top title background image
flash

GRACE.exe

Status: finished
Submission Time: 2021-01-27 07:56:16 +01:00
Malicious
Trojan
Evader
FormBook

Comments

Tags

  • COVID-19
  • Formbook

Details

  • Analysis ID:
    344817
  • API (Web) ID:
    591554
  • Analysis Started:
    2021-01-27 07:56:19 +01:00
  • Analysis Finished:
    2021-01-27 08:10:01 +01:00
  • MD5:
    9034acbb2742281523525d715a4ee566
  • SHA1:
    605948c4bcd7a0290e46a37d841a09ab43fbec86
  • SHA256:
    cd63e20a002279934bc2ed4887d77605686a79f28f8114f9c01b678754a1e10a
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 43/69
malicious
Score: 6/37
malicious
Score: 20/46

IPs

IP Country Detection
216.250.110.35
Hong Kong

Domains

Name IP Detection
www.dl888.net
216.250.110.35
www.hongreng.xyz
0.0.0.0
www.ludisenofloral.com
0.0.0.0
Click to see the 8 hidden entries
www.11sxsx.com
0.0.0.0
www.sterlworldshop.com
0.0.0.0
www.kornteengoods.com
0.0.0.0
www.hotvidzhub.download
0.0.0.0
www.luxusgrotte.com
217.160.0.171
gfw.cloud301.net
141.164.47.167
shops.myshopify.com
23.227.38.74
www.internetmarkaching.com
104.21.69.246

URLs

Name Detection
http://www.dl888.net/jqc/?njq0dR=RzuPnv&JfE=fDutAcwv9Lxx6pK+U/h8/Jmgh7jy3dQeKhNoyB3Bjj0bKWR6mwge2sLPOJXFU1/1riqc
http://www.galapagosdesign.com/staff/dennis.htm
http://www.fontbureau.com
Click to see the 97 hidden entries
http://www.apache.org/licenses/LICENSE-2.0
http://www.luxusgrotte.com/jqc/www.sterlworldshop.com
http://www.sakkal.com
http://www.fitdramas.comReferer:
http://www.sandoll.co.kr
http://www.fonts.com
http://www.novergi.comReferer:
http://www.kimberlygoedhart.net
http://www.novergi.com/jqc/www.quintred.com
http://fontfabrik.com
http://www.szyulics.com/jqc/M
http://www.typography.netD
http://www.internetmarkaching.com/jqc/
http://www.registeredagentfirm.comReferer:
http://schema.org/WebPage
http://www.ludisenofloral.comReferer:
http://www.goodfont.co.kr
http://www.tiro.com
http://www.szyulics.comReferer:
http://www.wlw-hnlt.com/jqc/www.novergi.com
http://www.wlw-hnlt.com
http://www.fontbureau.com/designers?
http://www.registeredagentfirm.com/jqc/www.wlw-hnlt.com
http://www.founder.com.cn/cn
http://ns.ado/1
http://www.kornteengoods.comReferer:
http://www.hotvidzhub.download/jqc/
http://www.quintred.com/jqc/
http://www.ludisenofloral.com/jqc/
http://www.fontbureau.com/designers8
http://www.fitdramas.com/jqc/www.szyulics.com
http://www.luxusgrotte.comReferer:
http://www.internetmarkaching.com/jqc/www.registeredagentfirm.com
http://www.jiyu-kobo.co.jp/
http://www.fitdramas.com/jqc/
http://www.founder.com.cn/cn/bThe
http://www.szyulics.com
http://www.fontbureau.com/designers/cabarga.htmlN
http://www.hongreng.xyzReferer:
http://www.quintred.com
http://www.kornteengoods.com
http://www.registeredagentfirm.com
http://www.sterlworldshop.com/jqc/www.internetmarkaching.com
http://www.dl888.net
http://www.wlw-hnlt.comReferer:
http://www.dl888.netReferer:
http://www.hotvidzhub.download
http://www.sajatypeworks.com
http://www.urwpp.deDPlease
http://www.kimberlygoedhart.netReferer:
http://ns.adb
http://www.galapagosdesign.com/DPlease
http://www.ludisenofloral.com
http://crl.pki.goog/GTS1O1core.crl0
http://www.luxusgrotte.com
http://www.hongreng.xyz/jqc/
http://ocsp.pki.goog/gts1o1core0
http://www.internetmarkaching.comReferer:
http://www.szyulics.com/jqc/
http://www.founder.com.cn/cn/cThe
http://www.zhongyicts.com.cn
http://www.novergi.com
http://ns.adobe.c/g
http://www.fontbureau.com/designers
http://www.sterlworldshop.comReferer:
http://www.hongreng.xyz/jqc/www.hotvidzhub.download
http://www.kimberlygoedhart.net/jqc/
http://www.quintred.comReferer:
http://www.ludisenofloral.com/jqc/www.11sxsx.com
http://www.11sxsx.com/jqc/
http://www.kornteengoods.com/jqc/
http://www.dl888.net/jqc/www.hongreng.xyz
http://www.carterandcone.coml
http://www.fontbureau.com/designers/?
http://www.fontbureau.com/designersG
http://www.novergi.com/jqc/
http://www.11sxsx.com/jqc/www.luxusgrotte.com
http://www.fitdramas.com
http://www.internetmarkaching.com
http://www.luxusgrotte.com/jqc/
http://www.fontbureau.com/designers/frere-jones.html
http://www.11sxsx.com
http://www.wlw-hnlt.com/jqc/
http://www.registeredagentfirm.com/jqc/
http://www.sterlworldshop.com
http://www.quintred.com/jqc/www.kimberlygoedhart.net
http://www.hotvidzhub.download/jqc/www.kornteengoods.com
http://www.dl888.net/jqc/
http://pki.goog/gsr2/GTS1O1.crt0
http://www.sterlworldshop.com/jqc/
http://ns.adobe.cobj
http://www.hotvidzhub.downloadReferer:
http://www.kimberlygoedhart.net/jqc/www.fitdramas.com
http://www.hongreng.xyz
http://www.kornteengoods.com/jqc/www.ludisenofloral.com
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://www.11sxsx.comReferer:

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GRACE.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\AddInProcess32.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
#