Overview

overview

10

Static

static

10

evaluation quote.docx

windows7_x64

10

evaluation quote.docx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    evaluation quote.docx

  • Size

    10KB

  • Sample

    210420-gelmm8395e

  • MD5

    bd609da0d3cc74098b2e771b8fce0915

  • SHA1

    b7058fe67f5f769995f77294975a4d8688ffa1e0

  • SHA256

    67d398e11b6229ba7fd8895f73dc96ff99fd50a2f6c7360938e0a4eb748a18e8

  • SHA512

    82ecf121b3f89055c633640e99ce62a09c9eab01588c79653b36347259d13a37883f46913b8a43b70ccc8753cf5255e02b4f546e22f2d93718e82007949fe1db

Score
10/10
xloaderloaderratwebsettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

http://23.95.122.25/-..-/......dot

Extracted

Family

xloader

Version

2.3

C2

http://www.nyclgbxyi.icu/u6nq/

Decoy

lamailefr.com

creativesword.com

mpconnextions.com

tureture-diary.net

ateamtotalcare.com

ihealthsauna.com

contex33.xyz

hotege.club

candiceco.com

southerntwistent.com

foivgohl.com

azetheelynn.art

galsmith.com

alphaquantumfunds.site

mursiony.club

ajobfit.com

resourceunits.com

metropolitanez.net

shaohuizq.com

tedbagsstore.com

Targets

    • Target

      evaluation quote.docx

    • Size

      10KB

    • MD5

      bd609da0d3cc74098b2e771b8fce0915

    • SHA1

      b7058fe67f5f769995f77294975a4d8688ffa1e0

    • SHA256

      67d398e11b6229ba7fd8895f73dc96ff99fd50a2f6c7360938e0a4eb748a18e8

    • SHA512

      82ecf121b3f89055c633640e99ce62a09c9eab01588c79653b36347259d13a37883f46913b8a43b70ccc8753cf5255e02b4f546e22f2d93718e82007949fe1db

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Abuses OpenXML format to download file from external location

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks