General

  • Target

    2022 Project Proposal.xlsx

  • Size

    187KB

  • Sample

    220131-n471ashff2

  • MD5

    04ac21a7f53f1272fdbeda43806427e2

  • SHA1

    79b5696e2e262573d4523cc158f4b296fe524626

  • SHA256

    301c7c22b62e1a034bdfe23c52e2bddf35701ae8ec20f4f25d8729eeaf533d78

  • SHA512

    265e154b1fa3634c3ecb7b15cc0de2f7660b47cda35f87c207414f3074041f689eed96d4eab84d32bc5acc0ebc764184ef977627f440f451ac981c5d741a673f

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nt3f

Decoy

tricyclee.com

kxsw999.com

wisteria-pavilion.com

bellaclancy.com

promissioskincare.com

hzy001.xyz

checkouthomehd.com

soladere.com

point4sales.com

socalmafia.com

libertadysarmiento.online

nftthirty.com

digitalgoldcryptostock.net

tulekiloscaird.com

austinfishandchicken.com

wlxxch.com

mgav51.xyz

landbanking.global

saprove.com

babyfaces.skin

Targets

    • Target

      2022 Project Proposal.xlsx

    • Size

      187KB

    • MD5

      04ac21a7f53f1272fdbeda43806427e2

    • SHA1

      79b5696e2e262573d4523cc158f4b296fe524626

    • SHA256

      301c7c22b62e1a034bdfe23c52e2bddf35701ae8ec20f4f25d8729eeaf533d78

    • SHA512

      265e154b1fa3634c3ecb7b15cc0de2f7660b47cda35f87c207414f3074041f689eed96d4eab84d32bc5acc0ebc764184ef977627f440f451ac981c5d741a673f

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets service image path in registry

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Scripting

1
T1064

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Tasks