General

  • Target

    Shipping Documents.xlsx

  • Size

    2.2MB

  • Sample

    210408-lmjy842bg6

  • MD5

    ab599dc3956c9e72ad6187bca6d7d783

  • SHA1

    c06939ab8436da2f3c37d0cece53837960943d19

  • SHA256

    ce11e96fe93545cd9d381c440d7e172eebfe7c0e177c6485216313b144c415a3

  • SHA512

    a28926991314329da86c8e76caeb0793c1f495733fdd5d61347eba55e0e65cdea3a9a02c23d0f912c86429228ab0eef9e010f8cd64dfbccacd5bc7f234d86cb2

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.autotrafficbot.com/evpn/

Decoy

memoriesmade-l.com

babypowah.com

usinggroovefunnels.com

qapjv.com

kp031.com

kinfet.com

markmalls.com

keithforemandesigns.com

fydia.com

jesussaysalllivesmatter.com

sarachavesportela.com

standerup.com

monthlywifi.com

productsoffholland.com

newbieadvice.com

globalnetworkautomation.com

theholisticbirthco.com

physicalrobot.com

thesouthernhomesellers.com

teamcounteract.com

Targets

    • Target

      Shipping Documents.xlsx

    • Size

      2.2MB

    • MD5

      ab599dc3956c9e72ad6187bca6d7d783

    • SHA1

      c06939ab8436da2f3c37d0cece53837960943d19

    • SHA256

      ce11e96fe93545cd9d381c440d7e172eebfe7c0e177c6485216313b144c415a3

    • SHA512

      a28926991314329da86c8e76caeb0793c1f495733fdd5d61347eba55e0e65cdea3a9a02c23d0f912c86429228ab0eef9e010f8cd64dfbccacd5bc7f234d86cb2

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Command-Line Interface

1
T1059

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Tasks