General
-
Target
INVOICES.exe
-
Size
996KB
-
Sample
220803-1jq79sffg4
-
MD5
edfc6e2add36e49c8c9e010db0eb0632
-
SHA1
69697675cdc6d2c26db0709339bfd8f42044e7b6
-
SHA256
86871dd03f2da6c6de34710060ddc726fae5907f1f48d37c26d23f4d3d3f9bb8
-
SHA512
61dd86fe6c09ecb2e8e107a0aa6f93d0d44334f873c3fb4b842be5e4da26e72ad53cc65c202fe9aca0ef540021ed4ddbe4f3fa9030886d835ff6ad74c894cac6
Static task
static1
Behavioral task
behavioral1
Sample
INVOICES.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
INVOICES.exe
Resource
win10v2004-20220721-en
Malware Config
Extracted
formbook
4.1
ee27
gasimportsfiles.com
hospitaljobsindia.com
mymortgagecantips.xyz
yourenotalone.world
livethejesuslife.com
sobernv.com
bobgruber.online
badu100.com
id98qq12.com
naturalex.co.uk
metathrillrides.com
blessingstowing.com
juddsbarandgrill.com
qrcodemania.com
haodaculture.com
obot.xyz
soupmortgagemark.xyz
top-road.com
xiaoterv.com
madrstyonline.com
lntmemories.com
codeverse.store
coleadersolutions.com
xn--2i0bs4kuxch7w.com
trumanridgekc.com
urbansummerfest.com
prelistingphotos.com
ncknights.com
demo-box.com
rifinastore.com
costamp.online
growthdigitalstudios.com
mso-4.com
rebeccast.club
mobilebusinessmoneymachine.com
hardmails.com
taylorbeckerhair.com
bradarender.com
urfahaberdar.com
evershinetransportltd.co.uk
perfecttime.club
phch.pro
fccxzb.site
myassetssecured.com
mysticmindpublishingacademy.com
energyharvesting.online
nhckom.com
tomiburkolo.com
uplandshell.com
tabularasa.net.cn
pagosahanger.com
apicemtech.com
doomscene.com
yqxinydz.com
lolmaster.host
massageindenton.uk
95hillerdr.com
paymentwize.com
tamwen.app
4any4all.com
neustabos.com
jedonnadingesforgpboe.com
dabeiw.com
thatpaintlady.com
ndcolledge-traducteur.com
Targets
-
-
Target
INVOICES.exe
-
Size
996KB
-
MD5
edfc6e2add36e49c8c9e010db0eb0632
-
SHA1
69697675cdc6d2c26db0709339bfd8f42044e7b6
-
SHA256
86871dd03f2da6c6de34710060ddc726fae5907f1f48d37c26d23f4d3d3f9bb8
-
SHA512
61dd86fe6c09ecb2e8e107a0aa6f93d0d44334f873c3fb4b842be5e4da26e72ad53cc65c202fe9aca0ef540021ed4ddbe4f3fa9030886d835ff6ad74c894cac6
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Formbook payload
-
ModiLoader Second Stage
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-