Overview

overview

10

Static

static

PI_55034455.xlsx

windows7_x64

10

PI_55034455.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PI_55034455.xlsx

  • Size

    1.3MB

  • Sample

    210826-q7zh934h42

  • MD5

    b677902aa5e2126451dc6258e35d99f5

  • SHA1

    2325d8d4c12de4fcd6b29c152cf4017983730198

  • SHA256

    4b2e04f07ddbbc25db9260eac2de0d8ce45488b3a2c80de9c384b1abb014bbbd

  • SHA512

    e7b2fb8dad97742f85aa935bcde585d1876c79600804f969c8667c2011250b194fb3dc2b505d444a8210590182b2213ace2c09e5fed7f9e370d955796f0fd8d8

Score
10/10
modiloaderxloaderecuuloaderpersistenceratsuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ecuu

C2

http://www.polaritelibrairie.com/ecuu/

Decoy

buoy8boats.com

tomrings.com

o-distribs.com

majesticgroupinc.com

tehridam.com

yzwjtoys.com

castro-online.run

aquarius-twins.com

jamesrrossfineart.com

pavarasupatthonkol.com

rivermarketdentistry.com

gyiblrjd.icu

redcountrypodcast.com

youngbrotherspharmacyga.com

betsysobiech.com

neocleanpro.com

ingpatrimoine.com

mustangsallytransportation.com

jsvfcxzn.com

krsfpjuoekcd.info

Targets

    • Target

      PI_55034455.xlsx

    • Size

      1.3MB

    • MD5

      b677902aa5e2126451dc6258e35d99f5

    • SHA1

      2325d8d4c12de4fcd6b29c152cf4017983730198

    • SHA256

      4b2e04f07ddbbc25db9260eac2de0d8ce45488b3a2c80de9c384b1abb014bbbd

    • SHA512

      e7b2fb8dad97742f85aa935bcde585d1876c79600804f969c8667c2011250b194fb3dc2b505d444a8210590182b2213ace2c09e5fed7f9e370d955796f0fd8d8

    Score
    10/10
    modiloaderxloaderecuuloaderpersistenceratsuricatatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Scripting

1
T1064

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks