General
-
Target
Order_088067.exe
-
Size
1.1MB
-
Sample
221125-pq7caagf67
-
MD5
d997a93c96c04fccf6ebe280ab6b025b
-
SHA1
27627f774f7a30428e4a7be77a49f413fd16f740
-
SHA256
ebb76e46e178491fd48787e80ce952910124d6f1a00c92744a5f84278192030c
-
SHA512
abe758baa50d9929fd364ac68559b89b310db4e2805bef1e909e4f9ec0a3d941b9298cc1693b590265a92e6e21459abda1e5b90ec5816d37ab7a23d7711310b1
-
SSDEEP
24576:LAOcZXMu3khBQ8KQO2qnQP4KnmdMLFspB6Q7CqFlF:NO4K/QRnmdMLE8Q7h
Static task
static1
Behavioral task
behavioral1
Sample
Order_088067.exe
Resource
win7-20220812-en
Malware Config
Extracted
formbook
4.1
nurs
caixinhascomcarinho.com
abinotools.com
oporto-tours.com
iruos.com
yesmamawinebar.com
wwwscu.com
habit2impact.com
antigenresearch.com
ux4space.com
diarypisces.com
cryptopers.com
lovingmoreband.com
beerwars.net
ascariproject.site
livesoccerhd.info
bluestardivingschool.com
pluik.com
snorrky.space
lcoi9.com
phantomxr.com
billingandinvoicing-d.space
sdcvbk.online
ozoraa.tech
chroniclesmagazine.net
hlamarwillis.com
tavolosmart.com
petrouzinexmail.com
nord-income.com
boatlifestyle.life
kangenionizedwater.com
cassandrestlouis.com
nicodemusandcrow.com
yodercontractors.com
trendingwithtom.com
amazondeserthotsprings.com
ietsiemooishop.com
yuqifudemao.online
rdf-group.com
jukerounisexsalon.com
lunarphase-aroma.com
charmapa.com
pimcoclients-au.com
denmarktennessee.com
practicalfpa.biz
mdjwa.com
aerobalear.com
hotgirlseeking.online
upscalee.com
northerntohoku-cartours.com
bestcomposable.com
hgjjglq.com
biggabytes.com
positiveenergyart.com
gastries.info
jamestaylorcreative.com
oolsoojeed-ihissoavaj.online
teoshotthis.com
freetinytools.com
keyupstudio.com
nakiavolaris.store
lifewithlenaivie.com
meysisupplierberas.com
akannroyal.xyz
cultivayoga.store
truckdued.com
Targets
-
-
Target
Order_088067.exe
-
Size
1.1MB
-
MD5
d997a93c96c04fccf6ebe280ab6b025b
-
SHA1
27627f774f7a30428e4a7be77a49f413fd16f740
-
SHA256
ebb76e46e178491fd48787e80ce952910124d6f1a00c92744a5f84278192030c
-
SHA512
abe758baa50d9929fd364ac68559b89b310db4e2805bef1e909e4f9ec0a3d941b9298cc1693b590265a92e6e21459abda1e5b90ec5816d37ab7a23d7711310b1
-
SSDEEP
24576:LAOcZXMu3khBQ8KQO2qnQP4KnmdMLFspB6Q7CqFlF:NO4K/QRnmdMLE8Q7h
-
Formbook payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-