Overview

overview

10

Static

static

Payment_Co...1.xlsx

windows7_x64

10

Payment_Co...1.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment_Confirmation_1.xlsx

  • Size

    1.2MB

  • Sample

    210819-fs5ljrd5j6

  • MD5

    dc861bd05a3e4424f31186fb19c7a2f1

  • SHA1

    0dc660e9a05ff7049f08a052cd7883a7d776f266

  • SHA256

    4c77f00fc7d1b712acbfe44697e36ed638465da6de7dcbef3bb59056358cffc5

  • SHA512

    e490c0d01b8892f7e921fee73024cfbca62bca621e6cc7a6f0e8a4fb80a0e0285a4931e9077ee9a796832c0ffcca05aac185465828d0788a9be7cc84064c822d

Score
10/10
modiloaderxloader6mamloaderpersistencerattrojan

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

6mam

C2

http://www.mobiessence.com/6mam/

Decoy

gxduoke.com

lawmetricssolicitors.com

e-bizbox.com

ilovemehoodie.com

marcuslafond.com

bransolute.com

kuppers.info

kykyryky.art

vavasoo.com

tlamj.com

besport24.com

hibachiexpressnctogo.com

elglink99.com

maximos.world

uniamaa.com

aladinfarma.com

opticatervisof.com

delhibudokankarate.com

juliekifyukstyle.com

fuzhourexian.com

Targets

    • Target

      Payment_Confirmation_1.xlsx

    • Size

      1.2MB

    • MD5

      dc861bd05a3e4424f31186fb19c7a2f1

    • SHA1

      0dc660e9a05ff7049f08a052cd7883a7d776f266

    • SHA256

      4c77f00fc7d1b712acbfe44697e36ed638465da6de7dcbef3bb59056358cffc5

    • SHA512

      e490c0d01b8892f7e921fee73024cfbca62bca621e6cc7a6f0e8a4fb80a0e0285a4931e9077ee9a796832c0ffcca05aac185465828d0788a9be7cc84064c822d

    Score
    10/10
    modiloaderxloader6mamloaderpersistencerattrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Scripting

1
T1064

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks