General
-
Target
Quotation.exe
-
Size
1.0MB
-
Sample
221031-hwmrhaacg6
-
MD5
7fd40d18e9804f154780cbb3d2b017d8
-
SHA1
772940d64eb308d240cd205d29c4e1c5881a96b4
-
SHA256
89af280045471592c70e1c139db75bbe28354d08370ac05dff4ea8245f2088b5
-
SHA512
1cbfe6168b30db197a140ccc3fdf9b2dbe5e63db246c734d3374c0e026863bec025f7a1f104f35e77058370203b76ee3ff805c697a74d04ba2343d722d9d1154
-
SSDEEP
12288:8OHgGPilFfoqztDiGW8E2YoFhqJLNu6n0o/rUbihaIJDk:HbiAkD08rYoFALK44bisYI
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
nhg6
FSZGb3Of7ECMIOG9mh1ql/w=
DAPP3Pm63eo+zg==
khOZTuClxYsKQsZALgy3ob9TFAk=
5uWol2f/RF3CAwFd
P70LqPOi2iE9g4vpPH1Lk8E0K6tC
KBRl7TSt3eo+zg==
rqedJWUJXKkDbORa
lpORtIg8lvMKbJ77PQW9kes=
Qinv+gsohAIooqyTcfUYgZ/IVxQ=
J0L2ggPAiE2gxm4=
r/I6qOGI5noJCghf
khJg6HKM6l9okVK+pg==
HRMTK/6p3eo+zg==
HqMiuv2JaKYJCghf
+FzGYtsGTpK46OkKkh5C
BBrOUpUY91R/r8gkPwrcuw==
klWfn2smdNcqog581h6vX7px
t8uvr7+R7IPaHSOH1hqvX7px
bHdghkj64OjzY2hOLa/WObrRkkeJjQ==
s3/smhoylh1J0mPS4aDHBDRyJw==
Eu3Z//8qkb4Pgnxjs7KvX7px
Du/M2tykfsrvKI21BL4=
PSM470DF9TZfxg==
g8+4SOr4WukPPHaaxWhV
Wp6eQXMJ4vcGbPvJGeO4K2cjEQM=
sUu3agUQbwZBjWbTrA==
cD2jpmsR7f74LQOoiG5H
3uWfnmL43kmM0eYKkh5C
D8hIaSK6nOYyvuwKkh5C
2jukR8PuW9opgKsne71aPJfpk2rYfuk6bQ==
8Kn8jxXXsvtDzvYKkh5C
PBS059Wedb7mSnjpPdLzU7s0K6tC
/RMCOf+e9YCnIxQSu2marA==
wkO7TZc1jPoLNcOp4vUglpKzLw==
0IEGMPKlhU2gxm4=
2T8RCBr43vVVaf5I
fljAttGHXHWMq8RIqzxMpxG/r+LsFTk=
/og98Tea9nueONlLQD2egqUdkAs=
DakWt1Bc6TFTzA==
h1O9avS4iE2gxm4=
uu4WRzneVStU1w==
LsZmJl8YeP5Vaf5I
nHdkkYug/oK87Hcp0JSQyxC7qOLsFTk=
2oURQhXaNMIXkEcjayLqQmcjEQM=
NfVyM2uD3eo+zg==
nT20ZP8fheL5IiV4xhqvX7px
dbeCkGH4309r5gp24CCvX7px
72jolSNVrfj/NBu/Bn/evQ==
jGtO0Rey6DhVmKwRUtGvX7px
RPd7qXExmzSGlZHVuw==
X70pwhG0S4qZv2w=
9xPzBiP3SNEaU1KuDFRMtE3fYMons6VE
gXVziEtEmsbg/SeBwQGIoKj8tK01jw==
+B9xAkQQb+wSkhl/T08gEjAs9IugoA9I
KMgonCDitr/U/aiSc/bZdfnSjepK
belockUJb/okrNEwgBdDjsA0K6tC
FGDUFuN9k03/08Ks/bw=
nRGNPr25BpzvAXbgwJJK
7awA/seC0Uhr3dLAHB1ql/w=
glK6Uc2Mzma3/E196bQ=
O4Jwj11Xqv9IjWbTrA==
s++5zMnzj8z2aWY=
eJN2bFImkiB4xOAKkh5C
xsaRhotGVStU1w==
liuhejing.org
Targets
-
-
Target
Quotation.exe
-
Size
1.0MB
-
MD5
7fd40d18e9804f154780cbb3d2b017d8
-
SHA1
772940d64eb308d240cd205d29c4e1c5881a96b4
-
SHA256
89af280045471592c70e1c139db75bbe28354d08370ac05dff4ea8245f2088b5
-
SHA512
1cbfe6168b30db197a140ccc3fdf9b2dbe5e63db246c734d3374c0e026863bec025f7a1f104f35e77058370203b76ee3ff805c697a74d04ba2343d722d9d1154
-
SSDEEP
12288:8OHgGPilFfoqztDiGW8E2YoFhqJLNu6n0o/rUbihaIJDk:HbiAkD08rYoFALK44bisYI
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-