General

  • Target

    DOC.exe

  • Size

    480KB

  • Sample

    210916-k1622sfdhq

  • MD5

    66fc712a2dc1321fa0fc6bdf8bcd82a5

  • SHA1

    7870ac22e3c8233430e0c5df62c72397f29e1294

  • SHA256

    b092672d7f36d3deaab664c0a562b055f9cee3f247328e639aca58f025f979ca

  • SHA512

    d0c101943eb61750234a838e1c5b2571996c64c5f0800272656d74e79dd60e9737e3c5326978ff6dacdd32bde71b88b46e0b4b9e87cde7e09f1246bb3667e7d7

Malware Config

Extracted

Family

xloader

Version

2.4

Campaign

n58i

C2

http://www.nordicbatterybelt.net/n58i/

Decoy

southerncircumstance.com

mcsasco.com

ifbrick.com

societe-anonyme.net

bantank.xyz

dogecoin.beauty

aboutacoffee.com

babalandlordrealestate.com

tintgta.com

integrity.directory

parwnr.icu

poltishof.online

stayandstyle.com

ickjeame.xyz

currentmotors.ca

pond.fund

petrosterzis.com

deadbydaylightpoints.com

hotel-balzac.paris

focusmaintainance.com

Targets

    • Target

      DOC.exe

    • Size

      480KB

    • MD5

      66fc712a2dc1321fa0fc6bdf8bcd82a5

    • SHA1

      7870ac22e3c8233430e0c5df62c72397f29e1294

    • SHA256

      b092672d7f36d3deaab664c0a562b055f9cee3f247328e639aca58f025f979ca

    • SHA512

      d0c101943eb61750234a838e1c5b2571996c64c5f0800272656d74e79dd60e9737e3c5326978ff6dacdd32bde71b88b46e0b4b9e87cde7e09f1246bb3667e7d7

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Discovery

System Information Discovery

1
T1082

Tasks