General

  • Target

    W6902.xlsx

  • Size

    187KB

  • Sample

    220128-zpal2adcek

  • MD5

    9a0e6f87707210a385ef8ed3bf348de3

  • SHA1

    800a9f004b17cd24413eb98c2f6d9fcd02128887

  • SHA256

    41b58cddca86e32e7034daf8e97dcdaa04ac6cdcb41eae86be1c3fa7fd05c871

  • SHA512

    e35a536e9d68da1cc14ea854d977490ed6865cc756c23d479d6a37572f004c2f6b0ab475c9f765434588c827721b3fbc72cf5a33cf6144b92fc205bdc7a96269

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b80i

Decoy

yixuan5.com

jiazheng369.com

danielleefelipe.net

micorgas.com

uvywah.com

nbjcgl.com

streets4suites.com

hempgotas.com

postmoon.xyz

gaboshoes.com

pastodwes.com

libes.asia

damusalama.com

youngliving1.com

mollyagee.com

branchwallet.com

seebuehnegoerlitz.com

inventors.community

teentykarm.quest

927291.com

Targets

    • Target

      W6902.xlsx

    • Size

      187KB

    • MD5

      9a0e6f87707210a385ef8ed3bf348de3

    • SHA1

      800a9f004b17cd24413eb98c2f6d9fcd02128887

    • SHA256

      41b58cddca86e32e7034daf8e97dcdaa04ac6cdcb41eae86be1c3fa7fd05c871

    • SHA512

      e35a536e9d68da1cc14ea854d977490ed6865cc756c23d479d6a37572f004c2f6b0ab475c9f765434588c827721b3fbc72cf5a33cf6144b92fc205bdc7a96269

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks