General
-
Target
Aztexnika Ltd BAKU Order.xls
-
Size
1.5MB
-
Sample
221206-hr3l6ade27
-
MD5
0096434371fec7c2352199a7c5d746d8
-
SHA1
42d939a4fb5bd3ab37b20239d181cac781b9ec60
-
SHA256
13cdbb613bb0df701013068c650cf252acfbd5034710710ab099d7c75fd41d30
-
SHA512
c684c087e78df4bc1e904f66bbd38b497e3475e41ea5a1db3ec847ffdb11b267a368810c6dc4ec8cbada53c365b30d318e6c169d7d5611b572ac9d0b2fd69029
-
SSDEEP
24576:XzxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDWmhxr5XXXXXXXXXXXXUXXXXXXXrXXX/:YG8VBQ6Q
Static task
static1
Behavioral task
behavioral1
Sample
Aztexnika Ltd BAKU Order.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Aztexnika Ltd BAKU Order.xls
Resource
win10v2004-20220901-en
Malware Config
Extracted
formbook
f4ca
omFHB5ajfJi1UEIEV9XcoRw=
UBjJkmQPyprdhcFF/bdCWQ==
evGKkBUj1je+otcfpw==
KgvGVeOATSt3nug0BIOm2JvOQycB
Lv6o3K0r9aSjI0lr9fg1txw=
LH1jJb/HieQpsEdqWCQTvX2PmsDVIeg=
99dte0XauJfk6Xv+uQxJFgA1gMktBA==
21FkkGB9gMniDQw2ffu6
r4lKBM/q6TZwVZfS
F+14qHeVWi56KdQ=
BgWXRsVoICMvvQ==
I+EozFl0Uy56KdQ=
xoXCgEllKEbWfjFCCLo=
qo9G1lXvvGt5GkxrLQWw
ORNlYic0PJ2ip4geEFSv
Yj+GFpvFxy0uVYx1fLI/XQ==
XL+veIKPjOTe4fjvFs+n
D2JKVAfuakXCAyoEvw==
voWJU81tH56wvt/vImbCcgVd
dVEcwFrmb8bZ4vXvFs+n
CMlcaOUF6cB+8Bnm2Kc=
NpYV3moXNE+ZQ4f9nVGCSA==
/GRkjGd1acLHyeLvImbCcgVd
R52MlF+Ag+LtFr1QKa7Zf/5a
kVD/mSO1YK75pA==
5q3IANfo/JHiDww2ffu6
4i8RFOH2ACRdhzja
VLWOSRe00XX6sNsijPzqiiWfFgf1J+g=
qnsgRFL46lWG
xo1QHOyKS9rj4fjvFs+n
mIHZlAqzS6ymmpMCU1uyZgE=
WCtjiGCFl/4JTiJ0R60=
c0vpAtZ3fY7TeLfdcnASQg==
Y87Xlic9/1+q3g/pUArVoB4=
kKOsRsf05wBOd67a
dDmgYgOZZ0aCMVwgDha4bgc=
ieXCbvcCyja+otcfpw==
Fd0XQwkTHHaBmNDvImbCcgVd
PK/M6eM8xOwqvw==
Pf0q8MdfICMvvQ==
EO8aPQwf7z2Du+XvImbCcgVd
BeUisSg/Ql6uJcg=
ay2v2pz4gomTESLosQ==
AGjX3ak2B+FyQ9ZKrQ==
Du0y0UXomyoxT4/arA8Du3FvpwE=
xhV7OrDTdonq4fjvFs+n
9+s2xTlaW66p2IAAnVkDQA==
AuS2UeN4Nsvl5vo8J67Zf/5a
B1vK2590RiUuuw==
/709BIUfMCIln8sus2u2aAM=
BMpYckjp699wVZfS
Pf2AqIscEhlpHlnV18IvVQk=
RKUTxUbz/zFroN/LLq+kIdZM
IuuiQ9pj7ZzciLVPiks4Rxc=
0KBn8XAV7NNm2xPxuA==
nv7yBtDj4UNE/ju8er1EZSanBXfyLv4=
sBgf41X1vKTwUspTsg==
5bk4+oQWD+X01tBEqQ==
c08KjxWnau8DDSsESMKNI+P5G/6/sYjU6g==
RJiyeEVj/N3rhNAW3qU=
v6O7hhQxA//+Oyq2ms9DWQ==
7MdHCYCb4OT5pg==
Je0NLgIfKIeFuyjxYD+i
68P+tIkhBdlwVZfS
inthecryptolane.com
Targets
-
-
Target
Aztexnika Ltd BAKU Order.xls
-
Size
1.5MB
-
MD5
0096434371fec7c2352199a7c5d746d8
-
SHA1
42d939a4fb5bd3ab37b20239d181cac781b9ec60
-
SHA256
13cdbb613bb0df701013068c650cf252acfbd5034710710ab099d7c75fd41d30
-
SHA512
c684c087e78df4bc1e904f66bbd38b497e3475e41ea5a1db3ec847ffdb11b267a368810c6dc4ec8cbada53c365b30d318e6c169d7d5611b572ac9d0b2fd69029
-
SSDEEP
24576:XzxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDWmhxr5XXXXXXXXXXXXUXXXXXXXrXXX/:YG8VBQ6Q
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-