Overview

overview

10

Static

static

PO-A5671.xlsx

windows7_x64

10

PO-A5671.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO-A5671.xlsx

  • Size

    587KB

  • Sample

    210913-v9ez2ahcdl

  • MD5

    5e3cfa8a71fbefaeedfc0d3dbe9f7c51

  • SHA1

    34bf9b8b6c46cfe5ef624cbded56f2d59e1e59d3

  • SHA256

    6b8fb4d4e872cf97e4e4943a9eee6a6d8175f518c039fdc066caae45b21fc5a8

  • SHA512

    9cd7e84b15743bba2b420b17fdc92b7c9b79fb4ad87ab089313662a640ae080154d351522b82adb4e8d624e48d31594d2c51193ccb5b5ab3368956791bba07f5

Score
10/10
modiloaderxloaderecuuloaderpersistenceratsuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

ecuu

C2

http://www.polaritelibrairie.com/ecuu/

Decoy

buoy8boats.com

tomrings.com

o-distribs.com

majesticgroupinc.com

tehridam.com

yzwjtoys.com

castro-online.run

aquarius-twins.com

jamesrrossfineart.com

pavarasupatthonkol.com

rivermarketdentistry.com

gyiblrjd.icu

redcountrypodcast.com

youngbrotherspharmacyga.com

betsysobiech.com

neocleanpro.com

ingpatrimoine.com

mustangsallytransportation.com

jsvfcxzn.com

krsfpjuoekcd.info

Targets

    • Target

      PO-A5671.xlsx

    • Size

      587KB

    • MD5

      5e3cfa8a71fbefaeedfc0d3dbe9f7c51

    • SHA1

      34bf9b8b6c46cfe5ef624cbded56f2d59e1e59d3

    • SHA256

      6b8fb4d4e872cf97e4e4943a9eee6a6d8175f518c039fdc066caae45b21fc5a8

    • SHA512

      9cd7e84b15743bba2b420b17fdc92b7c9b79fb4ad87ab089313662a640ae080154d351522b82adb4e8d624e48d31594d2c51193ccb5b5ab3368956791bba07f5

    Score
    10/10
    modiloaderxloaderecuuloaderpersistenceratsuricatatrojan

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Command-Line Interface

1
T1059

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Scripting

1
T1064

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks