Overview

overview

10

Static

static

FX-Transfer-Form.xlsx

windows7_x64

10

FX-Transfer-Form.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FX-Transfer-Form.xlsx

  • Size

    1.5MB

  • Sample

    210806-fwsmrzbq1a

  • MD5

    31b142cebbf97b880ead6a2dc3f415e2

  • SHA1

    b8b33c7492e0c6a25b2677f1126663d06a91fc2c

  • SHA256

    4411b4a05f3bc654dc86eba66de02e9a20751357b57a411468eee55cf3c879ec

  • SHA512

    0d4863b7184165fffa02a6bf10a5c157ed8246774cc5da7d9013d8bf448df123abaedbdf2260913b64ca52804190472fbabc483ccffc1b3cc485010d7234e325

Score
10/10
modiloaderxloader6mamloaderpersistenceratsuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

6mam

C2

http://www.mobiessence.com/6mam/

Decoy

gxduoke.com

lawmetricssolicitors.com

e-bizbox.com

ilovemehoodie.com

marcuslafond.com

bransolute.com

kuppers.info

kykyryky.art

vavasoo.com

tlamj.com

besport24.com

hibachiexpressnctogo.com

elglink99.com

maximos.world

uniamaa.com

aladinfarma.com

opticatervisof.com

delhibudokankarate.com

juliekifyukstyle.com

fuzhourexian.com

Targets

    • Target

      FX-Transfer-Form.xlsx

    • Size

      1.5MB

    • MD5

      31b142cebbf97b880ead6a2dc3f415e2

    • SHA1

      b8b33c7492e0c6a25b2677f1126663d06a91fc2c

    • SHA256

      4411b4a05f3bc654dc86eba66de02e9a20751357b57a411468eee55cf3c879ec

    • SHA512

      0d4863b7184165fffa02a6bf10a5c157ed8246774cc5da7d9013d8bf448df123abaedbdf2260913b64ca52804190472fbabc483ccffc1b3cc485010d7234e325

    Score
    10/10
    modiloaderxloader6mamloaderpersistenceratsuricatatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Scripting

1
T1064

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks