General

  • Target

    Order-EM7110509-pdf.pif

  • Size

    247KB

  • Sample

    220125-jqzpjsbeh3

  • MD5

    6965c35c75220ac5a5d4f3ab46cf4363

  • SHA1

    e4691bf844e64f3f05dda96ab50f8875979f65d6

  • SHA256

    fb45dfc26c736d67a8c409194b6f0e503a4519be42dfd1eaa7b7efb026d7c512

  • SHA512

    638c27f985560c0f9e7021cffd44a5c586f1c4a73d86c655e157d9167a6703d26961c2f6508c6a9aa850868042483b6878e97d644b9f0c7dcbd88e08076057b4

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

uar3

Decoy

sgadvocats.com

mjscannabus.com

hilldaley.com

ksdollhouse.com

hotgiftboutique.com

purebloodsmeet.com

relaunched.info

cap-glove.com

productcollection.store

fulikyy.xyz

remoteaviationjobs.com

bestcleancrystal.com

virtualorganizationpartner.com

bookgocar.com

hattuafhv.quest

makonigroup.com

officecom-myaccount.com

malgorzata-lac.com

e-learningeducators.com

hygilaur.com

Targets

    • Target

      Order-EM7110509-pdf.pif

    • Size

      247KB

    • MD5

      6965c35c75220ac5a5d4f3ab46cf4363

    • SHA1

      e4691bf844e64f3f05dda96ab50f8875979f65d6

    • SHA256

      fb45dfc26c736d67a8c409194b6f0e503a4519be42dfd1eaa7b7efb026d7c512

    • SHA512

      638c27f985560c0f9e7021cffd44a5c586f1c4a73d86c655e157d9167a6703d26961c2f6508c6a9aa850868042483b6878e97d644b9f0c7dcbd88e08076057b4

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Adds policy Run key to start application

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

3
T1112

Discovery

System Information Discovery

2
T1082

Tasks