General

  • Target

    tmp/2fe50cd698c141231db5d547de06e846312bbddaa3d5e8be0e012cc61de114ed.xls

  • Size

    310KB

  • Sample

    220111-m6k3wafcg8

  • MD5

    95cbc1f3891ed39e56fa3196a060f94e

  • SHA1

    ca003b9444c4eebeb468985bf53db7f7db52a4a8

  • SHA256

    2fe50cd698c141231db5d547de06e846312bbddaa3d5e8be0e012cc61de114ed

  • SHA512

    163f3d915abdc6042c6f7c39e0b7f7adc7a79a6e7ec96908d352ac1de3292a3c59b3bf7c5be56967249ea0dbc6a8763a0c18efd269195d3d44973aec0023b57c

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Targets

    • Target

      tmp/2fe50cd698c141231db5d547de06e846312bbddaa3d5e8be0e012cc61de114ed.xls

    • Size

      310KB

    • MD5

      95cbc1f3891ed39e56fa3196a060f94e

    • SHA1

      ca003b9444c4eebeb468985bf53db7f7db52a4a8

    • SHA256

      2fe50cd698c141231db5d547de06e846312bbddaa3d5e8be0e012cc61de114ed

    • SHA512

      163f3d915abdc6042c6f7c39e0b7f7adc7a79a6e7ec96908d352ac1de3292a3c59b3bf7c5be56967249ea0dbc6a8763a0c18efd269195d3d44973aec0023b57c

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks