General
-
Target
SOA_Invoice_04930.exe
-
Size
620KB
-
Sample
221004-mxzjxaafc2
-
MD5
e980fe4c7833022bb80b70abdda382de
-
SHA1
8d82c1696df13202dc4d41f23c6df7f5fe18abee
-
SHA256
8a9a70ca1dd6bd611d2b77bf233ab14f62b259d510973722a1381c237b4980f9
-
SHA512
72ab8d6ce9e55266a45d60f046ec44df1ab51c6ff20e8f0a8376285921672f9efad57c22a52d2962556dd228d18b28e3d16dc8c3266f0837745ac9f089d5d68f
-
SSDEEP
12288:NToPWBv/cpGrU3ypp8sGT72T4g+mtCYd/1l1fS7:NTbBv5rUOysGf2kxgN9fQ
Static task
static1
Behavioral task
behavioral1
Sample
SOA_Invoice_04930.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
hzb3
BVGWUXYpaaEaNSjsCHhJnDJz463cqQ==
CEqdZb0KaOLLbWqrDVTgc20=
nBv0jSFiQHxtE6awQnm2
E1sGpCJYtB8ImaguUyF6yQ==
PMBND7LzJGZH7CXulclbs2c=
u9zzlFGDXo6LLbGwQnm2
SaJjLbtVlMgsP5ZQRj4=
wckwEbwBbKA2X3g=
rPxB8ePUxfu4pilu
S562QFeKY5P//qawQnm2
BkEfWXZuY3ihKW8=
ZanakqMxkP7VdNfWdD4FGDqF
PYYbtzdINC1J0OYzQCk=
Fmg9LBxaPQ==
4eXWfoC06yGAkQ0l+Txs2w==
n68j2X6+CIhsD5GiCMYBsHI=
hRv6hpW3qfLbdI1XJ/J825G1TslJ+1JE
X6PAVGfwPHihKW8=
7zn1tkuDaZ2FKbGwQnm2
lB0m5ghWsSmMpIUS8EBM31l/463cqQ==
l9+AFK8Njc9C
RHkS2TSQ5mg=
+5d2+2EBePdmgUC4juLwhAozwBpJ+1JE
2CDJYHKCU33wHDf71wJasmU=
nOqcQcJNpQHtbLWtBk6B2BKC3nGu
5DrpfemL/GBR0+YzQCk=
1WBB2lWMbJaEFGVBEOhyzUGmO/wE8VVM
j6alTVV9wEa5160IUpLQ4wGC3nGu
4mh8GB+9K6OACTgF3wJasmU=
IDAKqyiqloA2Vyh7
O5Hjrs4LFfldbw==
U23Oc3SokdECZV7qyA==
+5qKLrABnAVb
HqQp24tAsiVIlTFz
YnBwLU2p+DdB2OYzQCk=
1tpoQtS08Gs=
5F1WUyajTZFzCmc=
nNJ9DTd1pOVFbUD12B7mUGCy83+3
RZ/KhZ/MvelKIlvryg==
mSq9dhWVjtisPVfshRsqzA==
GZeCIyVZtBhrh1nghRsqzA==
fbsOq3144mk+zeYzQCk=
rvwSr/PIk9i7QU+gjWuh
NjFwBNS08Gs=
y0haCyimjnihKW8=
Yqh6Mmu8+DOi06ovC2qA4cEFLg==
reumUsWxl8U3FkMKJ5lrxA==
n64VtWoYWqwdPv1b5kB80g6C3nGu
+zn0sPpKryNIlTFz
DlDKncH2Ffldbw==
G8q27dcW8zwfxhUgggJasmU=
VKlL8eYBnAVb
uQypIaJEtz2k1NOdhL+QsitOoRuYxuY=
TI5YIL0L+yEMXvwt3Q==
OoJBFc4aA0E81eYzQCk=
4pxm7haZ2VFG5R/w0wJasmU=
YK5Q+7T0vu3eX5ltUCKi+JquRsVJ+1JE
sMgkwGqEXZF5Hq2wQnm2
kwR4EJKBvwhZ
2zJV8en9zOpLIlvryg==
SclaLzK/GpB+LY6f9kHHThBxbDE=
WaLWiI2VdcKtT3h7mr7P4HI=
NYCpQw8uBu/EayWgjWuh
S5jus88LFfldbw==
vapes-shop.com
Extracted
xloader
3.8
hzb3
BVGWUXYpaaEaNSjsCHhJnDJz463cqQ==
CEqdZb0KaOLLbWqrDVTgc20=
nBv0jSFiQHxtE6awQnm2
E1sGpCJYtB8ImaguUyF6yQ==
PMBND7LzJGZH7CXulclbs2c=
u9zzlFGDXo6LLbGwQnm2
SaJjLbtVlMgsP5ZQRj4=
wckwEbwBbKA2X3g=
rPxB8ePUxfu4pilu
S562QFeKY5P//qawQnm2
BkEfWXZuY3ihKW8=
ZanakqMxkP7VdNfWdD4FGDqF
PYYbtzdINC1J0OYzQCk=
Fmg9LBxaPQ==
4eXWfoC06yGAkQ0l+Txs2w==
n68j2X6+CIhsD5GiCMYBsHI=
hRv6hpW3qfLbdI1XJ/J825G1TslJ+1JE
X6PAVGfwPHihKW8=
7zn1tkuDaZ2FKbGwQnm2
lB0m5ghWsSmMpIUS8EBM31l/463cqQ==
l9+AFK8Njc9C
RHkS2TSQ5mg=
+5d2+2EBePdmgUC4juLwhAozwBpJ+1JE
2CDJYHKCU33wHDf71wJasmU=
nOqcQcJNpQHtbLWtBk6B2BKC3nGu
5DrpfemL/GBR0+YzQCk=
1WBB2lWMbJaEFGVBEOhyzUGmO/wE8VVM
j6alTVV9wEa5160IUpLQ4wGC3nGu
4mh8GB+9K6OACTgF3wJasmU=
IDAKqyiqloA2Vyh7
O5Hjrs4LFfldbw==
U23Oc3SokdECZV7qyA==
+5qKLrABnAVb
HqQp24tAsiVIlTFz
YnBwLU2p+DdB2OYzQCk=
1tpoQtS08Gs=
5F1WUyajTZFzCmc=
nNJ9DTd1pOVFbUD12B7mUGCy83+3
RZ/KhZ/MvelKIlvryg==
mSq9dhWVjtisPVfshRsqzA==
GZeCIyVZtBhrh1nghRsqzA==
fbsOq3144mk+zeYzQCk=
rvwSr/PIk9i7QU+gjWuh
NjFwBNS08Gs=
y0haCyimjnihKW8=
Yqh6Mmu8+DOi06ovC2qA4cEFLg==
reumUsWxl8U3FkMKJ5lrxA==
n64VtWoYWqwdPv1b5kB80g6C3nGu
+zn0sPpKryNIlTFz
DlDKncH2Ffldbw==
G8q27dcW8zwfxhUgggJasmU=
VKlL8eYBnAVb
uQypIaJEtz2k1NOdhL+QsitOoRuYxuY=
TI5YIL0L+yEMXvwt3Q==
OoJBFc4aA0E81eYzQCk=
4pxm7haZ2VFG5R/w0wJasmU=
YK5Q+7T0vu3eX5ltUCKi+JquRsVJ+1JE
sMgkwGqEXZF5Hq2wQnm2
kwR4EJKBvwhZ
2zJV8en9zOpLIlvryg==
SclaLzK/GpB+LY6f9kHHThBxbDE=
WaLWiI2VdcKtT3h7mr7P4HI=
NYCpQw8uBu/EayWgjWuh
S5jus88LFfldbw==
vapes-shop.com
Targets
-
-
Target
SOA_Invoice_04930.exe
-
Size
620KB
-
MD5
e980fe4c7833022bb80b70abdda382de
-
SHA1
8d82c1696df13202dc4d41f23c6df7f5fe18abee
-
SHA256
8a9a70ca1dd6bd611d2b77bf233ab14f62b259d510973722a1381c237b4980f9
-
SHA512
72ab8d6ce9e55266a45d60f046ec44df1ab51c6ff20e8f0a8376285921672f9efad57c22a52d2962556dd228d18b28e3d16dc8c3266f0837745ac9f089d5d68f
-
SSDEEP
12288:NToPWBv/cpGrU3ypp8sGT72T4g+mtCYd/1l1fS7:NTbBv5rUOysGf2kxgN9fQ
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-