Overview

overview

10

Static

static

PROFORMA INVOICE.xlsx

windows7_x64

10

PROFORMA INVOICE.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PROFORMA INVOICE.xlsx

  • Size

    310KB

  • Sample

    220112-kvfynscacn

  • MD5

    f3413ff9501018c53c2d69e8df9da4a5

  • SHA1

    77baed712f614ed086dd9713d05d13cbc3300e85

  • SHA256

    23c430e7c7c5d5d73fd7fbfcc0d48c2cc421e757e044065d60de5fa9a92c6bb4

  • SHA512

    6dc5e95b607220276de2964cdf440ea89db983d1b2bac141abc5d8ffd9d6e05eabeabe6ad106fda7752e29123ac0c2a3be4a7b985c34ef09bec57df60cb27dcf

Score
10/10
xloadernt3floaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nt3f

Decoy

tricyclee.com

kxsw999.com

wisteria-pavilion.com

bellaclancy.com

promissioskincare.com

hzy001.xyz

checkouthomehd.com

soladere.com

point4sales.com

socalmafia.com

libertadysarmiento.online

nftthirty.com

digitalgoldcryptostock.net

tulekiloscaird.com

austinfishandchicken.com

wlxxch.com

mgav51.xyz

landbanking.global

saprove.com

babyfaces.skin

Targets

    • Target

      PROFORMA INVOICE.xlsx

    • Size

      310KB

    • MD5

      f3413ff9501018c53c2d69e8df9da4a5

    • SHA1

      77baed712f614ed086dd9713d05d13cbc3300e85

    • SHA256

      23c430e7c7c5d5d73fd7fbfcc0d48c2cc421e757e044065d60de5fa9a92c6bb4

    • SHA512

      6dc5e95b607220276de2964cdf440ea89db983d1b2bac141abc5d8ffd9d6e05eabeabe6ad106fda7752e29123ac0c2a3be4a7b985c34ef09bec57df60cb27dcf

    Score
    10/10
    xloadernt3floaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks