General

  • Target

    Orsha_NSC Contract 290720 Order for new shipment.xlsx

  • Size

    556KB

  • Sample

    210917-x3z3qsgdc5

  • MD5

    72d057ebfb1aa881ffee0cae72724866

  • SHA1

    a35397bed6c5368e2b9196557af225222163faf2

  • SHA256

    1707f694fc15ee93a6f06725c6a4cfe1283f6553a442a957f7b5fc646f003466

  • SHA512

    6b867c53a4ee8e1f844f170c17d98071cb11e75ef0b9ea735cc2eb8bc37d9f61223f37736ecc59010f414c91f0097da0411df6eec354d4b619d379c47295ed62

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b6a4

C2

http://www.helpmovingandstorage.com/b6a4/

Decoy

gr2future.com

asteroid.finance

skoba-plast.com

rnerfrfw5z3ki.net

thesmartroadtoretirement.com

avisdrummondhomes.com

banban365.net

profesyonelkampcadiri.net

royalloanhs.com

yulujy.com

xn--naqejahan-n3b.com

msalee.net

dollyvee.com

albertagamehawkersclub.com

cbspecialists.com

findingforeverrealty.com

mrtireshop.com

wadamasanari.com

growtechinfo.com

qipai039.com

Targets

    • Target

      Orsha_NSC Contract 290720 Order for new shipment.xlsx

    • Size

      556KB

    • MD5

      72d057ebfb1aa881ffee0cae72724866

    • SHA1

      a35397bed6c5368e2b9196557af225222163faf2

    • SHA256

      1707f694fc15ee93a6f06725c6a4cfe1283f6553a442a957f7b5fc646f003466

    • SHA512

      6b867c53a4ee8e1f844f170c17d98071cb11e75ef0b9ea735cc2eb8bc37d9f61223f37736ecc59010f414c91f0097da0411df6eec354d4b619d379c47295ed62

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks