General
-
Target
scan_pictures.exe
-
Size
370KB
-
Sample
221007-lhlttscag6
-
MD5
8de66376e7ec767b186df680b27a9333
-
SHA1
73ed9713241c33e165dd3909abf94e22f4b7f39d
-
SHA256
4eaa6cbb07ff01de61ba87d140ca4dcd5c4054f9796bc6c15e6946ef484991ff
-
SHA512
4d3368695962783cc563be9a783dfa3a07e11d259f8eda4be3a6d4362226eb3e343f699b24bdc985a709bc9533fff2fb189c160dbb65e3d5333b1b77a4640160
-
SSDEEP
6144:ANeZHRxXIP0knr07RTMjZJeurnQB2uDG8d7bjYNDUo0xIjgMyHdCwEzxIS9Onnkv:ANOk8RuZtsBbDG8d73VIcM7t9+njAs6n
Static task
static1
Behavioral task
behavioral1
Sample
scan_pictures.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
hzb3
BVGWUXYpaaEaNSjsCHhJnDJz463cqQ==
CEqdZb0KaOLLbWqrDVTgc20=
nBv0jSFiQHxtE6awQnm2
E1sGpCJYtB8ImaguUyF6yQ==
PMBND7LzJGZH7CXulclbs2c=
u9zzlFGDXo6LLbGwQnm2
SaJjLbtVlMgsP5ZQRj4=
wckwEbwBbKA2X3g=
rPxB8ePUxfu4pilu
S562QFeKY5P//qawQnm2
BkEfWXZuY3ihKW8=
ZanakqMxkP7VdNfWdD4FGDqF
PYYbtzdINC1J0OYzQCk=
Fmg9LBxaPQ==
4eXWfoC06yGAkQ0l+Txs2w==
n68j2X6+CIhsD5GiCMYBsHI=
hRv6hpW3qfLbdI1XJ/J825G1TslJ+1JE
X6PAVGfwPHihKW8=
7zn1tkuDaZ2FKbGwQnm2
lB0m5ghWsSmMpIUS8EBM31l/463cqQ==
l9+AFK8Njc9C
RHkS2TSQ5mg=
+5d2+2EBePdmgUC4juLwhAozwBpJ+1JE
2CDJYHKCU33wHDf71wJasmU=
nOqcQcJNpQHtbLWtBk6B2BKC3nGu
5DrpfemL/GBR0+YzQCk=
1WBB2lWMbJaEFGVBEOhyzUGmO/wE8VVM
j6alTVV9wEa5160IUpLQ4wGC3nGu
4mh8GB+9K6OACTgF3wJasmU=
IDAKqyiqloA2Vyh7
O5Hjrs4LFfldbw==
U23Oc3SokdECZV7qyA==
+5qKLrABnAVb
HqQp24tAsiVIlTFz
YnBwLU2p+DdB2OYzQCk=
1tpoQtS08Gs=
5F1WUyajTZFzCmc=
nNJ9DTd1pOVFbUD12B7mUGCy83+3
RZ/KhZ/MvelKIlvryg==
mSq9dhWVjtisPVfshRsqzA==
GZeCIyVZtBhrh1nghRsqzA==
fbsOq3144mk+zeYzQCk=
rvwSr/PIk9i7QU+gjWuh
NjFwBNS08Gs=
y0haCyimjnihKW8=
Yqh6Mmu8+DOi06ovC2qA4cEFLg==
reumUsWxl8U3FkMKJ5lrxA==
n64VtWoYWqwdPv1b5kB80g6C3nGu
+zn0sPpKryNIlTFz
DlDKncH2Ffldbw==
G8q27dcW8zwfxhUgggJasmU=
VKlL8eYBnAVb
uQypIaJEtz2k1NOdhL+QsitOoRuYxuY=
TI5YIL0L+yEMXvwt3Q==
OoJBFc4aA0E81eYzQCk=
4pxm7haZ2VFG5R/w0wJasmU=
YK5Q+7T0vu3eX5ltUCKi+JquRsVJ+1JE
sMgkwGqEXZF5Hq2wQnm2
kwR4EJKBvwhZ
2zJV8en9zOpLIlvryg==
SclaLzK/GpB+LY6f9kHHThBxbDE=
WaLWiI2VdcKtT3h7mr7P4HI=
NYCpQw8uBu/EayWgjWuh
S5jus88LFfldbw==
vapes-shop.com
Extracted
xloader
3.8
hzb3
BVGWUXYpaaEaNSjsCHhJnDJz463cqQ==
CEqdZb0KaOLLbWqrDVTgc20=
nBv0jSFiQHxtE6awQnm2
E1sGpCJYtB8ImaguUyF6yQ==
PMBND7LzJGZH7CXulclbs2c=
u9zzlFGDXo6LLbGwQnm2
SaJjLbtVlMgsP5ZQRj4=
wckwEbwBbKA2X3g=
rPxB8ePUxfu4pilu
S562QFeKY5P//qawQnm2
BkEfWXZuY3ihKW8=
ZanakqMxkP7VdNfWdD4FGDqF
PYYbtzdINC1J0OYzQCk=
Fmg9LBxaPQ==
4eXWfoC06yGAkQ0l+Txs2w==
n68j2X6+CIhsD5GiCMYBsHI=
hRv6hpW3qfLbdI1XJ/J825G1TslJ+1JE
X6PAVGfwPHihKW8=
7zn1tkuDaZ2FKbGwQnm2
lB0m5ghWsSmMpIUS8EBM31l/463cqQ==
l9+AFK8Njc9C
RHkS2TSQ5mg=
+5d2+2EBePdmgUC4juLwhAozwBpJ+1JE
2CDJYHKCU33wHDf71wJasmU=
nOqcQcJNpQHtbLWtBk6B2BKC3nGu
5DrpfemL/GBR0+YzQCk=
1WBB2lWMbJaEFGVBEOhyzUGmO/wE8VVM
j6alTVV9wEa5160IUpLQ4wGC3nGu
4mh8GB+9K6OACTgF3wJasmU=
IDAKqyiqloA2Vyh7
O5Hjrs4LFfldbw==
U23Oc3SokdECZV7qyA==
+5qKLrABnAVb
HqQp24tAsiVIlTFz
YnBwLU2p+DdB2OYzQCk=
1tpoQtS08Gs=
5F1WUyajTZFzCmc=
nNJ9DTd1pOVFbUD12B7mUGCy83+3
RZ/KhZ/MvelKIlvryg==
mSq9dhWVjtisPVfshRsqzA==
GZeCIyVZtBhrh1nghRsqzA==
fbsOq3144mk+zeYzQCk=
rvwSr/PIk9i7QU+gjWuh
NjFwBNS08Gs=
y0haCyimjnihKW8=
Yqh6Mmu8+DOi06ovC2qA4cEFLg==
reumUsWxl8U3FkMKJ5lrxA==
n64VtWoYWqwdPv1b5kB80g6C3nGu
+zn0sPpKryNIlTFz
DlDKncH2Ffldbw==
G8q27dcW8zwfxhUgggJasmU=
VKlL8eYBnAVb
uQypIaJEtz2k1NOdhL+QsitOoRuYxuY=
TI5YIL0L+yEMXvwt3Q==
OoJBFc4aA0E81eYzQCk=
4pxm7haZ2VFG5R/w0wJasmU=
YK5Q+7T0vu3eX5ltUCKi+JquRsVJ+1JE
sMgkwGqEXZF5Hq2wQnm2
kwR4EJKBvwhZ
2zJV8en9zOpLIlvryg==
SclaLzK/GpB+LY6f9kHHThBxbDE=
WaLWiI2VdcKtT3h7mr7P4HI=
NYCpQw8uBu/EayWgjWuh
S5jus88LFfldbw==
vapes-shop.com
Targets
-
-
Target
scan_pictures.exe
-
Size
370KB
-
MD5
8de66376e7ec767b186df680b27a9333
-
SHA1
73ed9713241c33e165dd3909abf94e22f4b7f39d
-
SHA256
4eaa6cbb07ff01de61ba87d140ca4dcd5c4054f9796bc6c15e6946ef484991ff
-
SHA512
4d3368695962783cc563be9a783dfa3a07e11d259f8eda4be3a6d4362226eb3e343f699b24bdc985a709bc9533fff2fb189c160dbb65e3d5333b1b77a4640160
-
SSDEEP
6144:ANeZHRxXIP0knr07RTMjZJeurnQB2uDG8d7bjYNDUo0xIjgMyHdCwEzxIS9Onnkv:ANOk8RuZtsBbDG8d73VIcM7t9+njAs6n
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-