General

  • Target

    090900 Quotation - Urgent.xlsx

  • Size

    269KB

  • Sample

    211013-hsr7tadfg8

  • MD5

    efdb3073607b0e44e67b7436fdb70f5b

  • SHA1

    bac5f9c3aa6e6fae7034d6a1fc9197b1090b4f0e

  • SHA256

    c13a3022f2212e4e16fb2147f6fd0c09ed4439a49b4313603a5e48b7b3174167

  • SHA512

    30efeeb74b2c0bec55e1d0abb8147da25f212e58b0a66a8e8d4f3c83142de43b347ffa6043399867774bb3deca446fd4de5eb1b5010d98c532cfec8fca2181ec

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Targets

    • Target

      090900 Quotation - Urgent.xlsx

    • Size

      269KB

    • MD5

      efdb3073607b0e44e67b7436fdb70f5b

    • SHA1

      bac5f9c3aa6e6fae7034d6a1fc9197b1090b4f0e

    • SHA256

      c13a3022f2212e4e16fb2147f6fd0c09ed4439a49b4313603a5e48b7b3174167

    • SHA512

      30efeeb74b2c0bec55e1d0abb8147da25f212e58b0a66a8e8d4f3c83142de43b347ffa6043399867774bb3deca446fd4de5eb1b5010d98c532cfec8fca2181ec

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Tasks