General
-
Target
Order list.doc
-
Size
32KB
-
Sample
221206-nz6axaef99
-
MD5
4fb9a0f253fae2dcd2ebd9327855706e
-
SHA1
61f9c00a4f2cb2c5acefc497bbe9c035ef4b5b8b
-
SHA256
306caca869e40f7d5a867f3ab7e91493886210888715b26f55578517a75889ad
-
SHA512
425f9fdf36be24da077f907cfda97c7dd4f24a8995cf2902bdd0526490667e7efc5c8387c294a279fd457f833fa660d0067d42282096b2bb15a9cd16415e9ef0
-
SSDEEP
768:XFx0XaIsnPRIa4fwJMFM4BZj163DLZQexNoGF88fVvif:Xf0Xvx3EM3BZY332ANdvif
Static task
static1
Behavioral task
behavioral1
Sample
Order list.rtf
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Order list.rtf
Resource
win10v2004-20220812-en
Malware Config
Extracted
formbook
w086
F6jSz+l9QmYXguG/xUipf/6ixrik
cQZre8twfBVOOJgLenGTGA==
pG5kW2/wqwEOCVxZ
KORXeYwt7wF8J3BR
HL0ZdBMjeHet
TR57b4Yi6wJ8J3BR
fRyK2yaqeDRGHiQTTw==
RwhsqfRxABNZS59wenGTGA==
GuZaY4H4ahcWKjUdVg==
I5C4/Wyz3fglj+o=
Te5QPEu3NjZ0P58LenGTGA==
M9YJLwifZIi9pfnj2Nj/kA6+ZlU=
c/JFdRndG8f/HiQTTw==
nMmcD1UjeHet
QWR7+9Rh8/l8J3BR
9MD+BzOyI6mXtM4w6LMyEA==
WABgaYPqdJzl2TviGbdH
02OexRebqj3+U2kXhQ0=
j17M2R3/fQwFHiQTTw==
dQpReYss5/l8J3BR
tiaHq71bHDzrXWkXhQ0=
pks7Z4EmPunm2e0ZDK5F
EKYCS50qID/AL4HlVNUIg0XJdFQ=
iCibxeJa5ARNSauNiDOMmBT/
yZHHww7dJM8EHiQTTw==
HbLe2y3prvglj+o=
dVJttQWbovglj+o=
PNU9jC3aosZHn/dewVKhOvPC8tWu
flK4vRfTDsWS7U/JQQoNoDI=
SG097d7jZ8zPlv0=
jildmuNaT3ndPI4LenGTGA==
M8cbIW9BjgwJHiQTTw==
nz6k8Ydf0cxaq/c=
tnrjNokIeQz39UHiGbdH
GJD0UP/vY3uw
yE6h6o1UGTvtXWkXhQ0=
LtxFZHfxbgn95SwTWAE2Sml55w==
rJ2BASXOQZ/Hnw==
7IXl+gV8iRTfWq7mqBU=
fRpdr0gmrlN8J3BR
Pe1BOFsjeHet
VhhdBl9AL2ez
agpovx6sPPHsyhwQDvlqRWRq4A==
2HDY8QKAKT24N46HenGTGA==
KdZAoDfxvDAtDWtZ
6sJYfcmQ43FZM4Z1q3PJcaiOi0CeDw==
khBpyO0KjDxJHiQTTw==
GPZiV8d80sX++1k7R9cn58qr6A==
+sdAldR8R5jdtM4w6LMyEA==
kjRknj/6LMB070Q9NlSVDw==
7oz0SZRADjdrUaqax7S2ozCm8k+qEg==
u4LngJ/1QZ/Hnw==
rSJUnvl4giPmirwliAM7vzo=
0kSk9EsjeHet
zl6gy9h22Hx+b9TVwlbTnM6YviaYRp/FYg==
/qn8dVEjeHet
BpH1R+W9RkuBYriychlArMmp6g==
HOdOcL1wtVIbfN5E8woNoDI=
41rBwtJN2Nt4/V3DNgoNoDI=
5HGl16E9+wV8J3BR
IMUfc0PAT1eIa8e1ojuMmBT/
JM4jYwHVU/0C3y8ZDvlqRWRq4A==
1WfCyxTOQZ/Hnw==
gRRmp/tz4nFcN4BwenGTGA==
re-curve.tech
Targets
-
-
Target
Order list.doc
-
Size
32KB
-
MD5
4fb9a0f253fae2dcd2ebd9327855706e
-
SHA1
61f9c00a4f2cb2c5acefc497bbe9c035ef4b5b8b
-
SHA256
306caca869e40f7d5a867f3ab7e91493886210888715b26f55578517a75889ad
-
SHA512
425f9fdf36be24da077f907cfda97c7dd4f24a8995cf2902bdd0526490667e7efc5c8387c294a279fd457f833fa660d0067d42282096b2bb15a9cd16415e9ef0
-
SSDEEP
768:XFx0XaIsnPRIa4fwJMFM4BZj163DLZQexNoGF88fVvif:Xf0Xvx3EM3BZY332ANdvif
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-