Overview

overview

10

Static

static

W6902.xlsx

windows7_x64

10

W6902.xlsx

windows10_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    W6902.xlsx

  • Size

    187KB

  • Sample

    220131-e1zp3sehdl

  • MD5

    69795e78fb23e13a62ebc183ef90b3ed

  • SHA1

    e16a17d9001daf722aab876d3dab010218af2a23

  • SHA256

    acc4be02b6d345725689351b0de0b19ea35f356a60df8cf92318fe9ff96e474f

  • SHA512

    77d20558c55569551b3e232a5b3f500ae5056fb13634a50bbadcda1ebdfefe6685d04479a6ae01e58c2a7ec3d0565c887a53d74000d7fe6b5c1404267fb4f651

Score
10/10
xloaderb80iloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

b80i

Decoy

yixuan5.com

jiazheng369.com

danielleefelipe.net

micorgas.com

uvywah.com

nbjcgl.com

streets4suites.com

hempgotas.com

postmoon.xyz

gaboshoes.com

pastodwes.com

libes.asia

damusalama.com

youngliving1.com

mollyagee.com

branchwallet.com

seebuehnegoerlitz.com

inventors.community

teentykarm.quest

927291.com

Targets

    • Target

      W6902.xlsx

    • Size

      187KB

    • MD5

      69795e78fb23e13a62ebc183ef90b3ed

    • SHA1

      e16a17d9001daf722aab876d3dab010218af2a23

    • SHA256

      acc4be02b6d345725689351b0de0b19ea35f356a60df8cf92318fe9ff96e474f

    • SHA512

      77d20558c55569551b3e232a5b3f500ae5056fb13634a50bbadcda1ebdfefe6685d04479a6ae01e58c2a7ec3d0565c887a53d74000d7fe6b5c1404267fb4f651

    Score
    10/10
    xloaderb80iloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks