flash

NHYGUnNN.exe

Status: finished
Submission Time: 2022-11-29 18:23:10 +01:00
Malicious
Trojan
Spyware
Evader
FormBook

Comments

Tags

  • exe
  • formbook

Details

  • Analysis ID:
    756156
  • API (Web) ID:
    1123432
  • Analysis Started:
    2022-11-29 18:23:12 +01:00
  • Analysis Finished:
    2022-11-29 18:32:48 +01:00
  • MD5:
    4f9c8432b57fa1aa875071de547ba947
  • SHA1:
    e1cc52fd851621743ba562a65161bfafed8e6b2b
  • SHA256:
    9f0d17930a9312b8d8dfb23119b57fed676a1bb15fc1582754ab94201651b221
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
11/40

IPs

IP Country Detection
38.55.236.89
United States
89.31.143.1
Germany
172.67.148.132
United States
Click to see the 3 hidden entries
54.38.220.85
France
162.213.255.142
United States
154.209.6.241
Seychelles

Domains

Name IP Detection
www.darkchocolatebliss.com
54.38.220.85
www.marketmall.digital
162.213.255.142
www.canadianlocalbusiness.com
172.67.148.132
Click to see the 3 hidden entries
www.y31jaihdb6zm87.buzz
154.209.6.241
www.ope-cctv.com
38.55.236.89
www.dersameh.com
89.31.143.1

URLs

Name Detection
http://www.darkchocolatebliss.com/4u5a/
http://www.dersameh.com/4u5a/
http://www.y31jaihdb6zm87.buzz/4u5a/
Click to see the 18 hidden entries
http://www.marketmall.digital/4u5a/?GFQD=d2J0s&l0GX=+3a19pWtZng4d4VWOC/6zX+Mtu8c5OpbMBerEkzVlILtG/Qx1KaY9rLPGpDSvmBGoypiYd46AJSA/qrnjKpXW0Tn6YTEKB73Lei52b2L1E6m
http://www.ope-cctv.com/4u5a/?GFQD=d2J0s&l0GX=PpVjBZYmN65mN/Cch5R9AL0rcoAD1LxI4sTzWlpX/jy1IrupfQnyd2YG9N8O4SbWoFYU5LvyeEtp38I885KIODFzvvn/7iZ+w1zSOWQrPDed
http://www.dersameh.com/4u5a/?l0GX=DO8SLO7p+ieBn2EC0oYIAc7qa4Xo4oKKhL6K9ytUp3CH+6ohEz4QzFDvrvyjA4KB81/r5tutyqTX+rvP+Yb6ZUWqEETpfEhrV3qJRCQNMeQd&GFQD=d2J0s
http://www.marketmall.digital/4u5a/
www.needook.com/4u5a/
http://www.darkchocolatebliss.com/4u5a/?GFQD=d2J0s&l0GX=pzMeEw2CLp9onsoEnnWxz7DjwWrmiPcXMIcMx0e8RMBYp3cHCqEf8wLsuyWBJtbijuVM0Zvb5p08kUy+wXRBHzYlQdhpzNTGfYmB4954z6O2
http://www.y31jaihdb6zm87.buzz/4u5a/?l0GX=odL+ljtDJZnnvHXGVqz6MYcHTNNFW2XRvrcwy4k99/9PUVuyA+q7lKaiZ8dF4agdsl/xXcCsqSWGiuLBWKJZJi8UVH1n7ApvhveD6637F7nt&GFQD=d2J0s
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
https://search.yahoo.com?fr=crmas_sfpf
https://ac.ecosia.org/autocomplete?q=
https://duckduckgo.com/ac/?q=
https://duckduckgo.com/chrome_newtab
http://www.autoitscript.com/autoit3/J
https://search.yahoo.com?fr=crmas_sfp

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NHYGUnNN.exe.log
CSV text
#
C:\Users\user\AppData\Local\Temp\1--Lt08NN
SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
#