General

  • Target

    invoice.xlsx

  • Size

    2.2MB

  • Sample

    210408-5nr7dtc2ns

  • MD5

    a36c4741d6a05389b3a23ff5e5201930

  • SHA1

    aacc6bd68a6b27041ac35148de613dae5423c8a3

  • SHA256

    21f857a7997892d8c9a725f447b9b7be3ce2451a177fb6286da2deb8853208d9

  • SHA512

    71434a45fb41026a4e4c339f1f4daabc1fbf0fe8cc7c434da49bf5a2fc87584b8396dd51fed15e54d8ee0a9e6febbedd003cd377493610576d79e85429ce7d6a

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.emergencylocksmithsolutions.com/bei3/

Decoy

cananevrensigorta.com

nyayayacho.com

delta8america.com

info-age.gmbh

magetu.info

illuqon.com

bohathome.com

kellydalva.com

hinkro.com

danlanproproductions.com

skkcabed.com

masnaoto.com

sourcelibre.net

www-1360666.com

ninekimchis.com

sgxzds.com

laysflavorsicons.com

vinkle.net

anazaczarowana.com

verneil.com

Targets

    • Target

      invoice.xlsx

    • Size

      2.2MB

    • MD5

      a36c4741d6a05389b3a23ff5e5201930

    • SHA1

      aacc6bd68a6b27041ac35148de613dae5423c8a3

    • SHA256

      21f857a7997892d8c9a725f447b9b7be3ce2451a177fb6286da2deb8853208d9

    • SHA512

      71434a45fb41026a4e4c339f1f4daabc1fbf0fe8cc7c434da49bf5a2fc87584b8396dd51fed15e54d8ee0a9e6febbedd003cd377493610576d79e85429ce7d6a

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks