General

  • Target

    10009.xlsx

  • Size

    317KB

  • Sample

    211214-tehl1ahaam

  • MD5

    5ea9a54df6bf0928d589e6061a1a424a

  • SHA1

    dcce37653dfa705267dc580092fb37fbc7d8a608

  • SHA256

    9f8906ad8010ef647b3efd1a27db09fb13f7e43261026d3ae4475740c5f1908a

  • SHA512

    a4d21559dcdb1a54839ce62e7a3b173af84493360de527eb135010a2c5d4061ef78a2f8cdee101261903eb3759d864f4b441f2df079b4c6a5927d3fe6c96853c

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Targets

    • Target

      10009.xlsx

    • Size

      317KB

    • MD5

      5ea9a54df6bf0928d589e6061a1a424a

    • SHA1

      dcce37653dfa705267dc580092fb37fbc7d8a608

    • SHA256

      9f8906ad8010ef647b3efd1a27db09fb13f7e43261026d3ae4475740c5f1908a

    • SHA512

      a4d21559dcdb1a54839ce62e7a3b173af84493360de527eb135010a2c5d4061ef78a2f8cdee101261903eb3759d864f4b441f2df079b4c6a5927d3fe6c96853c

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks