Overview

overview

10

Static

static

WellKnownC...nt.exe

windows7_x64

10

WellKnownC...nt.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WellKnownClientTypeEnt.exe

  • Size

    547KB

  • Sample

    211022-senmksbge5

  • MD5

    b3449aa97273b29d2429a1abc2d25c9f

  • SHA1

    22ff56a9c0b2ffe72afa4f9371a3a4e27ec34dfe

  • SHA256

    d69f6026a70bc45556d12b572cf6bf82ac7ce6db8731141eaeb88db396ed90d4

  • SHA512

    4b17af75ef8fb4f91e4b050613194d3ba437b89efbdc9f0403741a02d966a998161c367227bd8909c01f0fc75c4d6bbb5931b946653d018818e0679c53ac07c6

Score
10/10
formbookxloadera49iloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

a49i

C2

http://www.jywltx.com/a49i/

Decoy

myprobioticspayme.com

shavers.today

cinqueportshealthcare.com

itmservicesincne.com

credit-comparison.com

xn--2kr800ab2z.group

onlinebiyoloji.online

risaki.net

americasgotargument.com

rosinterpro.com

cortadoresdejamon.biz

hotamourclub.art

boettcherlaw.com

nuciic.com

redesdelraco.com

chivang.com

yourkstreetexperience.com

yourwaykeji.com

natureate.com

bidyawasterecycling.com

Targets

    • Target

      WellKnownClientTypeEnt.exe

    • Size

      547KB

    • MD5

      b3449aa97273b29d2429a1abc2d25c9f

    • SHA1

      22ff56a9c0b2ffe72afa4f9371a3a4e27ec34dfe

    • SHA256

      d69f6026a70bc45556d12b572cf6bf82ac7ce6db8731141eaeb88db396ed90d4

    • SHA512

      4b17af75ef8fb4f91e4b050613194d3ba437b89efbdc9f0403741a02d966a998161c367227bd8909c01f0fc75c4d6bbb5931b946653d018818e0679c53ac07c6

    Score
    10/10
    formbookxloadera49iloaderpersistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks