Overview

overview

10

Static

static

10

DHL Shippi...s.docx

windows7_x64

10

DHL Shippi...s.docx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL Shipping doc & Shipment tracking details.docx

  • Size

    10KB

  • Sample

    210408-9h7wsybb7e

  • MD5

    30909a9932c77fb923a96b1b090b4806

  • SHA1

    2bbe988290a47de63763796db6a39de0e268a5cf

  • SHA256

    23e650ad3f02ea9f4a402bf5e719d745b7c307c34fd8915045c79d51aab48741

  • SHA512

    3a42c4e4384bed6fe50d3ac3cc02d65108b315ae899abea355792d2f1063be415d80aa1786bac9053a5b7a5f622491fcc5e53cb8c222c252a430b9af0c034836

Score
10/10
xloaderloaderratwebsettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

http://23.95.122.24/..-.-.-.-.-.-.-.-.-.-.-._---------_-------_-------....-.-/................................................................................dot

Extracted

Family

xloader

Version

2.3

C2

http://www.scott-re.online/nnmd/

Decoy

bongwater.life

regalparkllc.com

gyanankuram.com

quehaydecenarhoy.com

israeldigitalblog.net

gatewaygaurdians.com

krphp.com

domentemenegi47.com

fjsibao.com

yetbor.com

goldenvalueable.com

finalexam-thegame.com

buyeverythingforbaby.com

phillydroneservices.com

xn--kck4cd0r.net

suns-brothers.com

xn--80aaxkmix.xn--p1acf

pjsgsc.com

7985699.com

blackmantech.fitness

Targets

    • Target

      DHL Shipping doc & Shipment tracking details.docx

    • Size

      10KB

    • MD5

      30909a9932c77fb923a96b1b090b4806

    • SHA1

      2bbe988290a47de63763796db6a39de0e268a5cf

    • SHA256

      23e650ad3f02ea9f4a402bf5e719d745b7c307c34fd8915045c79d51aab48741

    • SHA512

      3a42c4e4384bed6fe50d3ac3cc02d65108b315ae899abea355792d2f1063be415d80aa1786bac9053a5b7a5f622491fcc5e53cb8c222c252a430b9af0c034836

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Abuses OpenXML format to download file from external location

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks