General

  • Target

    Copia_de_pago_12_03.xlsm

  • Size

    197KB

  • Sample

    210312-5d3mrbpb6s

  • MD5

    b5192b8607edf0e0d159f5510576cf24

  • SHA1

    ea830c1f6a158b362cdfd7a1c9ac250efe2143bf

  • SHA256

    03e7588bbb5ace7f22485dee84bf149aa8129504b19b3727bf24ae8b1afd506c

  • SHA512

    3d5548ddb32670faf5df4a5a74c8c766268990c9cd4edafe41b739f352beb0c9927b89abefdc248a65f1f224622d8681d6ba85468331831ca7e0a519e642b4c4

Score
10/10

Malware Config

Extracted

Family

xloader

C2

http://www.basiclablife.com/8zdn/

Decoy

yourherogarden.net

onlineharambee.net

cerrajeriaurgencias24horas.com

distritoforex.com

verifyclientserverssr.com

dandwg.com

co2-zero.global

joshssl.com

meckwt.com

theammf.com

rawclectic.com

gzgnetwork.com

richmondavenuecoc.com

nicolelyte.com

thetinyclosetboutique.com

llt-group.net

seven-sky-design.com

joganifinancialgrp.com

elementsvapes.com

bingent.info

Targets

    • Target

      Copia_de_pago_12_03.xlsm

    • Size

      197KB

    • MD5

      b5192b8607edf0e0d159f5510576cf24

    • SHA1

      ea830c1f6a158b362cdfd7a1c9ac250efe2143bf

    • SHA256

      03e7588bbb5ace7f22485dee84bf149aa8129504b19b3727bf24ae8b1afd506c

    • SHA512

      3d5548ddb32670faf5df4a5a74c8c766268990c9cd4edafe41b739f352beb0c9927b89abefdc248a65f1f224622d8681d6ba85468331831ca7e0a519e642b4c4

    Score
    10/10
    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks