General

  • Target

    inquiry10204168.xlsx

  • Size

    2.4MB

  • Sample

    210305-h1dkceqq4n

  • MD5

    d21391378bff7acab49dfce8761978f1

  • SHA1

    c4a02857537b6b300f7ad279a6fe5660a473bda2

  • SHA256

    0944f78b8f2bd0e3a08c56793f90cc82ac064789018cf04a2fde5476055d1214

  • SHA512

    b2d7100141d27f01f3bf369a41b143350f94d01cb923995edd028d0c148e6b97660164f8d9b610cecde22d28db1dccc979f5942adc3bbd65f3d41e5396c08edb

Score
10/10

Malware Config

Extracted

Family

xloader

C2

http://www.856380692.xyz/nsag/

Decoy

usopencoverage.com

5bo5j.com

deliveryourvote.com

bestbuycarpethd.com

worldsourcecloud.com

glowtheblog.com

translations.tools

ithacapella.com

machinerysubway.com

aashlokhospitals.com

athara-kiano.com

anabittencourt.com

hakimkhawatmi.com

fashionwatchesstore.com

krishnagiri.info

tencenttexts.com

kodairo.com

ouitum.club

robertbeauford.net

polling.asia

Targets

    • Target

      inquiry10204168.xlsx

    • Size

      2.4MB

    • MD5

      d21391378bff7acab49dfce8761978f1

    • SHA1

      c4a02857537b6b300f7ad279a6fe5660a473bda2

    • SHA256

      0944f78b8f2bd0e3a08c56793f90cc82ac064789018cf04a2fde5476055d1214

    • SHA512

      b2d7100141d27f01f3bf369a41b143350f94d01cb923995edd028d0c148e6b97660164f8d9b610cecde22d28db1dccc979f5942adc3bbd65f3d41e5396c08edb

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks