Overview

overview

10

Static

static

REF_MIDLGB34.xlsx

windows7_x64

10

REF_MIDLGB34.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    REF_MIDLGB34.xlsx

  • Size

    327KB

  • Sample

    211014-j87swagegj

  • MD5

    18427b9e1b0494341170d883e691888d

  • SHA1

    bb19d8da9b524b1749ad517fe4ddde5aa0d9745d

  • SHA256

    20d0bd1ac88343ffc84035773ddb7ea0dcf14525fa9da7d3d8fd11239ab100fa

  • SHA512

    8ad87486ef0a10a5cc8feceb9c6abdc3950c715e7241f79c209ab33f2dacb6699b23c72ee777d567049e85cd6589793183a7dedf8e4126ddaa059ed764076aa6

Score
10/10
xloaderrqanloaderpersistenceratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

rqan

C2

http://www.cardboutiqueapp.com/rqan/

Decoy

panda.wiki

gailkannamassage.com

ungravitystudio.com

coraggiomusicschool.com

51walkerstreetrippleside.com

infemax.store

mapara-foundation.net

elitespeedwaxs.com

manateeprint.com

thelocksmithtradeshow.com

phoenix-out-of-ashes.com

marionkgregory.store

abasketofwords.com

century21nokta.com

anthonyaarnold.com

forevermyanmar.com

ramashi.com

uniquecarbonbrush.com

packecco.com

appelnacrtl.quest

Targets

    • Target

      REF_MIDLGB34.xlsx

    • Size

      327KB

    • MD5

      18427b9e1b0494341170d883e691888d

    • SHA1

      bb19d8da9b524b1749ad517fe4ddde5aa0d9745d

    • SHA256

      20d0bd1ac88343ffc84035773ddb7ea0dcf14525fa9da7d3d8fd11239ab100fa

    • SHA512

      8ad87486ef0a10a5cc8feceb9c6abdc3950c715e7241f79c209ab33f2dacb6699b23c72ee777d567049e85cd6589793183a7dedf8e4126ddaa059ed764076aa6

    Score
    10/10
    xloaderrqanloaderpersistenceratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks