Overview

overview

10

Static

static

QUOTATION ...F.xlsx

windows7_x64

10

QUOTATION ...F.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTATION REQUEST - SUPPLY OF PRODUCTS - DTD JANUARY 2022PDF.xlsx

  • Size

    187KB

  • Sample

    220124-gzxv7sdeaq

  • MD5

    8ecafed44ea096b7fd229ae3497de0bf

  • SHA1

    7ebf9f0f231d66306d456abfc47bc211ce1b7b55

  • SHA256

    8f0c93c132573c57f4e96e4dfec4eab60264895f70b173b3f307476a3ff0bf47

  • SHA512

    020ae8088dccd272b3a6f8373dc8de03613c5db526fa066eea8d1e5ef739544ed36947c7f0c7fe97f8860b2128b789d9fb66338b5300a50c4afa45b05dbbc3a8

Score
10/10
xloaderpnugloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Targets

    • Target

      QUOTATION REQUEST - SUPPLY OF PRODUCTS - DTD JANUARY 2022PDF.xlsx

    • Size

      187KB

    • MD5

      8ecafed44ea096b7fd229ae3497de0bf

    • SHA1

      7ebf9f0f231d66306d456abfc47bc211ce1b7b55

    • SHA256

      8f0c93c132573c57f4e96e4dfec4eab60264895f70b173b3f307476a3ff0bf47

    • SHA512

      020ae8088dccd272b3a6f8373dc8de03613c5db526fa066eea8d1e5ef739544ed36947c7f0c7fe97f8860b2128b789d9fb66338b5300a50c4afa45b05dbbc3a8

    Score
    10/10
    xloaderpnugloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks