General

  • Target

    Lod4.xlsx

  • Size

    186KB

  • Sample

    220131-e1zp3sfeh8

  • MD5

    56ef6b1e6fd2fc1dc0f874684946e22d

  • SHA1

    933a7a76510252a38d95f66b5da8027c8e670e0d

  • SHA256

    ee125af12f2e57274d9319559690ab1c9403ddacc9bb337e7109c189ecf64a91

  • SHA512

    269c136ceb741510781a3cf0e08aea1004a84631712bdc890195c4f4d11cb2238c3e3338e659081aae2dc9ef43f0679e934734132467c6fef67c6ddea8383f28

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ndf8

Decoy

cantobait.com

theangularteam.com

qq2222.xyz

floridasteamclean.com

daffodilhilldesigns.com

mindfulagilecoaching.com

xbyll.com

jessicaepedro2021.net

ccssv.top

zenginbilgiler.com

partumball.com

1681890.com

schippermediaproductions.com

m2volleyballclub.com

ooiase.com

sharingtechnology.net

kiminplaka.com

usedgeartrader.com

cosyba.com

foodfriendshipandyou.com

Targets

    • Target

      Lod4.xlsx

    • Size

      186KB

    • MD5

      56ef6b1e6fd2fc1dc0f874684946e22d

    • SHA1

      933a7a76510252a38d95f66b5da8027c8e670e0d

    • SHA256

      ee125af12f2e57274d9319559690ab1c9403ddacc9bb337e7109c189ecf64a91

    • SHA512

      269c136ceb741510781a3cf0e08aea1004a84631712bdc890195c4f4d11cb2238c3e3338e659081aae2dc9ef43f0679e934734132467c6fef67c6ddea8383f28

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks