishi.com
-
zilliq.com
-
pumateam04.com
-
xtzztf.com
-
sacmaudantoc.xyz
-
kalafwalker.com
-
jumeaux-numeriques.com
-
purposefulwork.com
-
jacquelineblog.info
Targets
-
- Target INQUIRY SUBMITTAL_ADM SWITZERLAND.exe
- Size 542KB
- SHA256 fcaa502268e22400e98ae6f0842b7cf3598cf5a920c09a0d74996bdb64add249
- MD5 8b1b41a27076e994863828472dc801c7
- SHA1 ad34c455b8152cfb261970db63b812f3b74e7d93
- SHA512 9807ab20d5657e5905b3d9837b6face00c2a751f832964876d49af3d9f6b2eef5d22d21543f813fcd8ac668605208e93f6690e3c4b5c0f717d9175a4ab5a3926
- MD5 SHA1 SHA512
Formbook Payload
Deletes itself
Suspicious use of SetThreadContext