General
-
Target
PROOF OF PAYMENT.exe
-
Size
24KB
-
Sample
220909-rnbhyagch7
-
MD5
7f99d249840dc2c5009b4771f887336e
-
SHA1
0a4de6946dca7444da62b7794bcb59e553108f0c
-
SHA256
fc15ab19130fccdae7dee477e0ae6d711fe3492cbac1b7e5d472eae4902f9516
-
SHA512
2dc950577ee4fa9b999d044cbb93aa365b13eb5a012633e7ec61410536790080c6c2f3be9f684ac3f11694b51d40d4732aa9975d91fd0c2b68c6e9d66a204237
-
SSDEEP
384:JwkCN7n8OIo3A12++XCCvcXEMA+7QEh2Fobm22:5CNz8OBnMA8R2
Static task
static1
Behavioral task
behavioral1
Sample
PROOF OF PAYMENT.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
a520
/gLFv8NVc2nqbYCCoHLJDBi+TWOu
sjwFU14OMEn7e45Z11ou
stKh65U2h0eAsE3C4do=
tk5xxHYnTytQmuXoUyhstM+PmMM3eNzI
VExtu7dXhpO5DVpouFRxSlhP
YdSW3s9Pg88HRHs7IfKVBk8dGis=
/LJ5vLk+mifRECHWQPfgWQ==
/4qc8tqSwrszxE3C4do=
e4IkI9v2EV+ertKMol1xSlhP
VlwmZCwqUvsUbriqC/RU8Hnh9yM=
o8+X4ZkxbmtygJJZ11ou
YPS3vnb0JRuS8CAOQ0OY2PG4s8U3eNzI
JT5iqFqVvyfGCDX2Httopp4=
2qeFp5QULYE4suWiry9MYFtH
6OaHllqHu+H49V0VCw==
c4xPnUPM8hW3Nldbq6j8X+iVlQ==
s0tmqKSyw0FK0vLpFZ1mX+iVlQ==
SWU1e3eTqiCzv8TIDAtus757e6k3eNzI
CcDlcuyGx8ZDyynuQjQLRg==
KNq19/KCns+bobJdXiXu9AK+TWOu
zUBSlETQ7/chaaBZ11ou
C5g9UkS0OHlz8g==
TYhNTUOBqhyx+C34JfN5kIk=
oFRL0sncOHlz8g==
YNrtPUI8XhdabLbC
t0jp97M8UgsZkcJ70FymTg==
9QslhDxRmhcWptXfSw3XEF0VXrXWJg==
/57NEQgxXw47tNhFYEw5
11R7vsHoJyT4gtbH
hiZEhnN30eUbYHeUyV1KzgnCTHG3
qbXSGcbJOHlz8g==
+Txcm5sccffuOk0ONziHEFwcXrXWJg==
6VXg6tlvuFK1AhY=
DDBKlE16n9pksuHSH9topp4=
/SVHjz5kcZ0ph9hFYEw5
ReqHlIAcODGn/E3C4do=
sMSLqF/SAow1iNxFYEw5
Ei5TqXCqyCDRToGE4bD4PUUADWas0mg=
XeURYxW0+A0zea2i5uhxSlhP
d5RaaGOVv2iP0T74CQ==
P7tWXEHM9j92gpJZ11ou
3P7WFgo3dQmsvNJ/0FymTg==
GjJJmFF5n9RdvwX4K9topp4=
mDTExIMKE+1abLbC
vfofahoYN647cKSK6qrvX+iVlQ==
w14nKuKAzuINWZZZ11ou
I1N7uHk+X5U0yE3C4do=
PrCbE5JwrwE=
mVIXKiW/1tVX4AoEODqBzgq+TWOu
2hbm6qN2wxi9+U3C4do=
AyX5PuOBk1FaosWTlVOmVLFxhRY3eNzI
BKLA++3oE9ftcbZ70FymTg==
enwWG9vm/1P1AU4D29cm
AwQXZ236P5RF2zD0HNtopp4=
/wSkp2NxeteHx9eWlmxbYl3YD6tZLg==
boqyBsT0F03rcrGPyccYRnnh9yM=
x1/6/LhGXRAdbIl2vL8Yn9fPXrXWJg==
HaHB8+kaSd6KzPm/2+tU5Df1Bmas0mg=
/nEDQpFBn3ur
ALKDjlPqNE/pd5JZ11ou
aOkNThJ2v5Wn
ava1yIsZNAIvjKt60FymTg==
vvS6A71vknmcst2TllSdTpOc3WBV4dzS8w==
/QnXJvFil1aq5gs=
brandshippinglines.com
Extracted
nanocore
1.2.2.0
amechi.duckdns.org:4190
7766992d-5166-4919-9d26-1d114e11093c
-
activate_away_mode
true
-
backup_connection_host
amechi.duckdns.org
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2022-06-17T10:10:35.253943636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
4190
-
default_group
NEW TRY FOR SUCCESS
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
7766992d-5166-4919-9d26-1d114e11093c
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
amechi.duckdns.org
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Targets
-
-
Target
PROOF OF PAYMENT.exe
-
Size
24KB
-
MD5
7f99d249840dc2c5009b4771f887336e
-
SHA1
0a4de6946dca7444da62b7794bcb59e553108f0c
-
SHA256
fc15ab19130fccdae7dee477e0ae6d711fe3492cbac1b7e5d472eae4902f9516
-
SHA512
2dc950577ee4fa9b999d044cbb93aa365b13eb5a012633e7ec61410536790080c6c2f3be9f684ac3f11694b51d40d4732aa9975d91fd0c2b68c6e9d66a204237
-
SSDEEP
384:JwkCN7n8OIo3A12++XCCvcXEMA+7QEh2Fobm22:5CNz8OBnMA8R2
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-