General

  • Target

    Payment.xlsx

  • Size

    1MB

  • Sample

    210504-lt7esdhj4s

  • MD5

    05f49aa5b342dedd1d7b6673f3d8bc41

  • SHA1

    9ca061b9851269f8b1d2fd990ebe119903a5f0fb

  • SHA256

    3a6cc669542f5e3f9a801e9344b182c71e72396e27afbeac14eeb3d3be0b9498

  • SHA512

    dc296422a45c34721b0746b1b3b34581def5b69b081718e790d4ad75e9e67c6f1afd6a5197ee48fba9d1d7c574ac95a4797b29ad4b2bfc094580fffa78513f2b

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.cats16.com/8u3b/

Decoy

pipienta.com

wisdomfest.net

jenniferreich.com

bigcanoehomesforless.com

kayandbernard.com

offerbuildingsecrets.com

benleefoto.com

contactlesssoftware.tech

statenislandplumbing.info

lifestylemedicineservices.com

blazerplanning.com

fnatic-skins.club

effectivemarketinginc.com

babyshopit.com

2000deal.com

k12paymentcemter.com

spwakd.com

lesreponses.com

abundando.com

hawkspremierfhc.com

Targets

    • Target

      Payment.xlsx

    • Size

      1MB

    • MD5

      05f49aa5b342dedd1d7b6673f3d8bc41

    • SHA1

      9ca061b9851269f8b1d2fd990ebe119903a5f0fb

    • SHA256

      3a6cc669542f5e3f9a801e9344b182c71e72396e27afbeac14eeb3d3be0b9498

    • SHA512

      dc296422a45c34721b0746b1b3b34581def5b69b081718e790d4ad75e9e67c6f1afd6a5197ee48fba9d1d7c574ac95a4797b29ad4b2bfc094580fffa78513f2b

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks