General

  • Target

    ASIANA INV- L553 PAYMENT SWIFT.xlsx

  • Size

    2.2MB

  • Sample

    210304-y49c8mymn2

  • MD5

    f0a960b15283f180e599491eb1e56be7

  • SHA1

    0477ad566347e79c96b79cbe3bc44ae9b4edcef2

  • SHA256

    2c0625d46a85f0cf4b43e08abe30cb4ea591cc0a84d9414ec21fda75bef47484

  • SHA512

    3ccf50cbf107bf30dcf96a60e11ae2e177e998bd31cfa7857746f8aa69a34c79ebff837f20230235128079fcc94750ad2fe7ee03f9e1a95d09d7b2251af0ed21

Score
10/10

Malware Config

Extracted

Family

xloader

C2

http://www.856380692.xyz/nsag/

Decoy

usopencoverage.com

5bo5j.com

deliveryourvote.com

bestbuycarpethd.com

worldsourcecloud.com

glowtheblog.com

translations.tools

ithacapella.com

machinerysubway.com

aashlokhospitals.com

athara-kiano.com

anabittencourt.com

hakimkhawatmi.com

fashionwatchesstore.com

krishnagiri.info

tencenttexts.com

kodairo.com

ouitum.club

robertbeauford.net

polling.asia

Targets

    • Target

      ASIANA INV- L553 PAYMENT SWIFT.xlsx

    • Size

      2.2MB

    • MD5

      f0a960b15283f180e599491eb1e56be7

    • SHA1

      0477ad566347e79c96b79cbe3bc44ae9b4edcef2

    • SHA256

      2c0625d46a85f0cf4b43e08abe30cb4ea591cc0a84d9414ec21fda75bef47484

    • SHA512

      3ccf50cbf107bf30dcf96a60e11ae2e177e998bd31cfa7857746f8aa69a34c79ebff837f20230235128079fcc94750ad2fe7ee03f9e1a95d09d7b2251af0ed21

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks