General
-
Target
E-dekont.exe
-
Size
286KB
-
Sample
230327-f67hjsdh8v
-
MD5
7f453b503f828a474ca684b065498d01
-
SHA1
b82a91e97e1c0a23b993db56f9f6049a96580b34
-
SHA256
7cdb9e0fde39ad1578dbd905a88c8b6492a608349c0fed0c79879f5a086108e9
-
SHA512
167c0afb30cd84f7a2980f1713012f5722b00a642977cb1c7d6f353698a8d74c11cfb367585d1a93b3ff4defee526017d71240bb1331baaf2169062e258f73a3
-
SSDEEP
6144:hT5Uzm0s9s3LWwHCZwX+A6UXqc0LrWK5OcraEUq2YWPOjJlaq8+:hT55Ns3LNi+uAz6c0LrWSaxHmX8+
Static task
static1
Behavioral task
behavioral1
Sample
E-dekont.exe
Resource
win7-20230220-en
Malware Config
Extracted
formbook
4.1
be83
woodlandscancercare.org.uk
hosting-delightful.lol
bilpreco.com
diplomk-v-habarovske.com
dzgck.com
jsdappraisals.com
digitalnishant.com
bluevibesgift.com
wowchershoo.co.uk
eudoriaofficial.online
ourcampaign2024.net
barlogcode.com
calmingscents.biz
thewaterfallproject.africa
www-1911.com
cigapp.online
wooddroppers.africa
casmiya.com
haruminailbar.com
drivermindset.com
kittysew.com
codinformer.com
carextra247.co.uk
hackldesign.com
jollyshopping.shop
ibufalari.com
cloudcapgear.com
afro.fitness
liverightseniorcareinc.com
imetmyselfinyou.com
easy-exchange.net
crowesnestvenue.com
bigszeieveryone.com
excavatorsmachines.com
39gaokk.com
cedarcreekmartinsville.com
lcllog.com
buylikeking.com
ag1elite.com
burnoutstudio.co.uk
aldafiq.com
foxdamold.com
doanses2022.click
bellanight.net
mouhc.online
carlosarenas.online
datifybase.com
allinahealthaetna.rsvp
alanmockler.com
jeevesalarm.com
fixmaster.africa
goxoasantander.com
austinmotorvillage.net
homespreadmechanics.com
irvinedigitalrealty.com
lacigalerouge.com
bjhybaobiao.com
channamphat.com
hotelmalabarresort.com
honstarnet.com
3dseal.online
heureka-health.ch
efefwonder.buzz
migswelders.com
777584.com
Targets
-
-
Target
E-dekont.exe
-
Size
286KB
-
MD5
7f453b503f828a474ca684b065498d01
-
SHA1
b82a91e97e1c0a23b993db56f9f6049a96580b34
-
SHA256
7cdb9e0fde39ad1578dbd905a88c8b6492a608349c0fed0c79879f5a086108e9
-
SHA512
167c0afb30cd84f7a2980f1713012f5722b00a642977cb1c7d6f353698a8d74c11cfb367585d1a93b3ff4defee526017d71240bb1331baaf2169062e258f73a3
-
SSDEEP
6144:hT5Uzm0s9s3LWwHCZwX+A6UXqc0LrWK5OcraEUq2YWPOjJlaq8+:hT55Ns3LNi+uAz6c0LrWSaxHmX8+
-
Formbook payload
-
Checks QEMU agent file
Checks presence of QEMU agent, possibly to detect virtualization.
-
Deletes itself
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-