General

  • Target

    Quotation Zhejiang.xlsx

  • Size

    2.5MB

  • Sample

    210408-twsk5x81kx

  • MD5

    a783de23277908ff94909e76e010e774

  • SHA1

    1439eb6b441bbe2723cb05829011a9fd415caafb

  • SHA256

    0d5ed941ed1f15a168cdd5be0abc6b9a0806ae42c267f7eb5ca35f5697fdf346

  • SHA512

    7d31e27c69bad458c21bd8775970645c0b257b2e8e0e592b1b40bd79725544d98643ae96d51a4322dcc88f749522d245ac9821238b8421c63a3a7715ef7bac85

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.stone-master.info/aqu2/

Decoy

thesixteenthround.net

nagoyadoori.xyz

bipv.company

imaginus-posters.com

heliumhubs.com

baohood.com

thesahwfam.com

susanlevinedesign.com

pdxcontracttracer.com

shopathamiltons.com

qcmax.com

didongthongminh.store

igotbacon.com

5915599.com

seacrestonsietakey.com

bumiflowers.com

arcax.info

lfhis.com

mlqconsultores.com

duilian2013.com

Targets

    • Target

      Quotation Zhejiang.xlsx

    • Size

      2.5MB

    • MD5

      a783de23277908ff94909e76e010e774

    • SHA1

      1439eb6b441bbe2723cb05829011a9fd415caafb

    • SHA256

      0d5ed941ed1f15a168cdd5be0abc6b9a0806ae42c267f7eb5ca35f5697fdf346

    • SHA512

      7d31e27c69bad458c21bd8775970645c0b257b2e8e0e592b1b40bd79725544d98643ae96d51a4322dcc88f749522d245ac9821238b8421c63a3a7715ef7bac85

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks