General

  • Target

    W029621.xls

  • Size

    342KB

  • Sample

    210420-g4p997k5qj

  • MD5

    dcb68156748e6c71ef5df8d9dddb3ff6

  • SHA1

    ffee33ce2a6b4523a5f7323ca00a7347b1dc986a

  • SHA256

    7da573f1004e4bb9c6979a6ccca45da8998deaa92dd1e318d128ff4888212536

  • SHA512

    eb24bd095799613417aaf3b0d8344af0cfce01d9700379e5e3ed7b8eff3f0d5abd3606866704a871aa0e2469b84ca24ce2416a590711329695ed0e700276186e

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.preciousvessel.com/spj6/

Decoy

kdelchev.com

myriamward.com

megaconsulting.pro

sunglassesmu.com

hispanavisionct.com

bodaciousbuffy.com

chuhuu.com

jerexcursion.com

merkabahindustries.com

shaktiroommontreal.com

violet-moon-interior-design.com

pyrosunited.com

89xs.xyz

bestchatonline.com

cubiscoin.com

ianzu.com

playersresearch.com

digitalvl.com

baans-barw.com

yuria-rain.com

Targets

    • Target

      W029621.xls

    • Size

      342KB

    • MD5

      dcb68156748e6c71ef5df8d9dddb3ff6

    • SHA1

      ffee33ce2a6b4523a5f7323ca00a7347b1dc986a

    • SHA256

      7da573f1004e4bb9c6979a6ccca45da8998deaa92dd1e318d128ff4888212536

    • SHA512

      eb24bd095799613417aaf3b0d8344af0cfce01d9700379e5e3ed7b8eff3f0d5abd3606866704a871aa0e2469b84ca24ce2416a590711329695ed0e700276186e

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Tasks