General
-
Target
Copy of Georgia- Order-Dec(009).xls
-
Size
1.7MB
-
Sample
221209-mkzddafg81
-
MD5
578ded3f250d228ab69bf49250bfef8a
-
SHA1
6fae8735bc436a74e689acb67185a34b6532d20b
-
SHA256
38661fc2ada2deea37d86d9b529685fd5b9986b39d8ca08460d0ed03cb690fe7
-
SHA512
962bddc5563256a41ffe68e06ac2405baee92c8ea1da0a1b1a873b3ecc386cf3919888db6ff82fec7adbf596263e215a0af07b8da30182a07a38a3550b84b90e
-
SSDEEP
24576:mzxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDcm6Kr5XXXXXXXXXXXXUXXXXXXXrXXX3:7cKfXmX+g3Y
Static task
static1
Behavioral task
behavioral1
Sample
Copy of Georgia- Order-Dec(009).xls
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Copy of Georgia- Order-Dec(009).xls
Resource
win10v2004-20220812-en
Malware Config
Extracted
formbook
henz
IxWMb+jVsoinShuZJzk=
TPfKgQZ//oGnKr/J
EsK0WxD5kY65XOW1Td/5CxSUpCUytR7M
KebSmiCP9p8yUw==
HAt/ljkEuqMLHOLCi53Pv8MKX9qk
CY4ogZTwJc4vSw==
WWDIx5UYUDyepntE0YIAPca3/rI=
+Pkr01Lfb2rME7bL
S5nyK0p8jS2xdwQ=
W/oqvlO57LfkLcLHnQ==
zrrwtqkTLwxulm4l8FGopw==
AqucYext8bzFbOKthIm8E6gfVkUHxKY=
OfnjeDs78+RTcz4OHRl+
XKf1wwpZR5hLLjHgmUGOpQ==
JMyhSLoJPTCwn5o9zX2d8i1+
Wk54MBsDhWSVbnIRkQ==
7aaYR/tOhh9piTw5/KHSRwuK2iqgafw7pQ==
hH/EYxN+jC2xdwQ=
S0F4ORqDjS2xdwQ=
0o/UwXnuJ+sJp0cOHRl+
klE+E/jVelhT72wOHRl+
ZGvqyzaT9qfME7bL
czgajHaygm4=
KufYeyTiLhIGlzU6/38IM7IrqzhFa64=
oVNF+2VXWBL9jwGsK3Bw5TE=
iI3g6JaEalRvMDaz8AD4+vt0
nWtRAaSccRlLVg==
NtvDoS2UMcMRSA==
1t5MW/lEfjsUrFJeGXBw5TE=
UFixmi+P2cgqPRj09Sc=
MSuTonT5QhU11IGFYWKB6eJj
k4Lw3r+hTj9NF8+zgnu+Nsa3/rI=
NSN7fCqHln/S+RuZJzk=
dTUV1GY97NlVLsaSJXBw5TE=
8u5OLgNPRShyRRuZJzk=
BLTZ0G3iV0B5PvedL3Bw5TE=
ci8Y27nGCM69
JxF8W9/QoC2xdwQ=
KusZC8MsPClL1oMo8SA=
tW9XIP/VYTmVpWIDjIu1p5/ebhC9
pmc//mhFFgx3l1IOHRl+
MOsl9G5hQT6lhc0oLHWtrQ==
fXvSx46RRSiGjWphOnO0p8a3/rI=
D8Hx4JoDG+znbnIRkQ==
Dsfu2pqFJP0Kv0gX1CGX3Sw=
FcGnEr4fhW7ME7bL
hkc37Y3GF8gTMAw=
dnGZWjqPqYqgTxuZJzk=
iDEV43sIvE1j7psMiQ==
vb8qEoNQBus+mQXst1h2
46qCRt3j3cfneiudJjE=
8eoYvzW2PgDrffLWrav++Mf1TUUHxKY=
vqkFDa0HYztZ+G8ODZ7Qug==
+K/F0qEnTxACrzMR2OocXxecmq31afw7pQ==
Egwn/u1rq2uVbnIRkQ==
nFVH/3fvalaRbnIRkQ==
CvtveEUyyqUJLOiOKnBw5TE=
dmfN5LErTj9l/Icl8FGopw==
VAQtEMawYiNPaTxLIxdbpD9sZL0=
MBSMhSCOHdpCVQ==
jz95eCeaJc4vSw==
85N/Gcy+XicYq0cOHRl+
D/1B46soVTKObnIRkQ==
Hgytgwn25KqyVRuZJzk=
brennancorps.info
Targets
-
-
Target
Copy of Georgia- Order-Dec(009).xls
-
Size
1.7MB
-
MD5
578ded3f250d228ab69bf49250bfef8a
-
SHA1
6fae8735bc436a74e689acb67185a34b6532d20b
-
SHA256
38661fc2ada2deea37d86d9b529685fd5b9986b39d8ca08460d0ed03cb690fe7
-
SHA512
962bddc5563256a41ffe68e06ac2405baee92c8ea1da0a1b1a873b3ecc386cf3919888db6ff82fec7adbf596263e215a0af07b8da30182a07a38a3550b84b90e
-
SSDEEP
24576:mzxXXXXXXXXXXXXUXXXXXXXXXXXXXXXXDcm6Kr5XXXXXXXXXXXXUXXXXXXXrXXX3:7cKfXmX+g3Y
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-