General

  • Target

    Unpaid invoice 76810091.xlsx

  • Size

    440KB

  • Sample

    211026-psx7dshdf2

  • MD5

    b8cf81e69b571ec7612d5b2ec8a66682

  • SHA1

    d4da3acfca6d028d8ec56b92c84af760f8c075f6

  • SHA256

    46ca11e597ee7173e77a1cd8ca582943b099afc05921bf566937637c34dc41d0

  • SHA512

    3e330457c41ed77aeb1bceabc128197229787027640456c5e7508a8696a6d05c5d101b1687cbe911adb2eebfb85fae7b741224b50cc8fa0ddb871430c356b56c

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b2c0

C2

http://www.thesewhitevvalls.com/b2c0/

Decoy

bjyxszd520.xyz

hsvfingerprinting.com

elliotpioneer.com

bf396.com

chinaopedia.com

6233v.com

shopeuphoricapparel.com

loccssol.store

truefictionpictures.com

playstarexch.com

peruviancoffee.store

shobhajoshi.com

philme.net

avito-rules.com

independencehomecenters.com

atp-cayenne.com

invetorsbank.com

sasanos.com

scentfreebnb.com

catfuid.com

Targets

    • Target

      Unpaid invoice 76810091.xlsx

    • Size

      440KB

    • MD5

      b8cf81e69b571ec7612d5b2ec8a66682

    • SHA1

      d4da3acfca6d028d8ec56b92c84af760f8c075f6

    • SHA256

      46ca11e597ee7173e77a1cd8ca582943b099afc05921bf566937637c34dc41d0

    • SHA512

      3e330457c41ed77aeb1bceabc128197229787027640456c5e7508a8696a6d05c5d101b1687cbe911adb2eebfb85fae7b741224b50cc8fa0ddb871430c356b56c

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks