Overview

overview

10

Static

static

HAWB AND INV.exe

windows7_x64

10

HAWB AND INV.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    HAWB AND INV.exe

  • Size

    724KB

  • Sample

    210503-dv64v87372

  • MD5

    42662765a94ce5ece11529509f937711

  • SHA1

    da57dd4c137c47fc9b906caaf067c6ed13fa2da6

  • SHA256

    2138325dd5e2825ee4086187a944af336476b0327e1ddae7563bb24523836e08

  • SHA512

    101d7bb5f778e779133f005c801fa26cf1bc147fed9f2774808526c50b3ae8e12863bc7ee3dfb060153d4b0b3a5ef66f357e44d477e1558060fe54df990b4b95

Score
10/10
xloaderevasionloaderrat

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.alldaazz.com/maw9/

Decoy

jaimericart.com

mayavantcard.com

romanzava.site

forefrontunderground.com

grafikirmarketing.com

airpoppoff.com

captureq.com

vph.ventures

historiclocation.com

theoxfordway.com

springersells.com

huther.mobi

networkingmaderas.com

reggatech.com

dollfacela.com

moneycrypt.net

calidad-precio.net

hamnsk165.com

victoriabrownrealtor.com

itechfreak.com

Targets

    • Target

      HAWB AND INV.exe

    • Size

      724KB

    • MD5

      42662765a94ce5ece11529509f937711

    • SHA1

      da57dd4c137c47fc9b906caaf067c6ed13fa2da6

    • SHA256

      2138325dd5e2825ee4086187a944af336476b0327e1ddae7563bb24523836e08

    • SHA512

      101d7bb5f778e779133f005c801fa26cf1bc147fed9f2774808526c50b3ae8e12863bc7ee3dfb060153d4b0b3a5ef66f357e44d477e1558060fe54df990b4b95

    Score
    10/10
    xloaderevasionloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Xloader Payload

      rat

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks