Overview

overview

10

Static

static

10

40HQ_of_CI...3.docx

windows7_x64

10

40HQ_of_CI...3.docx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40HQ_of_CI_PL_SC_HR210503.docx

  • Size

    10KB

  • Sample

    210503-zl4vg68bra

  • MD5

    78e85cb8cd9169dfe6fe6ddcf4090a97

  • SHA1

    6ca04ffc772794b12f4b6c724387823c185cce6e

  • SHA256

    ab80b9b17c044eeed0605980caeaf6617c48f04d4f11a5f19d9a65256a940e95

  • SHA512

    d330a14930f4fe9e74a0973e261bd060844b62211fa00f316c4d8233907a7cd845b6782a2cb646c5eb33246cad65d9f41dc42c57d57401f5ec0425e686e3256d

Score
10/10
xloaderloaderratwebsettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

http://107.173.219.80/prf/regasm.dot

Extracted

Family

xloader

Version

2.3

C2

http://www.stonescapes1.com/de92/

Decoy

zindaginews.com

tyelevator.com

schustermaninterests.com

algemixdelchef.com

doubscollectivites.com

e-butchery.com

hellbentmask.com

jumbpprivacy.com

teeniestiedye.com

playfulartwork.com

desertvacahs.com

w5470-hed.net

nepalearningpods.com

smoothandsleek.com

thecannaglow.com

torrentkittyla.com

industrytoyou.com

raquelvargas.net

rlc-nc.net

cryptoprises.com

Targets

    • Target

      40HQ_of_CI_PL_SC_HR210503.docx

    • Size

      10KB

    • MD5

      78e85cb8cd9169dfe6fe6ddcf4090a97

    • SHA1

      6ca04ffc772794b12f4b6c724387823c185cce6e

    • SHA256

      ab80b9b17c044eeed0605980caeaf6617c48f04d4f11a5f19d9a65256a940e95

    • SHA512

      d330a14930f4fe9e74a0973e261bd060844b62211fa00f316c4d8233907a7cd845b6782a2cb646c5eb33246cad65d9f41dc42c57d57401f5ec0425e686e3256d

    Score
    10/10
    xloaderloaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Abuses OpenXML format to download file from external location

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks