General

  • Target

    tmp/885a3f3c6c82f70a36a07cc47a0655ec01283f28863aa8c216f6ffa73f77bf2e.xls

  • Size

    317KB

  • Sample

    211220-qrcdzaafd7

  • MD5

    207b94d9cc8b9af2ccc9ff119cf94ae5

  • SHA1

    2c562a8c366f4ae564e7b6e9264212fb602429bf

  • SHA256

    885a3f3c6c82f70a36a07cc47a0655ec01283f28863aa8c216f6ffa73f77bf2e

  • SHA512

    0feef63885c908f399d794496b420b514ca67b6874440ddba7d8972250f6c1384278155a5b7ee2917cef95ac167705a75cc6ae8ad9fedfdb7575426fd74e7354

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Targets

    • Target

      tmp/885a3f3c6c82f70a36a07cc47a0655ec01283f28863aa8c216f6ffa73f77bf2e.xls

    • Size

      317KB

    • MD5

      207b94d9cc8b9af2ccc9ff119cf94ae5

    • SHA1

      2c562a8c366f4ae564e7b6e9264212fb602429bf

    • SHA256

      885a3f3c6c82f70a36a07cc47a0655ec01283f28863aa8c216f6ffa73f77bf2e

    • SHA512

      0feef63885c908f399d794496b420b514ca67b6874440ddba7d8972250f6c1384278155a5b7ee2917cef95ac167705a75cc6ae8ad9fedfdb7575426fd74e7354

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks