General
-
Target
DHL INVOICE#00834.xls
-
Size
1.1MB
-
Sample
221130-w3sg8adf65
-
MD5
47325c14fe5c22486ed25c43367779ba
-
SHA1
17a51494cd6492da17d15b40562ba223118c31f0
-
SHA256
9b81d5a774c8e6ee7bceed2661e9f58b600c75aac7027d92521201a28b7882d7
-
SHA512
81cda215b8e823836d9848a283ccb8429887a6558a5a915c65a2f67023f129251c850e6a2e00d50995fc8d171c353c44062b778dba7c73fd583f39b7d476b0ce
-
SSDEEP
24576:6L7yir5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXXmBr5XXXXXXXXXXXXUXXXXXXXSXx:G2adxl4T
Static task
static1
Behavioral task
behavioral1
Sample
DHL INVOICE#00834.xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
DHL INVOICE#00834.xls
Resource
win10v2004-20221111-en
Malware Config
Extracted
formbook
codp
WLwbp9IgDF0DRbuq
oNQ7DHBzVHVMTxxxFCORk65Z5w==
eKyDm2P0S8i8tXrGSRxyN/GB+g==
DWLDupksnDvfKi7Q7PI=
JAaYbOFx1G0f4pcM36gDB3YaG796
KWQ71Z4U7+2Nv8K72OXED5M9oe8=
YJpvEHW5TU/wL02R9TiN0A==
tpQX78fPprFMi7ocSgXfUNYKpTq33Icp
a9Z0eju3FKFA/YBy+MQfG3QaG796
uQzt58fSssDUenxacQCY2g==
vijGzYPYOfi2gxZLhlbA
kZfzlQg7IGPxc29BJA==
dcQu+blQlxGyZu7qw5P4L6s=
TTIXAcXMr85yqqvxWBMqdrw=
xZb/tyGC8sOjIS7Q7PI=
KnzenvO+cXkVS3biKfRDwJ9Q5Q==
ZqZvDt9+yYxqh1Si
vZD8CtVZigY/cqnmLA==
QJy2dd/p0MO1Ji7Q7PI=
l+Hmoea3jsiAcqnmLA==
j19MVSQr/CceRbwAwBMqdrw=
vS+9sWn2gDVJYeHZaHTPCN9ywAEKVg==
blpyOo9dQZt5ZxddwQVmww==
IOs9KPQyS0gISA==
nn/ZeuJwB9m55jogOw==
M49wUTbsPAwOcqnmLA==
WqL2DMvly8XMWUkzLPvkgjf1aM5QNRk=
fd7UqRCiNTCiTs+3
vY9pE5GVeJJKMpNw0Imsk65Z5w==
PoplGWGv//+qJC7Q7PI=
d8msQUS/1UNH
g3JQ+nF3X3cfRU7V4us=
CEaYiEEOXyvzU07V4us=
lWFpIAPKKBaU90M=
TzIO/uHUaDELiHVWcQCY2g==
C23Tr3r7VMWspGfecQCY2g==
nqSKdTr0YhS+hBlLhlbA
tqY5MRsZX3MVS0YS8eY=
9MouOBNcWth14KOG9e1CFHYaG796
pKi80FPSajXvnxxLhlbA
RBb0/dHxCF8DRbuq
H2JA8ah0Bg4ScqnmLA==
Ui6WUnCpdrSBlN+xk1450g==
dXUNxi54AIl/E/W/tLmhAJM9oe8=
g8SPLINNHWVYb9gTSBMqdrw=
ld0F/BjbTxaU90M=
jmTquCeAzJmZHGHL7sydCpM9oe8=
K25MOh0tGDTYolGNUQ1yxw==
B1Ozd8XF67PJZGdHJA==
Py0TshQX8wvo4n5WcQCY2g==
G378nwBW6hJ73dDIcfo=
lebDk/+/1UNH
sO5QF9cf+lLssy7Q7PI=
mu50P/Y9kRfOLS7Q7PI=
Akgd/+60CxK1KVo=
wxp6MYyFq4coVQ==
XinIiM8UXijMrUh19sfnOvav
N7THlsfP5amkUA==
DoafUba91Bo1xbahrLegAJM9oe8=
owwVtzbvRgDKNXLAzqwrDNGFpTe33Icp
kQMRCcXUvNWa4OrZxJFt9JM9oe8=
ViF1HZskhw7WOrenND/Q2ZVRhy+33Icp
3rGLk2t/q4coVQ==
L2/L3M8P5DMaGpN/6LvKmJM9oe8=
gameikanjoker123.com
Targets
-
-
Target
DHL INVOICE#00834.xls
-
Size
1.1MB
-
MD5
47325c14fe5c22486ed25c43367779ba
-
SHA1
17a51494cd6492da17d15b40562ba223118c31f0
-
SHA256
9b81d5a774c8e6ee7bceed2661e9f58b600c75aac7027d92521201a28b7882d7
-
SHA512
81cda215b8e823836d9848a283ccb8429887a6558a5a915c65a2f67023f129251c850e6a2e00d50995fc8d171c353c44062b778dba7c73fd583f39b7d476b0ce
-
SSDEEP
24576:6L7yir5XXXXXXXXXXXXUXXXXXXXSXXXXXXXXXmBr5XXXXXXXXXXXXUXXXXXXXSXx:G2adxl4T
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-