General
-
Target
RFQ 8525-22.exe
-
Size
388KB
-
Sample
221128-qfhfvaah7x
-
MD5
11160a2dacd444402d8ba3d97be284ec
-
SHA1
8e4c00a7e42b4c35c57cd970d21981c7697df195
-
SHA256
fdc647398dc8d60cba61b2f6c4120c1829a78d845c3bf545ce7857380735c390
-
SHA512
1a8a2d321099b20254cb2b10965fc27038117a9444569188c5ee5a8aac87311ef08952113de554135c5c85b7068fd3ed6ad87e536977b17d17742f67eb7c952e
-
SSDEEP
6144:hBn7A5jMUCoQR7h3Xfbxp0Cw1g1+B4iX8OUYilXUqD:vrR7hn70Lg1+v8ONilXUqD
Static task
static1
Behavioral task
behavioral1
Sample
RFQ 8525-22.exe
Resource
win7-20220901-en
Malware Config
Extracted
formbook
m9ae
nWTQpX6TYm6dfT3Lcw==
7JaBLgMm8EKn2AlTy5Ksj4Jq
yWRJIhE3viQgqEpZS3o=
ES9dFo0bytF8vlvRcg==
aX/aBZn29pD+cg==
lU64sYOZV7ZVpUy1ag==
9BpOCYAPv8L8TyIFAiTp2PSqLg==
uEJ2RyQ1BcBXfFr8kT5Z1KV0
oVM42Ury9pD+cg==
0Zl3VkcuKaY+
OjZeGI8dw67Z6eWtnOoBfoI=
ytwFn9j4i+N8nKYRSgcfh3xn5LU=
xMb1+YkOyxmbxJ53JsP7Pg==
HODQpzTBS1gVoi4X0hStKQ==
fQ417ycwD+ziKt1u0hStKQ==
nsApOqE62sA8uS735uCXVP+YcrQ=
4aobG3oZ3AHqTPs=
P2LEwJatZbQZUTayTW0=
/bopO7NR6clCfT3Lcw==
bBxRRkFY01R+20pZS3o=
enylSY//R0Euo5Hc
s3hoHGn+blzIzLD2XcWsj4Jq
MvZlcWyHEnNHRGHB
qDJgM38Zlp2BriDZBnI=
JlaRDbpPJo43fT3Lcw==
aZgM/YERpLJOfT3Lcw==
dgcdTgcuKaY+
N12TQ5X0uI7/dA==
85d5Cn4gEuXNHOY=
XGyjNRUvzkzpFEb98NiZYf+YcrQ=
nUc1kamtJHlHRGHB
M+1WZ6NvT6VHRGHB
k1iSQqU6E3biHW3Ev1x/
yoeZZ9suKaY+
yiqErKzdOA==
I8FYQ4Mx9pD+cg==
e3sMggibmaRHRGHB
YBxPTjVYD4c2WVRYdfxP9f/w5W+IU0g=
A6GFXmNsA4y3ByPuEXU=
RkSck9R+79lCe5vEv1x/
c4Hf8OWx18LuWN4pPnA=
IK6UOZcpvKTL2/PbBHI=
dpbLY0FV8mxHRGHB
RoTt48Dgi/aZtJ/Ev1x/
4/FRPhpH3TPGD0uYB7Yf2PSqLg==
5A5CBZYyzanG52lgk7V7K8G4gdDu5w==
p8IpCMzdxqyj2UpZS3o=
cToa+3QRpLJOfT3Lcw==
Lat9/Yk19pD+cg==
CrjklYWQN6tXfIjEv1x/
SfQyB+TxpJSt20pZS3o=
eTEdrAOeVYJ4Cx6WSxqnYGgz01Yv7w==
NP7rnOJz7QXxQfk=
hrYdLa1V+exp20UX0hStKQ==
R+gl+MvhTQHqTPs=
CC6YqK+3hWJYpEseExvt2PSqLg==
VmybWD1f6EIreDUVP47Yw5la3rI=
Sgv5moChVKcQSZYjwYWyvbeuMw==
rtxt7QYo5mxHRGHB
cH/l/4Ecn61OfT3Lcw==
T4iddmuQEGhd1NwMviZm
cyH/sQGRb8s6e5vEv1x/
Y3DL3M3XS86ftJ7Ev1x/
U2jGyqnCYcDDJt3mAjZDxf+YcrQ=
spirituallyzen.com
Targets
-
-
Target
RFQ 8525-22.exe
-
Size
388KB
-
MD5
11160a2dacd444402d8ba3d97be284ec
-
SHA1
8e4c00a7e42b4c35c57cd970d21981c7697df195
-
SHA256
fdc647398dc8d60cba61b2f6c4120c1829a78d845c3bf545ce7857380735c390
-
SHA512
1a8a2d321099b20254cb2b10965fc27038117a9444569188c5ee5a8aac87311ef08952113de554135c5c85b7068fd3ed6ad87e536977b17d17742f67eb7c952e
-
SSDEEP
6144:hBn7A5jMUCoQR7h3Xfbxp0Cw1g1+B4iX8OUYilXUqD:vrR7hn70Lg1+v8ONilXUqD
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-