Overview

overview

10

Static

static

tmp/1ee280...28.xls

windows7_x64

10

tmp/1ee280...28.xls

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp/1ee280cb4130d09c2739d4e89cfd0aaa3a2a996d86606e43d4d42e29ac73ca28.xls

  • Size

    310KB

  • Sample

    220111-m4tx1afegn

  • MD5

    f4d6c1f8616c2d921abe653049bf2b37

  • SHA1

    41b4ede1e3f10a46b029a75cc472132ad1afae84

  • SHA256

    1ee280cb4130d09c2739d4e89cfd0aaa3a2a996d86606e43d4d42e29ac73ca28

  • SHA512

    77e02662535a351eccfdf8884f78920befb20e2fd5ff7c7d1cf762ae476967361fa4b09140c9d4bda9204dfdfd92e7a4658fd85768a2ac5b2c91a17649e670e7

Score
10/10
xloaderef6cloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Targets

    • Target

      tmp/1ee280cb4130d09c2739d4e89cfd0aaa3a2a996d86606e43d4d42e29ac73ca28.xls

    • Size

      310KB

    • MD5

      f4d6c1f8616c2d921abe653049bf2b37

    • SHA1

      41b4ede1e3f10a46b029a75cc472132ad1afae84

    • SHA256

      1ee280cb4130d09c2739d4e89cfd0aaa3a2a996d86606e43d4d42e29ac73ca28

    • SHA512

      77e02662535a351eccfdf8884f78920befb20e2fd5ff7c7d1cf762ae476967361fa4b09140c9d4bda9204dfdfd92e7a4658fd85768a2ac5b2c91a17649e670e7

    Score
    10/10
    xloaderef6cloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks